Use Safeguard with nothing to install: cloud sandbox, Cloud CLI, web

You can use Safeguard without installing anything. Start with the cloud sandbox, an isolated tenant against a seeded demo repo that is free for seven days with no card. Use the web interface, the cloud computer, the cloud browser or the Cloud CLI for real work. Move to the local CLI when you want source kept on your machine.

This guide walks through each no-install option, what it is for, how it compares with hosted sessions from other coding tools, and the signals that tell you it is time to install the local CLI.

Nothing here asks you to give up the tools you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. And if you would rather not install anything at all, connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already have open.

Safeguard is one platform on every surface. A question you start in a cloud session in the browser can continue in the desktop app later and be checked from your phone. The no-install options are simply the quickest way in.

Five ways to use Safeguard with nothing installed

Every description below comes from the Safeguard download page, checked on 21 October 2026.

The table splits into two groups. The cloud sandbox is a place to learn: its data is a seeded demo repo, not yours. The other four are ways to do real work on your own account without installing anything.

The cloud sandbox: seven days, no card

The sandbox is the lowest commitment way to see Safeguard. It is a hosted, isolated tenant built around a seeded demo repo, so you are looking at real platform behaviour on code that is safe to experiment with. It is free for seven days and does not ask for a card.

Because the repo is seeded, you do not have to connect GitHub, set up a runner or wait for a first scan of your own code before you have something to look at. That is the point of it.

Seven days goes quickly. Here is a plan that uses them well:

1. Day one: get oriented. Open the findings for the demo repo and ask plain questions, such as "how many critical vulns do we have" or "which package brings in the most high severity issues". Get a feel for how answers point back to projects and packages.
2. Day two: look at the SBOM. Every finding hangs off a component in a software bill of materials. Follow one vulnerability from the finding to the component, then to the dependency path that pulls it in.
3. Day three: reachability. Safeguard's reachability analysis is generally available. Where the demo shows it, look at which findings are reachable from the code and think about how that would change the order you fix things in.
4. Day four: policies and gates. Policies and gates are evaluated in the platform. Look at how they are set up, and sketch what your own team's first policy would be.
5. Day five: remediation. Autonomous remediation with fix PRs is generally available and off by default. Work out what you would want it to do on your own code before anyone switches it on.
6. Day six: plan the chat route. Decide whether your team would rather ask Safeguard from Claude or ChatGPT through the Safeguard MCP server, and which tools you would let it use.
7. Day seven: decide how you will work with your own code. That usually means the web interface for the team and the local CLI for developers.

What the sandbox shows depends on the seeded demo repo, so treat it as a tour. It tells you how the platform behaves, not what Safeguard will find in your code.

The web interface

The web interface is the full platform in a browser at app.safeguard.sh. There is nothing to install and nothing to update. It is the natural home for people who do not live in a terminal: security leads reviewing findings, managers checking status, auditors pulling reports.

It also works on any device with a modern browser, which makes it the fallback when an app is not available for your hardware.

The cloud computer and the cloud browser

These two sound alike and do different jobs.

The cloud computer is the full platform in your browser, hosted by Safeguard. The download page lists search, scans, SBOMs, compliance and reporting as part of it. Think of it as a complete Safeguard workspace that you reach through a tab.

The cloud browser is a remote browser session running Safeguard, streamed to your tab. The browser itself runs on Safeguard's side. That helps on machines where you can open a tab but cannot add extensions or apps.

The Cloud CLI

The Cloud CLI is the Safeguard CLI running on Safeguard's infrastructure, so a scan needs no local runner. You get the CLI's way of working without putting a binary on your own machine.

The trade-off is where the work happens. With the local CLI and local runner, your source code never leaves the machine; only SBOMs and findings are uploaded. With the Cloud CLI, the CLI runs on Safeguard's side. Pick the Cloud CLI when installing is not an option and that trade-off is acceptable for the code in question. Pick the local CLI when keeping source on your own device matters.

Use Safeguard from the chat you already use

The lightest no-install option is the chat window you already have open. If you use Claude or ChatGPT, you can connect it to the Safeguard MCP server and ask Safeguard questions from there.

