Use the CLI when the work is repeatable and should run without you, the web app when many people share a view, and the desktop app when you want a fast native window for your own exploration. Most teams end up using two of the three, not one.
What each surface is good at
The command line suits anything that belongs in a script or pipeline. It is scriptable, it runs the same way every time, and it needs no window. The download page offers CLI 1.4.0 with curl and PowerShell installers.
The web app suits shared work: dashboards for a manager, a review everyone opens from a link, nothing to install.
The desktop app, version 3.2.2 on the download page, is a native window that opens instantly and lets you query what you have scanned in plain English. It suits an engineer exploring a question alone.
A task by task guide
- Fail a build on new findings: CLI
- Weekly review with a manager: Web app
- Why is this package in our tree?: Desktop or CLI
- Onboarding a new teammate: Web app, then Desktop
- Quick check of a manifest: Desktop or the free scan
- Scripted inventory export: CLI
Consider your constraints
Install rights. The Windows Desktop installer needs no administrator rights, but a web app needs no install at all. Where you cannot install anything, the browser wins.
Offline or restricted networks. A native window does not by itself mean offline operation, and the download page does not claim that. Check how your own setup behaves before relying on it.
Platform. Desktop covers Windows 10 and 11, macOS 12 or later, and 64-bit Linux. On Linux, the page says the CLI must also be installed, so there you will have both anyway.
Automation. Anything that must run when nobody is looking cannot depend on a window. Put it in the CLI.
Avoid the common mistake
Teams often click through issues in a window every day and call it a process. If the same check runs more than twice a week, script it. A person should spend time on decisions, not on repeating lookups. The pre pull request dependency checklist shows which checks to move into a script first.
Share one source of truth
Whichever surface you favour, agree on where the official answer lives. If the desktop view and the web view disagree because one scan is older, people lose trust in both. Record the scan time next to any number you quote.
Where Safeguard fits
Safeguard provides all of these surfaces, plus IDE extensions, browser extensions and mobile apps, so the choice can follow the task instead of the vendor. For a first look without installing anything, use the free scan at gold.safeguard.sh/scan.
Quick check
Do I need the CLI if I use Desktop?
On Linux the page says the CLI must be installed and on your PATH. Elsewhere it is optional, but useful for scripts.
Which surface is best for CI?
The command line, because it runs unattended.
Sources
Last reviewed: 19 October 2026.
