How do you triage a critical vulnerability with Safeguard in Claude?

Connect the Safeguard MCP server to Claude, ask it for your critical vulnerabilities, then triage each one on four questions: is it being exploited, can your code reach it, is a fix available, and does it sit somewhere exposed. Claude does the lookups in plain language. You make the call.

The server is hosted by Safeguard at mcp.safeguard.sh, and tool calls are unlimited on every plan. What you can ask depends on which tools your administrator has switched on.

How do you connect it?

Safeguard's docs describe two routes.

1. From Claude's connector directory. Safeguard is listed there. Select it, sign in to Safeguard, check the app name and the host that will receive the authorization code, and click Authorize access. This needs you signed in to claude.ai, and it may not be available on every plan or workspace.
2. As a custom connector. Create your account at app.safeguard.sh. In Claude, open Customize, then Connectors, click Add, then Add custom connector. Enter the name Safeguard Security and the URL https://mcp.safeguard.sh/mcp/anthropic. Claude detects OAuth. Choose Register automatically under OAuth client, click Add, then approve in Safeguard.

On a Team or Enterprise plan, an owner adds the connector first under Organization settings, and members then connect it. On the Free plan you can add one custom connector.

Claude Desktop uses the connectors in your Claude account, so you do not edit its local configuration file. The docs are explicit that Safeguard publishes no npm package or local bridge for this server, and that any package claiming to be one should be treated as untrusted.

What can Claude see?

The docs say a new workspace starts with a small read-only set of tools, and an administrator turns on the rest per tool. Once connected, Claude can query vulnerabilities, SBOMs, packages, licenses, findings and compliance data, and generate AI remediation plans for npm, pip, Maven, Go and Cargo projects. If a question returns less than you expected, ask your administrator which tools are enabled before assuming the data is missing.

A triage routine

Start broad, then narrow.

1. Ask for the list. A prompt from the docs works: "Find critical vulnerabilities." Ask Claude to group results by project.
2. Ask what is exploited. Ask whether any of the findings appear in CISA's Known Exploited Vulnerabilities catalog or carry a high EPSS score, if your tenant exposes those fields. KEV means exploitation has been observed in the wild, and EPSS estimates the chance of exploitation in the next 30 days.
3. Ask what is reachable. Safeguard describes reachability analysis as checking whether your code actually calls the vulnerable function. Ask Claude to show the reachability status for each remaining finding, and to say so plainly if the data is not available through its enabled tools.
4. Ask what is exposed. Is the affected service internet facing, handling regulated data, or only used in tests? You may need to supply this yourself.
5. Ask for the fix. "Generate a remediation plan for my npm project" is a docs example. Read the plan, including what a version bump could break.
6. Decide and record. For each finding, write one line: fix now, fix this sprint, accept with reason, or not affected, with a name and date.

Claude can summarize and propose. It can be wrong, so check any version number or advisory ID against the source before you act.

How should you phrase questions?

Specific beats general. "Which critical findings in the payments service are on the KEV list and have a fix available?" will get a better answer than "What should I worry about?" Ask Claude to cite the finding ID and package version for each item, so you can verify.

Open the full walkthrough at /demos/claude-with-safeguard.

What are the limits?

• Claude only sees what your enabled tools allow. Tenant administrators control this.
• An answer is as current as the data in Safeguard when you ask.
• Triage is a judgment. The tool provides facts, and the business context, such as which service earns revenue, comes from you.
• A chat transcript is not an audit record. Copy the decision into your ticketing system.

What to do

1. Connect the server using the directory or the custom connector steps.
2. Ask your administrator which tools are enabled, and request any you need for triage.
3. Run the six step routine on your current critical findings.
4. Record every decision outside the chat, with a reason and a review date.
5. Revisit accepted risks when a finding appears on the KEV list or its exploit probability rises.

Quick check

Sources

• Safeguard docs: Claude Integration
• Safeguard docs: Vulnerability Prioritization (Reachability Analysis)
• CISA, Known Exploited Vulnerabilities Catalog
• FIRST, Exploit Prediction Scoring System (EPSS)

Last reviewed: 18 October 2026.