Connect Claude to the Safeguard MCP server, ask it questions about the SBOM your vendor sent, and confirm the important answers with the CLI. The assistant is a faster way to read results. The vendor's data quality and your own judgment still decide the outcome.
How do you connect Claude?
Per the Safeguard docs, the Claude server URL is https://mcp.safeguard.sh/mcp/anthropic, and the general one is https://mcp.safeguard.sh/mcp. Add the URL in Claude, and you are sent to Safeguard's sign-in page at app.safeguard.sh. Check the app name and host, then choose Authorize access. Safeguard also appears in the Claude connectors directory. Per the MCP page, setup steps for Claude live in a dedicated guide at safeguard.sh/mcp/claude. Use it for the clicks.
Which tools will the assistant have?
The docs describe categories: vulnerabilities, SBOMs, packages, licenses, findings, compliance, remediation plans, SBOM comparison, SCM integrations and policy gates. Visibility is per tenant. A new workspace starts with six read-only tools for browsing products, projects, vulnerabilities and findings, and an administrator enables the rest per tool under Feature Flags. If your first question fails, ask your admin which tools are on.
What should you ask about the SBOM?
Start with the vendor's file loaded into your workspace through the normal intake. Then ask in plain language:
- Which components in this SBOM have known critical vulnerabilities?
- Which of them are reachable, if reachability data exists for this product?
- Which licenses appear, and do any conflict with our policy?
- How does this version differ from the last SBOM we received?
- What is missing: components without versions or supplier names?
An SBOM comparison category exists in the docs, which is what the fourth question relies on. If the tool for it is off in your workspace, the assistant will say so.
How do you check the answers?
Do not stop at the chat. Take the vendor's file and verify the headline facts yourself. The CLI can validate an SBOM against SPDX and CycloneDX with safeguard validate, and scan it with safeguard scan and the sbom option. Read the vuln.json output to see the same matches. If chat and CLI disagree, trust neither until you find out why.
Also read the SBOM for quality. A file with few components for a large product, or no versions, is a finding about the vendor, whatever the scan says.
What to do
- Add the Claude connector with the URL from the docs and authorize with OAuth.
- Ask your admin to confirm which tools are enabled.
- Load the vendor SBOM into your workspace.
- Ask the five questions above and note the answers.
- Validate and scan the same file with the CLI and compare.
- Write up the gaps and send them to the vendor with a deadline.
- Keep the SBOM, your notes and the vendor's reply together, dated.
What does a weak vendor SBOM look like?
A few signs show up quickly. The component count is tiny for a large product, which suggests only top level dependencies are listed. Versions are missing or say "latest," which makes matching to vulnerabilities impossible. There is no supplier or origin information. The file has no timestamp, so you cannot tell if it matches the current release. Or it was exported once, a year ago, and never refreshed.
When you see these, do not just score the vendor. Send a specific list of gaps and ask for a corrected file by a date. Ask whether they generate it from the build or write it by hand, since build generated files are usually more complete.
A vendor that answers quickly with a better file is telling you something good about how they work. One that cannot produce a file at all is telling you something too. Record both in your vendor review.
Quick check
Can Claude read the SBOM without my loading it?
The assistant can only use what the enabled tools expose. Load the file into your workspace first.
Do I need an npm package to connect?
No. The docs say Safeguard publishes no npm package for this server. You add the URL in the assistant.
Sources
Last reviewed: 18 October 2026.
