Partly. The Safeguard extension for Cursor scans dependency manifests in your workspace, and its documentation does not describe importing a vendor SBOM file. For a vendor file, use Cursor as the workbench: read the document there, then run the Safeguard CLI in the integrated terminal to validate it and scan it.
What does the extension actually do?
Per Safeguard's IDE documentation, the same extension package serves VS Code and Cursor, and Cursor installs it through the Open VSX registry. It scans manifest files such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml and Gemfile as you work, flags vulnerabilities inline, and offers AI-assisted fixes. Its view in the activity bar has panels for Vulnerabilities, SBOM, Compliance and Recommendations, and you can export a report.
That SBOM panel concerns the project you have open. We found no documented command for loading someone else's CycloneDX or SPDX file into it, so this post does not promise one. Check the extension's current behavior before relying on any workflow beyond what the docs say.
So what is Cursor good for in a vendor review?
A vendor SBOM is a JSON or XML file, and reviewing it is mostly reading and checking. Cursor gives you a code editor with search, folding, diffs against last quarter's file, and an integrated terminal. That covers a lot.
How do you validate the file first?
Before asking what is in it, ask whether it is a valid SBOM. In Cursor's terminal, the CLI's validate command checks CycloneDX (JSON and XML), SPDX (JSON, YAML, tag-value and RDF) and VEX documents against their specifications:
safeguard validate vendor-sbom.json
safeguard validate vendor-sbom.json --strict -o report.json
The strict flag treats warnings as errors. A file that fails validation is a finding in itself, because tooling downstream may misread it. The CLI's scan command also accepts an existing SBOM in SPDX or CycloneDX, detected automatically.
How do you check what it says?
Read the file with these questions. They follow the idea of minimum elements: CISA and partners published 2026 Minimum Elements for an SBOM on 29 July 2026, replacing the 2021 NTIA baseline, so use that document as your checklist and read it directly.
- Completeness. Does the file list the vendor's own component and the dependencies beneath it, with names and versions, or only top-level libraries?
- Identifiers. Are components identified in a way you can match to advisories?
- Relationships. Does it show what depends on what?
- Freshness. Does it carry a timestamp, and does it match the product version you run?
- Authorship. Who produced it, and with which tool?
- Gaps. Are there components with no version or no supplier?
Searching the file for a package you know matters to you, such as one with a recent advisory, is a quick test of whether the SBOM is useful.
How do you match it against known vulnerabilities?
Run a scan on the vendor file:
safeguard scan --sbom vendor-sbom.json --format cyclonedx
Results are written as JSON files in an output folder, including vulnerability and license results. Note that the scan command exits with 0 when the scan ran, regardless of what it found, so read the files rather than trusting the exit code. Then open the findings in Cursor and sort by severity.
Treat the output as questions for the vendor, not as accusations. A vulnerable component might not be reachable in the vendor's product, and the vendor may have a VEX statement that says so. Ask for it.
What to do
- Install the Safeguard extension from Open VSX in Cursor and the CLI from cli.safeguard.sh.
- Save the vendor file into a review folder under version control.
- Validate it with the CLI and record the result.
- Check completeness, identifiers, relationships, freshness and authorship against the CISA 2026 elements.
- Scan it and read the vulnerability and license output.
- Write questions for the vendor, including a request for VEX statements on the findings that matter.
- File the SBOM, scan output and questions together so next year's review can diff against them.
Quick check
Does the extension import SBOM files?
Not according to the documentation we reviewed. It scans manifests in your workspace. Use the CLI to validate and scan a vendor SBOM file.
Why validate an SBOM before scanning it?
An invalid or partial file can hide components or break tools. Validation tells you whether the document itself meets the specification before you trust its contents.
Sources
- Safeguard docs: IDE Support, fetched 18 October 2026
- Safeguard docs: CLI usage, fetched 18 October 2026
- Safeguard CLI
- CISA, 2026 Minimum Elements for a Software Bill of Materials
Last reviewed: 18 October 2026.
