In Cursor, the Safeguard extension scans your dependency manifests automatically when you open a project and again when you save one. It does not run on a clock. For a true schedule, pair it with platform continuous scanning, a recurring task in the desktop app (beta), or a CI cron job.
We read the Safeguard IDE documentation on 18 October 2026 and only describe settings and commands it lists.
How do you install it in Cursor?
Cursor installs extensions from the Open VSX registry, not the VS Code Marketplace. Open Extensions, search for Safeguard and click Install, or run this in a terminal:
cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension
Then run the command Safeguard: Login from the Command Palette. A browser tab opens at app.safeguard.sh/activate with a verification code. Approve the device, return to Cursor, and your tenant is filled in. The code expires after about ten minutes, so rerun the login if you wait too long.
Public package scanning works before you sign in. Some backend features, such as backend verified Package Firewall verdicts, need a login.
What runs automatically?
Two settings do the work, and both default to on. safeguard.autoScan scans the project when it opens. safeguard.scanOnSave rescans a manifest when you save it. A third, safeguard.scanDebounceDelay, waits 2000 milliseconds after you stop typing.
The extension activates when your workspace contains a package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or Gemfile. Results appear as inline warnings, in the Safeguard view and as hover cards on a flagged dependency. Results are cached for one hour by default.
You can also run a scan by hand. Safeguard: Scan Project for Vulnerabilities covers the workspace, and Safeguard: Scan Current File covers the open manifest.
What about a real schedule?
An editor extension only runs while the editor is open. For checks that must happen while nobody is coding, use one of these.
Continuous scanning. The platform re-evaluates assets when new vulnerability data arrives or an asset changes. No timer is needed.
Recurring tasks in the desktop app (beta). You can schedule a plain language task at an interval such as 24h and enable or disable it from the Tasks tab.
CI. Run the Safeguard CLI from your pipeline and use the CI system's cron trigger.
The editor then becomes the place where a finding is understood and fixed. The extension offers fix strategies named Safe, Balanced and Aggressive through safeguard.remediationStrategy, and the default is Balanced. A setting called safeguard.autoFixOnSave exists, but it is off by default and the documentation says to enable it with caution.
What to do
- Install the extension from Open VSX in Cursor and run Safeguard: Login.
- Leave
autoScanandscanOnSaveon. - Set
safeguard.severityThresholdto the lowest level you want to see, for example medium, so the panel stays readable. - Check
safeguard.excludePatternsso build output folders are skipped. - Pick a real schedule for unattended checks: continuous scanning, a desktop recurring task or CI cron.
- Keep
autoFixOnSaveoff until you trust the fix strategy on a branch.
Quick check
Does the Cursor extension scan on a timer?
No. It scans on project open, on save and on demand. For timed or unattended scans, use platform continuous scanning, the desktop app's recurring tasks or a CI schedule.
Why does Cursor use Open VSX?
Cursor installs extensions from the Open VSX registry. Safeguard publishes the same extension package there that it publishes to the VS Code Marketplace.
Open the full demo at /demos/gate-dev-ide.
Sources
Last reviewed: 18 October 2026.
