Asking Claude about a package with the Safeguard MCP server

You can connect Safeguard to Claude and ask about your projects, vulnerabilities and findings in plain language. A dedicated "check this package before I install it" tool is not named in Safeguard's MCP docs. For a true pre-install check, use the Package Firewall command in the CLI, and use Claude to understand what you find.

How do you connect Claude?

Safeguard's MCP server is hosted, so there is nothing to install. The connector is named Safeguard Security and its URL is https://mcp.safeguard.sh/mcp/anthropic.

The documented routes:

1. Connector directory. While signed in to claude.ai, open Safeguard's entry in Claude's connector directory, select Safeguard, connect, then sign in to Safeguard, check the app name and host, and click Authorize access.
2. Manual setup. In Claude, go to Customize, then Connectors, click Add, then Add custom connector. Enter the name and URL, continue past the OAuth prompt, pick when to sign in, choose Register automatically, and click Add. Then sign in to Safeguard and authorize.

On Team or Enterprise plans an Owner or Primary Owner adds the connector under Organization settings, then Connectors, and members connect it afterwards. For Claude Desktop, the docs say not to edit claude_desktop_config.json: it uses the connector from your Claude account.

Open the MCP server setup demo

What can you ask once connected?

The docs list capabilities: querying vulnerabilities, SBOMs, packages, licenses, findings and compliance data, generating remediation plans for npm, pip, Maven, Go and Cargo projects, comparing SBOMs in CycloneDX and SPDX, and running policy-gate checks. Example prompts include "Find critical vulnerabilities," "Show me all SBOMs," and "Which packages violate my license policy?"

The tool gating page names the six read-only tools a new workspace starts with: list products, list projects, get a project, list vulnerabilities, get one vulnerability with CVSS and remediation, and list findings. Everything else stays off until an administrator enables it under Feature Flags. So what Claude can do in your workspace depends on what your admin turned on, and on your Safeguard role.

So, can it vet a package before install?

Look at what is documented. A package you already depend on appears in your projects and SBOMs, so Claude can tell you about its vulnerabilities and licenses. A package you have not added yet is a different case. The pages we read do not name a package-check tool, and the gating page says it does not give a complete tool list, only that you can search Feature Flags by keyword. So we cannot promise one exists in your workspace. Ask your admin to search before you plan around it.

For the install moment itself, the documented option is the Package Firewall. A one-shot check exits 1 on a block: safeguard pkgfw check, passing the ecosystem, package name and version as options. It covers npm and pip. Its checks include typosquats, namespace confusion, known-malicious signatures and static inspection of the package archive.

A workable routine

1. Before adding a dependency, run the CLI check for npm or pip packages.
2. After adding it, ask Claude: "Find critical vulnerabilities in my project" or "Which packages violate my license policy?"
3. Ask Claude to generate a remediation plan, and review it as you would a colleague's suggestion.

What are the limits and cautions?

Safeguard says it publishes no npm package or local bridge for its MCP server, and that you should treat any package claiming to be one as untrusted. Setup instructions that rely on environment variables like SAFEGUARD_API_KEY are outdated. OAuth is the default sign-in. MCP keys exist for clients that can only send a fixed header, and an administrator must enable API-key MCP access first. Tool calls are unlimited on every plan, but the docs note the Free plan of Claude allows one custom connector.

An assistant can only see and do what your Safeguard role allows.

What to do

1. Connect Safeguard to Claude using the connector directory, or the manual steps.
2. Ask your admin which tools are on, and to search Feature Flags for package and scan tools.
3. Use safeguard pkgfw check before installing unfamiliar npm or pip packages.
4. Use Claude for questions about projects you already scan.
5. Never install a third-party package claiming to be the MCP server.

Quick check

Sources

• Safeguard docs, MCP server
• Safeguard docs, Connecting to Claude
• Safeguard docs, Tool availability and gating
• Safeguard docs, Package Firewall

Last reviewed: 18 October 2026.