This demo shows Claude connecting to the Safeguard MCP server with OAuth and choosing which tools Claude can use.

Click through it at your own pace, or open it full screen.

The same works for ChatGPT: connect it to the Safeguard MCP server with OAuth and choose which tools ChatGPT can use. Choosing tools is the step to take seriously. Give the chat the read tools you need for the questions you plan to ask, and add more later if you find a gap.

Once connected, the questions are the same ones you would ask anywhere else in Safeguard: which projects have critical vulnerabilities, what a given CVE affects in your estate, which findings came in this week. The answers come from your Safeguard data, scoped to your account.

How hosted sessions compare across tools

Safeguard is not the only tool with a hosted option. Several coding tools now run sessions on the vendor's infrastructure instead of your laptop. The table below uses only facts from each vendor's own documentation, fetched on 21 October 2026. It is a factual reference, not a ranking.

A few patterns stand out. Every hosted option moves your code, or a copy of it, to someone else's machines for the length of the session. Several tie into GitHub for cloning and pushing. And several are designed to keep working while your laptop is closed: Anthropic's docs say a cloud session "keeps running after you close your laptop", and OpenAI's say each Codex task "can keep working while your computer is asleep".

Safeguard's hosted options differ in purpose. The coding tools above host an agent that writes code. Safeguard's cloud options host a security platform that scans code, explains findings and tracks fixes. They work well side by side: an agent writes the change, and Safeguard checks it. If you are weighing the coding tools themselves, we cover them in Claude Code alternatives in 2026 and OpenAI Codex alternatives in 2026.

When to move to the local CLI

The no-install options are a good place to start and, for many people, a good place to stay. Developers usually reach a point where the local CLI makes more sense. These are the signals.

You want your source to stay on your machine

When the local runner runs platform scan jobs, your source code never leaves the machine. Only SBOMs and findings are uploaded. For private code with strict handling rules, that is often the deciding factor.

You want the assistant to change files in your repo

The local CLI's assistant has tools for your local files and for your Safeguard data. With your approval it can edit code, write files and run commands in the folder you started in. A hosted session cannot reach the folder on your laptop.

You want checks in CI

safeguard exec runs one non-interactive assistant turn, which is the shape a CI job needs. safeguard scan writes JSON results you can archive or parse.

You scan images and SBOMs that live locally

safeguard scan --image and safeguard scan --sbom work on what is on your machine. safeguard validate checks CycloneDX, SPDX and VEX files before you send them anywhere.

Your seven days are nearly up

If the sandbox convinced you, the next step is your own code, and for developers that usually means the local CLI.

Moving over, step by step

1. Install the CLI on your machine (commands below).
2. Run safeguard in a project folder and sign in with /login.
3. Run /scan . on a project you already know well, so you can judge the findings.
4. Ask the assistant to explain the top finding, then to fix it. Review the diff before you approve it.
5. Add safeguard exec to one CI job.
6. Keep the web interface for the rest of the team. It is the same platform and the same data.

Do the work properly with the Safeguard CLI

The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan it. For a fuller tour of the assistant, see Use the Safeguard CLI as an AI assistant on your own machine.

Install

It is a single static binary with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64, with Windows on x86_64 only.

On macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

Your first session

Run safeguard with no arguments to open the interactive terminal:

/login
/scan .

/login signs you in through the browser. /scan . scans the current folder. Then ask in plain language: "how many critical vulns do we have", "fix the lodash CVE in this repo", or something that has nothing to do with security, such as "what's the latest file in ~/Downloads".

Three commands help you settle in. /model shows or switches the AI model. @ attaches a file from the folder you started in. /resume picks up the last session in that folder.

Writing and fixing code

The assistant picks between your local files and your Safeguard data depending on the question. That means you can use it as a general terminal assistant: find and read files, edit code and run commands, with your approval. Because it also knows your vulnerabilities, a request like "fix the lodash CVE in this repo" can go from finding to edited code to a fresh scan in one session.

This demo shows the flow from Safeguard Search: attach a computer running the Safeguard CLI and a folder, ask for a fix, review the diff and approve the command before it runs.

Click through it at your own pace, or open it full screen.

The demo notes that computer work from Search is "available, expanding", so expect it to grow.

