How do you review a vendor SBOM with Safeguard in ChatGPT?

To review a vendor SBOM with Safeguard in ChatGPT, add Safeguard as a custom MCP server at mcp.safeguard.sh, sign in with OAuth, then ask ChatGPT to list the SBOM, surface critical vulnerabilities, and compare it with an earlier version. Treat the answers as leads, and confirm important ones in the Safeguard app.

What is a vendor SBOM good for?

A software bill of materials is a nested inventory, a list of the ingredients that make up a piece of software, as CISA puts it. When a supplier sends you one, you can check what they ship against known vulnerabilities, licenses and your own policy. NTIA's multistakeholder work defined common SBOM formats and how to produce and consume them, and it lists SPDX, CycloneDX and SWID as the key formats. CISA also describes VEX, a companion document that states whether a product is affected by a given vulnerability.

An SBOM is a starting point, not a verdict. It says what is inside, not whether the vendor's use of a component is exploitable. Ask for VEX statements when you can.

How do you connect Safeguard to ChatGPT?

According to the Safeguard documentation, the recommended path is a custom MCP server. You need a Safeguard account at app.safeguard.sh first.

1. In ChatGPT, open Plugins, select the plus button, then Add custom MCP server.
2. Enter a name, such as Safeguard Security, and a description.
3. Under Connection, enter the MCP server URL https://mcp.safeguard.sh/mcp.
4. Choose OAuth for authentication. ChatGPT registers itself, so there is no key to copy.
5. Read the risk warning, select that you understand and want to continue, then create the plugin.
6. When ChatGPT sends you to Safeguard, sign in, check the app name and the host that will receive the authorization code, and click Authorize access.

Nothing is installed locally. Safeguard says it publishes no npm package or local bridge for its MCP server, so treat any package claiming to be one as untrusted. If you do not see the option in ChatGPT, your workspace administrator controls custom MCP servers.

Tools are gated. A new Safeguard workspace starts with a small read-only set, and an administrator turns on the rest tool by tool. If your assistant cannot see what you expect, that is usually why. MCP tool calls are unlimited on every Safeguard plan.

Try the walkthrough at /demos/mcp-server-setup.

What do you ask once it is connected?

The docs list sample prompts such as listing your security projects, finding critical vulnerabilities and showing all SBOMs. Once the vendor's SBOM is in your Safeguard workspace, build on those:

• "Show me all SBOMs and tell me which one is from this vendor."
• "Find critical vulnerabilities in this SBOM."
• "Which packages violate my license policy?"
• "Compare this SBOM with the previous release and list what changed."

The server can compare SBOMs in both CycloneDX and SPDX formats, which helps when a vendor changes tools between releases.

What should you check yourself?

Language models can misread or overstate. Before you act:

• Open the finding in the Safeguard app and read the underlying record.
• Check whether the vulnerable component is actually reachable in the vendor's product. The SBOM alone cannot tell you that.
• Confirm the SBOM is complete. A short list for a large product is a red flag worth raising with the vendor.
• Keep your own notes of what you asked and what you decided. They are your audit trail.

A word on access

Your assistant acts as you. It can see and do only what your Safeguard role allows, within the tools your workspace has switched on. Do not share an MCP key with a client you do not trust. OAuth avoids that problem, so prefer it.

What to do

1. Create or confirm your Safeguard account and role.
2. Add the custom MCP server in ChatGPT with OAuth.
3. Ask an administrator to enable the read tools you need.
4. Load the vendor SBOM into your workspace.
5. Ask for critical findings, license issues and a comparison with the last release.
6. Verify the top findings in the app, and send the vendor specific questions, including a VEX request.
7. Record the decision and the evidence.

Quick check

Sources

• Safeguard docs: connect Safeguard to ChatGPT
• Safeguard docs: MCP Integrations
• CISA: Software Bill of Materials
• NTIA: Software Bill of Materials

Last reviewed: 18 October 2026.