Safeguard on Huawei devices: MateBook, phones and what to use

Safeguard is not in Huawei AppGallery. If you have a Huawei MateBook running Windows, use the Windows desktop app, the Safeguard CLI and the browser extension. If your Huawei phone installs Android apps, you can use the direct APK from the download page. Otherwise, use the web interface or one of the cloud options.

The rest of this guide is the detail: which file to pick, how to check it, what to do when an install is blocked, and how to work with nothing installed.

You also do not have to give anything up to use Safeguard. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. And if you would rather stay in the chat you already use, connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from there.

Safeguard is one platform on every surface. You can start a scan in the terminal on your MateBook, continue the conversation in the desktop app, and check the findings later from your phone or a browser. What changes from device to device is only how you get in.

Which Safeguard build fits which Huawei device

Every fact in this table comes from the Safeguard download page, checked on 21 October 2026. Huawei AppGallery, HarmonyOS, the Microsoft Store and Apple Watch are not listed there, so this guide makes no claims about them.

Two lines in that table deserve a closer look. The APK is described on the download page as being "for phones without Play or a company that hands it out itself". It is not an AppGallery listing and Safeguard does not claim it is tested on any particular Huawei model or operating system version. If your phone runs Android apps, it is the route to try. If it does not, the web interface gives you the same platform in a browser.

The second is the CLI. The Windows desktop installer covers both x64 and ARM, but the CLI ships for Windows x86_64 only. The MateBook spec pages we checked, such as the MateBook 14 (2024), list Intel processors and Windows 11 Home, so the x86_64 build is the one that applies to them. If you own a different Windows laptop with an ARM chip, plan on the desktop app and the web interface, and check the CLI docs before you assume the terminal tool will run.

Huawei MateBook on Windows: desktop app, CLI and extensions

A MateBook running Windows is, for Safeguard's purposes, a Windows laptop. Everything the download page offers for Windows applies.

Install the desktop app

The desktop app gives you "ask your supply chain anything" in plain English in a native window. On Windows it is a single installer, Safeguard-3.2.2.exe, about 205 MB, for Windows 10 and 11.

1. Open safeguard.sh/download on the MateBook and download the Windows installer.
2. Before you run it, compare its SHA-256 hash with the value on the download page. In PowerShell:

Get-FileHash "$env:USERPROFILE\Downloads\Safeguard-3.2.2.exe" -Algorithm SHA256

Get-FileHash uses SHA-256 by default, so -Algorithm SHA256 is only there to make the intent obvious. The hash it prints must match the one on the page character for character. If it does not, delete the file and download it again.

3. Run the installer. It installs per user and does not ask for administrator rights, which matters on a work MateBook where you may not have them.
4. Because the build is not yet code-signed, Windows SmartScreen may show a warning. Once the hash matches, choose More info, then Run anyway.

That order is the point. The SmartScreen warning is expected for this build, and the hash check is how you know the file you are about to run is the one Safeguard published.

Watch for Windows in S mode

Some Windows laptops ship in S mode. Microsoft's FAQ says S mode allows users "to only install the apps from Microsoft Store". Safeguard is not in the Microsoft Store, so on a machine in S mode the desktop installer and the CLI will be blocked.

You can switch out of S mode from Settings, System, Activation, using the Go to the Store link under the Switch to Windows 11 Pro section. Microsoft is clear that "Switching out of S mode is one-way", so on a company laptop ask your IT team first. If you cannot or should not switch, the web interface and the cloud options still work.

Add the browser extension

The Safeguard browser extension, version 1.0.4, puts Griffin search in a side panel. On a MateBook you will most likely be using Edge or Chrome, and both install it from the Chrome Web Store. Firefox users install it from Firefox Add-ons. There is nothing Huawei specific here: it is the same extension on the same browsers.

Do the work properly with the Safeguard CLI

The desktop app is the comfortable way to ask questions. The CLI is where the work happens on a MateBook used for development. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan it.

For a longer walkthrough of the assistant on its own, see Use the Safeguard CLI as an AI assistant on your own machine.

Install

The CLI is a single static binary. There is no Node, Python or JVM to install first. On a Windows MateBook, open PowerShell and run:

irm https://cli.safeguard.sh/install.ps1 | iex

On macOS and Linux the equivalent is:

curl -fsSL https://cli.safeguard.sh/install | bash

The download page also lists the binaries directly: macOS Apple Silicon and Intel, Linux x86_64 and arm64, and Windows x86_64 as a zip. Windows on arm64 is not in that list.

Your first session

Run safeguard with no arguments to open the interactive terminal. Then:

/login
/scan .

