The Safeguard CLI is a program you run in a terminal. It scans your software for known security flaws on your own machine, can preview and open fixes, and can also write code. According to its own page, only the results leave your computer, not your source code.
TL;DR: CLI means command line interface, a way to control a program by typing. Safeguard's CLI is a single file you install with one command. It scans a folder, a repository, a container image or a bill of materials, shows what it found, and can prepare fixes for you to review.
Definition: CLI (command line interface). A CLI is a program you use by typing short commands into a text window called a terminal, instead of clicking buttons. Many developer tools have one because commands are easy to repeat and to automate.
Why would anyone use a terminal tool instead of a website?
There are three reasons, and none of them is about being fancy.
First, the code is already there. Developers keep their projects on their own computers and in build systems. A tool that runs in the same place does not need to copy the code anywhere to look at it.
Second, commands can be repeated. If you type the same command each time, you get the same kind of check each time. You can also put the command in an automatic build, so every change is checked without anyone remembering.
Third, privacy. Some teams cannot or do not want to upload source code to an outside service. A tool that works locally avoids that question.
If you have never used a terminal, do not worry. You will type only a handful of commands, and our guide to your first scan with the Safeguard CLI shows them one at a time.
What does the Safeguard CLI do?
Based on the commands listed on the CLI page, here is what the main ones do in plain words.
| Command | What it does, in plain words |
|---|---|
safeguard login | Signs this computer in to your Safeguard account |
safeguard init | Writes a local settings file for your organization |
safeguard scan | Builds a list of components and matches them against known flaws |
safeguard resolve | Looks up a package and the libraries it depends on |
safeguard validate | Checks a bill of materials file against its official format |
safeguard fix | Updates vulnerable packages to safe versions and can open a pull request |
safeguard patch-image | Rebuilds a container image with patched layers |
safeguard report | Creates a report from an existing scan, for example for an auditor |
safeguard runner | Lets the platform schedule scans that run on your own machine |
safeguard update | Refreshes the local flaw databases the scanner uses |
You do not need all of them. Most people start with scan, then try fix with a preview.
The CLI can also write code. That means that after a scan finds a problem, the tool can help prepare the change itself, and you review it the way you would review a teammate's work.
What exactly can it scan?
The CLI page says safeguard scan accepts four kinds of input.
- A local folder. The simplest case: point it at your project.
- A Git repository. A Git repository is a project stored with its full history of changes. You can give the tool the address of one.
- A container image. A container image is a packaged bundle of an application and the files it needs to run.
- An existing bill of materials. A software bill of materials, or SBOM, is a list of every component inside an application. The CLI can read standard SPDX and CycloneDX files.
In each case, the scan builds a list of components and checks it against a database of known vulnerabilities. It reports by severity and shows the version that fixes each flaw, when one exists.
Where does my code go?
According to the CLI page, the scan, the dependency graph walk and the patching all happen on your machine. The platform sees only what you send it. The results, a bill of materials and a findings file, are the whole payload, and only when you upload them or when a runner job returns them.
That is a statement from the product's own page, so check it against your own policy and test it in your environment. Our post on whether the Safeguard CLI uploads your source code goes deeper on this question.
How do you preview a fix before it changes anything?
The CLI page says safeguard fix updates vulnerable packages to safe versions, writes a patched bill of materials and produces a fix report. Two options matter most:
--dry-runshows you what would change, without changing it.--create-propens a pull request with the change. A pull request is a proposal that people can read and approve before it joins the main code.
A careful routine looks like this:
- Run a scan and read the findings.
- Run the fix command with
--dry-runand read the planned changes. - If the changes look right, run it again with
--create-pr. - Have a person review the pull request.
- Rescan after it merges to confirm the problem is gone.
Our post on previewing dependency fixes with the Safeguard CLI walks through this with examples.
How do you install it?
The CLI page lists two installers. On macOS and Linux, run the curl installer. On Windows, use the PowerShell installer. The page says the installer detects your operating system and processor type, checks the release against published checksums, and puts one program on your path. It also says npm installation is coming soon, so do not rely on that yet.
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard scan --dir .
The page also suggests that you read the script before running it. That is good advice for any installer. Our post on installing the Safeguard CLI on macOS, Linux and Windows has the full steps.
What does a worked example look like?
All numbers below are invented for illustration.
A developer named Sam has a small web service. Sam runs safeguard scan --dir . and the tool reports 160 components across 4 ecosystems, with 2 high and 5 medium findings.
One high finding is in a library that has a fixed version. Sam runs the fix command with --dry-run. The preview shows one change: a version number moves from 4.17.11 to 4.17.21 in one file. That matches the finding.
Sam runs the command again with --create-pr, a teammate reads the one line change, the tests pass, and it merges. Sam rescans. The high finding is gone. Four medium findings remain, and Sam adds them to next week's plan.
The whole thing took Sam under half an hour, and every change was visible before it happened.
Where does the CLI fit with the rest of Safeguard?
The CLI is one way into the same platform. The download page lists the desktop app, editor extensions for VS Code, JetBrains and Open VSX, browser extensions, and mobile apps for iOS and Android. They all work with the same findings.
On the platform side, Safeguard offers reachability analysis, which shows which flaws your code can actually trigger. Policies and gates can block pull requests that break your rules. Autonomous fix pull requests are available but off by default, with every category set to Manual, so a person turns them on.
You can also try the free scan at gold.safeguard.sh/scan without installing anything.
Try it yourself
Open the demo below and watch the local runner work in the CLI. Look for which steps happen on your machine and what is reported back.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be a developer to use the CLI?
It helps to be comfortable with a terminal, but a first scan takes one or two commands. If you prefer clicking, the desktop app and the free web scan are alternatives.
Does the CLI send my source code to Safeguard?
According to the CLI page, no. The scan runs on your machine, and the results, a bill of materials and findings, are what the platform receives. Check this against your own security policy.
Can the CLI write code?
Yes. Besides scanning and preparing version fixes, it can also write code. As with any tool, review every change before it merges.
Can I install it with npm?
Not yet. The CLI page lists npm as coming soon. For now, use the curl installer on macOS and Linux or the PowerShell installer on Windows.
Sources
Last reviewed: 19 October 2026.
