In Cursor, install the Safeguard extension from Open VSX, sign in with the device flow, then use the command palette to generate an SBOM, export it, and compare it with the previous one. The docs list CycloneDX and SPDX as export formats. Public package scanning works without login.
How do you install it?
Cursor uses the Open VSX registry, not the VS Code Marketplace. Safeguard's IDE support page says Cursor gets the same package as VS Code, version 5.1.0 at the time of writing. Install from the Extensions view by searching "Safeguard," or run cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension. The download page also lists Open VSX for Cursor, Windsurf, Codium and compatible editors.
The extension activates automatically when a workspace contains package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or Gemfile. Supported package managers are npm, Yarn and pnpm, pip, Poetry and Pipenv, Maven and Gradle, Go modules, Cargo and Bundler.
How do you sign in?
Run Safeguard: Login from the command palette. A browser opens at app.safeguard.sh/activate with a verification code. Approve it and the tenant ID fills in automatically, with tokens kept in the editor's encrypted credential storage. Device codes expire after 10 minutes per the docs, so re-run Login if you time out. You can also open the activation URL on another machine and approve there.
How do you generate and export the SBOM?
The docs list three SBOM commands for VS Code and Cursor: Generate SBOM, Export SBOM and Compare SBOM with Previous. Open the command palette and type "Safeguard: Generate SBOM." The Safeguard view in the activity bar also has an SBOM panel next to Vulnerabilities, Compliance and Recommendations, and Export Report on any panel saves findings.
The comparison table on the page lists SBOM export as CycloneDX and SPDX. We did not find a description of exact file names, locations or per-ecosystem differences, so check what your first export looks like before you script around it.
The safeguard.enableSBOM setting is on by default. If the panel is missing, check it.
Open the dependency inventory demo
Why compare an SBOM with the previous one?
The comparison answers "what changed?" A pull request that bumps one dependency may move five transitive ones. A diff of the inventory shows added, removed and changed components, which is what a reviewer needs and what a lockfile diff makes hard to read. Compare before you merge, and keep the exported files with the release so you can answer questions later.
For audit trails, the docs also describe an Export Security Report command.
What are the limits?
- Everything above is documented for VS Code and Cursor. The JetBrains plugin's docs do not describe SBOM export.
- The SBOM reflects what the extension can resolve from your manifests and lockfiles. Commit your lockfile first.
- A local export is not a signed attestation. If you need to give customers an SBOM, check what your tenant provides for that.
- Package Firewall inline checks, a separate feature, are on by default in VS Code and Cursor and evaluate names as you type.
A small routine for teams
- Generate an SBOM at every release branch cut and store both formats.
- Run Compare SBOM with Previous when reviewing dependency pull requests.
- Record the exported file names in the pull request description.
- Use the vulnerability panel to fix findings before pushing.
What to do
- Install the extension from Open VSX in Cursor and log in.
- Open a project with a lockfile and run Generate SBOM.
- Export in CycloneDX or SPDX, depending on what your consumers ask for.
- Make a dependency change, generate again, and run the comparison.
- Store exports with the release.
Quick check
Why is the extension on Open VSX for Cursor?
Cursor uses the Open VSX registry, not the VS Code Marketplace, so the same package is published there.
Which SBOM formats does it export?
The IDE support page lists CycloneDX and SPDX for VS Code and Cursor.
Sources
Last reviewed: 18 October 2026.
