Which Safeguard surface should I use: desktop, CLI, IDE or browser?

Pick the surface that matches where you already work. Developers usually start in their editor or terminal. Managers and security leads often start in the desktop app, the web interface or an AI chat. All surfaces talk to the same platform and the same findings, so you can switch later without losing anything.

TL;DR

• A surface is just a way in: an app, an editor extension, a terminal tool, a browser add-on or a chat connector.
• The download page says every surface talks to the same platform and the same findings.
• Developers: editor extension or CLI. Leads: desktop, web or chat. Anyone on a phone: the iOS or Android app.
• If you only want a quick check with no install, use the free scan at gold.safeguard.sh/scan.

Definition: A surface, in this post, means one way of using the same product. The desktop app, the editor extension and the command line are three surfaces for one platform, like a bank you can reach by app, by branch or by phone.

What surfaces does Safeguard offer?

The Safeguard download page lists these. This table shows only what that page describes.

Griffin is Safeguard's AI assistant, named on the download page. The page also says the Safari extension is included in the Safeguard app on iPhone and iPad, and that the Mac version is in Apple review.

How do I choose by role?

I write code every day

Start in your editor. It shows problems next to the code that caused them. See our guide to adding scanning to VS Code or JetBrains. If you live in a terminal, or want the same scan in your pipeline, install the CLI. See the CLI guide.

The CLI runs on your own machine. It uploads results, never source code, and its built-in assistant can also write code, such as updating a dependency. It asks before it acts, depending on your permission setting.

I lead a team or own the risk

Start with the desktop app or the web interface. Both give you the whole platform: search, scans, SBOMs, compliance and reporting. An SBOM is a software bill of materials, the ingredient list of your software. You can ask questions in plain English and see findings across projects in one queue.

I approve things on the move

The iOS and Android apps give you the same answers on a phone. The download page says the stores are the way to install. The APK file is there for phones without the Play store, or for a company that hands out apps itself.

I use an AI chat all day

Connect Safeguard to Claude or ChatGPT, or any MCP client, and ask there. See our post on using Safeguard from Claude or ChatGPT.

I just want to try it

Use the free scan. You can paste a dependency file or upload an SBOM and check up to 100 dependencies against the Gold corpus. It needs no login. If you want something hands on without touching your own code, the download page lists a cloud sandbox, hosted by Safeguard, against a seeded demo repo, free for seven days with no card.

What should I know before I install?

A few honest notes from the download page.

• Windows desktop builds are not yet code signed. The page says Windows SmartScreen shows a "Windows protected your PC" warning, that the warning is expected, and that you can verify the checksum if you want certainty. The macOS builds are signed with the company's Developer ID and notarized by Apple.
• Checksums are published. A checksum is a short fingerprint of a file. Compare it with what you downloaded.
• The Linux desktop build is an AppImage. It needs no installer. You mark it executable and run it.
• Browser extensions can read page content. The page says the Safeguard extension can read and change content on websites you visit so that Griffin can carry out tasks you give it. The Gold Open Source extension is a separate launcher that never reads page content.
• Android has two routes. Google Play handles updates. With the APK file, updates come from the download page.

If you are in a company with an IT team, tell them first. Some tools may need approval.

Can I combine surfaces?

Yes, and most teams do. A common pattern:

1. A developer uses the editor extension while writing code.
2. The CLI or a connected repository runs the scan in the pipeline.
3. A security lead reviews findings in the desktop or web app.
4. Someone asks the AI chat for a quick summary before a meeting.

Because the platform and findings are shared, these are four views of one set of data. A fix you make in the editor shows up in the next scan everyone sees.

What does choosing look like with invented numbers?

The numbers below are invented to show the thinking.

A team of 12 has 9 developers, 1 engineering manager, 1 security lead and 1 product manager.

Everyone starts in a place they already know. Nobody needs a long training session. After a week, the team reviews what they actually used and drops what they did not.

What are the first three steps for any surface?

1. Try the free scan at gold.safeguard.sh/scan to see a result in a few minutes.
2. Pick one surface from the table and install it on one machine.
3. Look at one finding from start to finish: read it, check whether it is reachable, and decide what to do. Our guide on what to fix first helps.

How can Safeguard help?

Whichever surface you pick, the generally available capabilities behind it are the same: SBOM and dependency scanning, reachability analysis, zero day discovery, asset discovery, policies, gates and guardrails, MCP Guardrail, agent identity, compliance and evidence automation, and autonomous remediation with fix pull requests. Remediation is off by default, and every category starts on Manual.

Try it yourself

Click through it at your own pace, or open it full screen.

Click through the eight steps and look at the single queue of findings for a product. That is the shared view every surface leads back to.

Quick check

Sources

• Safeguard download page
• Safeguard product demos
• Vulnerability management demo
• Safeguard Gold, Free Dependency Scan
• CLI documentation

Last reviewed: 19 October 2026.