Seeing only six tools after connecting is expected, not a bug. A new Safeguard workspace turns on a default set of six read-only tools for browsing products, projects, vulnerabilities and findings. Every other tool is off until a Safeguard administrator enables it per tool under Feature Flags. The same goes for an empty tools menu on a fresh workspace.
The six default tools
| Tool | What it does |
|---|---|
| safeguard_list_products | Lists products in the tenant |
| safeguard_list_projects | Lists projects in the current org or product |
| safeguard_get_project | Details for one project |
| safeguard_list_vulnerabilities | Lists vulnerabilities, filterable by severity, ecosystem, CVSS or exploit status |
| safeguard_get_vulnerability | Details for one CVE |
| safeguard_list_findings | Lists findings in an SBOM or project |
All six are reads. Nothing in the set can create, change or delete anything, or handle a credential. A client can approve the whole set at once without much worry.
Why it is built this way
Safeguard registers hundreds of tools across vulnerability management, SBOM analysis, findings, compliance, scanning, integrations and administration. Not every workspace wants every tool reachable by an AI assistant. So availability is decided per tenant, and the default is the narrowest useful slice.
Two design points follow from the documentation. First, a tool that is not enabled does not appear in the tool list at all. There is no greyed out entry. Second, if the server cannot work out your enabled set, for example during a brief outage, it falls back to the small default set instead of exposing more. An outage cannot widen what an assistant can do.
Checklist when the list looks wrong
- Confirm the connection itself succeeded. For OAuth, you clicked Authorize access. For an MCP key, the client sends a valid Authorization header.
- Check whether the list is exactly the six above. If so, nothing is broken.
- Ask your Safeguard administrator to enable the tools you need. Tool names follow the pattern safeguard, then a verb, then a noun, such as safeguard_scan_manifest.
- After a change, wait about a minute. Enabled tool resolution is rechecked on roughly that cadence.
- Restart or reconnect your assistant. Many clients fetch the tool list once per session and cache it.
Older workspaces may still have a few more tools on, such as add integration or scan repository, because they were created before the default set was narrowed. Feature Flags shows what yours has.
Who can change it
Feature Flags is an administrative screen. An administrator searches by name or filters by the mcp category, toggles a tool on, and saves. Resolution is per tenant, not per user, so everyone connecting under that tenant sees the same set. For a staged plan, see how to widen MCP tool access in stages.
Click through it at your own pace, or open it full screen.
Quick check
Is the six tool default a limit of my plan?
The documentation describes it as a default for new workspaces, with administrators enabling more. It is not described as a connection fault.
I enabled a tool and it still is missing. Why?
Give it about a minute, then restart the assistant session, since clients often cache the tool list.
Sources
Last reviewed: 19 October 2026.