/login signs you in through the browser. /scan . scans the current folder. After that you can ask in plain language, for example "how many critical vulns do we have" or "fix the lodash CVE in this repo".

A few commands you will use often: /model shows or switches the AI model, @ attaches a file from the folder you started in, and /resume picks up the last session in that folder.

The next demo shows the same idea from the other side: attach a computer running the Safeguard CLI and a folder, ask for a fix, review the diff and approve the command before it runs.

Click through it at your own pace, or open it full screen.

The demo itself notes that computer work from Search is "available, expanding", so treat it as a preview of where this is going rather than a finished feature list.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. That makes it useful beyond security. With your approval it can find and read files ("what's the latest file in ~/Downloads"), edit code, and run commands. Because it also knows your vulnerabilities, you can ask it to fix a specific finding and then scan the result in the same session.

It also works well as a second pass on what another coding agent changed. Run a scan on the branch before you merge, and ask the assistant to explain anything new. We cover that workflow in Check what your coding agent changed with the Safeguard CLI.

Use your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. To see which models are connected or to switch, use /model, and see the CLI docs for connecting a model.

Approvals

Tools that change things ask before they act. /permissions sets the approval mode:

• Ask: prompt before every action.
• Auto: approve known actions and ask for anything new. This is the default.
• Yolo: approve everything.

On a MateBook you also use for email and documents, Ask or Auto is the sensible setting. The current mode shows in the bar under the input.

Scans from the shell and in CI

Outside the interactive terminal, the same binary runs scans directly:

safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:tag
safeguard scan --sbom ./sbom.cdx.json

Each builds an SBOM and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json. To check an SBOM or VEX file someone sent you:

safeguard validate ./sbom.cdx.json

safeguard validate checks CycloneDX, SPDX and VEX documents. For CI, safeguard exec runs one non-interactive assistant turn:

safeguard exec "summarise the critical findings in this repository"

When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. Policies and gates are then evaluated in the platform, not by the CLI.

Huawei phones: using the direct Android APK

The download page offers Android two ways: Google Play for phones and tablets, and a direct APK, version 1.0.2 and about 69 MB, "for phones without Play or a company that hands it out itself". That second route is the one to look at if your Huawei phone does not have Google Play but can install Android apps.

Safeguard is not listed in Huawei AppGallery, and this guide does not claim the APK works on any particular Huawei model or operating system version. What we can say is what the download page says, and what Android's own documentation says about installing apps from outside a store.

Step by step

1. Download the APK. Open safeguard.sh/download in the phone's browser and choose the Android APK. If you prefer, download it on your computer first so you can check the hash there.
2. Check the SHA-256. The download page lists a SHA-256 for the APK. On a computer, run shasum -a 256 followed by the APK's file name on macOS or Linux, or Get-FileHash with the file's path in PowerShell, and compare the result with the page. Only continue if they match.
3. Allow the install. Android's developer documentation says it "blocks such installs until the user opts into allowing the installation of apps from other sources". On Android 8.0 and later that permission is per source: you allow the specific browser or file manager you are installing from on the Install unknown apps settings screen. The exact menu names vary by phone maker and version.
4. Open the APK and install it. Then sign in.
5. Turn the permission back off for that browser or file manager if you do not need it for anything else.

What changes compared with Google Play

The download page notes that updates for the APK come from the Safeguard site, not Google Play. Nothing will update the app for you. Check the download page now and then for a newer APK, and repeat the hash check each time.

If your phone is managed by your company, ask IT before you sideload anything. The download page names company distribution as one of the reasons the APK exists, so your IT team may already be handing it out through their own tools.

If your phone cannot install Android apps

Then do not try to force it. Use the web interface at app.safeguard.sh in the phone's browser, or one of the cloud options below. You get the same platform and the same data, with nothing installed.

Nothing to install: web interface, cloud options and the chat you already use

Some Huawei devices will not take any of the installers above. Some people simply do not want to install anything. Safeguard covers both.

• Web interface: the full platform in a browser at app.safeguard.sh, nothing to install.
• Cloud sandbox: a hosted, isolated sandbox tenant against a seeded demo repo. Free for seven days, no card. A good way to see what Safeguard does before you put your own code near it.
• Cloud computer: the full platform in your browser, hosted by Safeguard.
• Cloud browser: a remote browser session running Safeguard, streamed to your tab.
• Cloud CLI: the CLI running on Safeguard's infrastructure, so a scan needs no local runner.

One trade-off to understand. The local CLI and local runner keep your source code on your machine and upload only SBOMs and findings. The Cloud CLI runs on Safeguard's infrastructure instead. Both are valid. Pick the local route when keeping source on your own device matters, and the cloud route when installing is not an option.

