The Safeguard runner is part of the CLI. It claims scan jobs for your tenant, runs them on your own machine and uploads SBOMs and findings, never source, according to the CLI documentation. Use it when the code cannot leave your network.
What the documentation says
Run the CLI with the runner command and it opens the on premises runner, which claims and runs scan jobs for your tenant. A status command shows the registration. The CLI site's example shows a 30 second poll interval. The CLI documentation states that the runner executes platform scan jobs locally and uploads SBOMs and findings, never source.
The download page describes two flavours of CLI use: a local one that runs on your machine or in your pipeline and sends only the results, and a cloud one that runs on Safeguard's infrastructure so no local runner is needed.
When it fits
Pick the runner or local CLI when source code must stay inside your network, when builds happen on self hosted agents, or when a security review forbids a hosted service cloning your repository. Pick the cloud route when you accept the platform reading the repository and want the least maintenance.
This is the same choice as in connect the repository or run the CLI, seen from the data handling side.
Putting it on a CI agent
A long running agent can host the runner as a service. A short lived container cannot, since it would register and vanish. Think about how your agents live before you choose. The documentation does not give a service or container recipe for the runner, so this is a design question to settle with Safeguard support.
Sign in
The CLI authenticates with the OAuth device flow, which needs a person to approve it. The system configuration page says there is no API key variable and no variable that points the CLI at a config file. How unattended runners should authenticate is therefore not documented on those pages. Confirm the supported method before building automation around it.
Air gapped use
For machines with no internet, the documentation describes importing a vulnerability database downloaded elsewhere and placing scanner binaries in a tools directory. It also names variables that turn off update checks. A separate air gapped deployment guide exists.
What to ask before you commit
Ask which exact artifacts leave your network, what is encrypted in transit, and how unattended sign in works. The pages we read do not answer the first and last of these, so get them in writing.
Network and approval
Whatever you pick, involve your network team early. The runner polls the platform, so it needs outbound access, and many regulated environments need that allowed explicitly. Write down the destinations, and have the data handling answers reviewed before the first production scan, not after.
Quick check
Does the runner upload my source code?
The documentation says it uploads SBOMs and findings, never source.
Can I run it in an ephemeral CI container?
The documentation does not cover that. Ask before you design around it.
Sources
- Safeguard docs: CLI
- Safeguard CLI site
- Safeguard docs: CLI system configuration
- Safeguard download page
Last reviewed: 19 October 2026.
