Add Safeguard to Claude as a custom connector at mcp.safeguard.sh, sign in, and ask questions about your SBOM data in plain language. To create the SBOM itself, use the Safeguard CLI, which builds one as part of a scan. Tool calls over MCP are unlimited on every plan.
What can the MCP server do with SBOMs?
The Safeguard MCP page describes the server as a way to connect an AI assistant directly to your software supply chain security data, so you can query vulnerabilities, SBOMs, findings and compliance in plain language. The page we read did not list individual tool names, so we do not describe them. Ask your questions normally and let Claude choose.
One honest limit: this post does not claim that Claude can generate an SBOM from source through the connector. Generation is a CLI task, covered next.
How do you make an SBOM first?
The Safeguard CLI docs at cli.safeguard.sh give these install commands:
- macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash - Windows:
irm https://cli.safeguard.sh/install.ps1 | iex
The docs say the installer verifies the release checksum before placing the binary on your path.
To scan a local directory: safeguard scan --dir .. Other inputs are --repo URL, --image REF and --sbom FILE for an existing SPDX or CycloneDX document. The docs describe building the SBOM as part of scan rather than a separate command, and they provide safeguard validate FILE to validate SBOM documents.
How do you connect Claude?
Safeguard is hosted, so nothing needs installing. The steps from the setup page for claude.ai and Claude Desktop:
- In Claude, open Customize, then Connectors, click Add, then Add custom connector. On a Team or Enterprise plan, an Owner adds it under Organization settings, then Connectors, and members click Connect.
- Name it Safeguard and enter the connector URL
https://mcp.safeguard.sh/mcp/anthropic. Click Continue. - Under Authentication choose Sign in now. Under OAuth client choose Register automatically. Click Add.
- Sign in to Safeguard, check the app name and the host receiving the authorization code, and click Authorize access.
Claude Desktop uses the connectors you add in Claude, so the same connector works there. The page says not to edit claude_desktop_config.json for this.
The default sign-in is OAuth 2.0 with PKCE. For platforms that can only send a static header, there is an MCP key option under Settings then Developer, available only if your workspace has API key access to MCP enabled. Ask your Safeguard administrator.
What should you ask once connected?
Start with questions you could verify by hand:
- Which components in this project have a known exploited vulnerability?
- Which findings are in direct dependencies, and which are transitive?
- What licenses appear in this SBOM that need review?
- What changed between the last two scans?
Check a few answers against the app. An assistant can summarize well and still misread a field, so keep a human check on anything that drives a decision.
Who controls access?
Tenant admins can switch off any client type, including MCP clients and Claude. Connect with the account that has the access you intend, since the connector acts through your sign-in.
Open the full demo at /demos/claude-with-safeguard.
What to do
- Install the CLI and run
safeguard scan --dir .on one repository. - If you already have an SBOM, check it with
safeguard validate. - Add the Safeguard connector in Claude using the steps above.
- Ask four verifiable questions and compare with the app.
- Review who in your organization can use the connector.
- Save the questions that worked as team prompts.
Quick check
Does the connector need a config file?
No for Claude. The setup page says Safeguard is hosted and you add it through Connectors, not by editing a config file.
Is there a limit on MCP tool calls?
Tool calls are unlimited on every plan.
Sources
Last reviewed: 18 October 2026.
