In Cursor, install the Safeguard extension from Open VSX, log in, and scan your project. Findings show as inline warnings, and the built in AI assistant can answer questions about a flagged package. The reachability verdict lives in the Safeguard web app, so check it there before you decide how urgent a fix is.
What does the extension do in Cursor?
Cursor installs extensions through the Open VSX registry, and Safeguard publishes the same package there as for VS Code. Per the docs it activates automatically when the workspace has a manifest such as package.json, requirements.txt, pom.xml, go.mod, Cargo.toml or a Gemfile.
Scanning covers npm, Yarn, pnpm, pip, Poetry, Pipenv, Maven, Gradle, Go modules, Cargo and Bundler. Auto scan and scan on save are on by default. Scanning public packages works without logging in. Backend verified Package Firewall verdicts and notifications need a login.
How do you set it up?
- Open Extensions in Cursor, search for Safeguard, and click Install.
- Run the command Safeguard: Login. A browser opens at app.safeguard.sh/activate for an OAuth device flow. Codes expire after ten minutes, so approve promptly.
- Run Safeguard: Scan Project for Vulnerabilities, or let scan on save do it.
- Open the Safeguard view in the activity bar. It has Vulnerabilities, SBOM, Compliance and Recommendations panels.
How do you triage one finding?
Say a lockfile pulls in a package with a high severity advisory. A reasonable order of questions:
First, read the hover. Hovering the flagged dependency gives a summary and a quick fix lightbulb. Run Safeguard: Show Vulnerability Details for the full record.
Second, ask. Open the AI assistant with Safeguard: Open AI Assistant, or Safeguard: Ask AI Assistant with a question. The docs give the style of question it handles, for example whether an upgrade to a new major version is a good idea. Ask what the advisory affects and what the upgrade changes. Treat the answer as a lead to confirm, not a verdict.
Third, check reachability. The Safeguard docs say reachability analysis combines static call graph analysis, a runtime collector, and configuration parsing. Verdicts are reachable, conditional, unreachable and unknown, and unknown is treated as possibly reachable. The Reachability column sits next to Priority on the Vulnerabilities tab in the web app. The IDE docs do not say the extension displays reachability, and they do not document a "why is this reachable" command in Cursor, so we do not claim one. Use the web app for that step.
Fourth, fix. The lightbulb offers Safeguard: Auto-Fix Vulnerability (Bump Version). The remediation strategy setting has three modes: Safe for minor updates only, Balanced (the default) for minor and patch updates, and Aggressive for the latest version. After the bump, run your tests. A patch version should still be tested.
Can Cursor talk to Safeguard over MCP instead?
Yes, as a separate path. The MCP server at mcp.safeguard.sh is hosted, nothing to install, and Cursor signs in with OAuth. A new workspace starts with six read only tools for products, projects, vulnerabilities and findings, and an administrator turns on others one at a time. That lets the agent in Cursor list findings for a project without leaving the editor. Which tools exist for your tenant is an admin setting, so check before building a workflow on one.
What to do
- Install the extension from Open VSX and log in.
- Scan the project and sort by severity.
- For each high finding, read the hover, ask the assistant, then check the Reachability column in the web app.
- Fix reachable and unknown findings first, with Balanced strategy, and run tests.
- Record anything you decide not to fix, with a reason and a review date.
Quick check
Does the Cursor extension come from the VS Code Marketplace?
No. Cursor uses Open VSX. Safeguard documents the same package on both registries.
Where do I see whether a finding is reachable?
In the Reachability column next to Priority on the Vulnerabilities tab in the Safeguard web app.
Sources
Last reviewed: 18 October 2026.