The other no-install path is the chat you already use. If you work in Claude or ChatGPT in a browser, connect it to the Safeguard MCP server and ask about your projects and vulnerabilities from there. This demo shows ChatGPT connecting to the Safeguard MCP server with OAuth and choosing which tools it can use.

Click through it at your own pace, or open it full screen.

The same works for Claude: connect it to the Safeguard MCP server with OAuth and choose which tools Claude can use. Either way, the findings you see in chat are the same ones you see on the MateBook and in the web interface.

A day across devices

Here is how the pieces fit for someone with a MateBook and a phone without Google Play:

1. In the morning, on the MateBook, run safeguard in your project folder, /scan ., and ask the assistant to fix the one critical finding it reports. Approve the edit and the test command when it asks.
2. Before lunch, open the desktop app and ask in plain English which projects still have critical vulnerabilities.
3. On the train, open the Safeguard app you installed from the APK, or app.safeguard.sh, on the phone and check that the fix you pushed cleared the finding.
4. In the evening, from Claude or ChatGPT in a browser, ask Safeguard through the MCP connection for a summary to paste into tomorrow's standup.

Same platform, same data, four ways in.

Common mistakes on Huawei devices

Searching AppGallery for Safeguard

You will not find it there, and anything with a similar name is not ours. Get every Safeguard file from safeguard.sh/download.

Skipping the hash check because SmartScreen already warned

The SmartScreen warning tells you the Windows build is not code-signed yet. It does not tell you whether the file is the right one. The SHA-256 check does. Do it before More info and Run anyway, not after.

Downloading the APK from a mirror site

APK mirror sites are a common source of tampered apps. The only place to get the Safeguard APK is the Safeguard download page, and the hash on that page is how you confirm it.

Leaving "install unknown apps" switched on

Android grants that permission per source. Once Safeguard is installed, turn it off for the browser you used unless you have another reason to keep it.

Expecting automatic updates on the APK

Updates for the direct APK come from the Safeguard site. Put a reminder in your calendar to check the download page.

Assuming the Windows CLI runs on every Windows laptop

The CLI ships for Windows x86_64. The desktop installer covers x64 and ARM. If your laptop has an ARM chip, use the desktop app or the web interface and check the CLI docs.

Choosing Yolo on your everyday machine

Yolo approves everything. On a laptop that also holds your personal files, keep the CLI on Ask or Auto.

FAQ

Is Safeguard available in Huawei AppGallery?

No. Safeguard is not listed in Huawei AppGallery. The download page offers Android through Google Play and a direct APK, and the full platform through the web interface.

Can I use Safeguard on a Huawei MateBook?

Yes, if it runs Windows. Use the Windows desktop app (Windows 10 or 11, x64 and ARM, per user, no admin rights), the Safeguard CLI (Windows x86_64), and the browser extension from the Chrome Web Store or Firefox Add-ons.

Can I install Safeguard on a Huawei phone without Google Play?

If the phone installs Android apps, you can try the direct APK from safeguard.sh/download, which the page offers for phones without Google Play. Check the SHA-256 first. If it does not install Android apps, use the web interface or the cloud options.

Does Safeguard support HarmonyOS?

HarmonyOS is not listed on the download page, so we make no compatibility claim. On any device with a modern browser, the web interface works without installing anything.

Can I switch to Safeguard and keep my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

Does my source code leave the MateBook?

When the local runner runs platform scan jobs, your source code never leaves the machine. Only SBOMs and findings are uploaded. The Cloud CLI is different: it runs on Safeguard's infrastructure.

Will the APK update itself?

No. Updates for the direct APK come from the Safeguard site, not Google Play. Check the download page for new versions and repeat the hash check.

Can I try Safeguard before installing anything?

Yes. The cloud sandbox is a hosted, isolated tenant against a seeded demo repo, free for seven days with no card. The web interface at app.safeguard.sh also needs no install.

Try it yourself

This walkthrough covers installing and starting the CLI: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal. On a MateBook, pick Windows.

Click through it at your own pace, or open it full screen.

When you are ready, get the build for your device from safeguard.sh/download and read the Safeguard CLI docs. For more on how the assistant handles code, see the Safeguard CLI as a security-aware coding assistant.

Quick check

Sources

• Safeguard download page
• Safeguard CLI documentation
• Safeguard CLI interactive mode
• Safeguard CLI slash commands
• HUAWEI AppGallery
• HUAWEI MateBook 14 (2024) specifications
• Android developers: alternative distribution options
• Microsoft: Windows 10 and Windows 11 in S mode FAQ
• Microsoft Learn: Get-FileHash

Last reviewed: 21 October 2026.