Using your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Use /model to see or switch models, and see the CLI docs for connecting one.

Approvals

Tools that change things ask before they act. /permissions sets the mode:

• Ask: prompt before every action.
• Auto: approve known actions and ask for anything new. This is the default.
• Yolo: approve everything.

Coming from a hosted sandbox, where nothing could touch your machine, start on Ask for the first few sessions. Move to Auto once you know what the assistant tends to do.

Scans and CI with safeguard exec

The same binary runs scans without the interactive terminal:

safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:tag
safeguard scan --sbom ./sbom.cdx.json
safeguard validate ./sbom.cdx.json

Each scan builds an SBOM and matches it against vulnerability databases. Results are JSON files under ./output, including vuln.json and license.json. In CI:

safeguard exec "summarise the critical findings in this repository"

Policies and gates are evaluated in the platform, not by the CLI, so the CLI's job in CI is to scan and report, and the platform decides whether a gate passes.

Common mistakes with the no-install options

Expecting the sandbox to show your own code

The sandbox runs against a seeded demo repo. It shows how Safeguard behaves, not what it will find in your projects. For that, use the web interface with your own account or the local CLI.

Putting real secrets into a demo environment

Treat any trial environment as a place for demo data. Do not paste production credentials or private code into it to test a theory.

Mixing up the cloud computer and the cloud browser

The cloud computer is the full platform hosted by Safeguard. The cloud browser is a remote browser session streamed to your tab. If you just want Safeguard in a browser on a normal laptop, the web interface is simpler than either.

Assuming the Cloud CLI keeps source local

It does not run on your machine. The guarantee that source never leaves your machine applies to the local runner, which uploads only SBOMs and findings.

Giving a connected chat every tool on day one

When you connect Claude or ChatGPT through MCP, you choose which tools it can use. Start with what your questions need.

Leaving the decision until day seven

The sandbox is free for seven days. Use the plan above so the last day is for deciding, not for a first look.

Turning on Yolo straight after installing

On a fresh install, Ask or Auto lets you see what the assistant wants to do before it does it.

FAQ

Can I use Safeguard without installing anything?

Yes. Use the web interface at app.safeguard.sh, the cloud computer, the cloud browser, the Cloud CLI, or connect Claude or ChatGPT to the Safeguard MCP server. To try it first, the cloud sandbox is free for seven days with no card.

What is the Safeguard cloud sandbox?

A hosted, isolated sandbox tenant against a seeded demo repo. It is free for seven days and needs no card. It is meant for seeing how the platform works before you connect your own code.

What is the difference between the Cloud CLI and the local CLI?

The Cloud CLI runs on Safeguard's infrastructure, so a scan needs no local runner. The local CLI runs on your machine; when the local runner runs platform scan jobs, your source code never leaves it and only SBOMs and findings are uploaded.

Can I keep using my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

When should I install the local CLI?

When you want source kept on your machine, want the assistant to edit files in your repo with your approval, want checks in CI with safeguard exec, or need to scan local images and SBOMs.

Does the local CLI change files without asking?

Tools that change things ask before they act. /permissions sets Ask, Auto (the default) or Yolo.

Which platforms does the local CLI run on?

macOS, Linux and Windows, on x86_64 or arm64, with Windows on x86_64 only. It is a single static binary.

Is Safeguard a replacement for Claude Code or Codex cloud sessions?

They do different jobs. Those hosted sessions run a coding agent. Safeguard's cloud options run a security platform that scans, explains and tracks fixes, and the Safeguard CLI adds an assistant that can write and fix code with your approval. Many teams will use both.

Try it yourself

When you are ready to move from the cloud to your own machine, this walkthrough shows the install and first run: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Start the sandbox or pick your build at safeguard.sh/download, and read the Safeguard CLI docs when you install locally.

Quick check

Sources

• Safeguard download page
• Safeguard CLI documentation
• Safeguard CLI interactive mode
• Safeguard CLI slash commands
• Claude Code docs: use Claude Code in the cloud
• OpenAI: Codex cloud
• GitHub Docs: about cloud and local sandboxes
• Docker Docs: cloud sandboxes

Last reviewed: 21 October 2026.