Coding agents are now a normal part of how software gets written. People use a range of them, including tools such as T3 Code and OpenCode, and the choice often comes down to workflow and taste.
Safeguard Code is another option. It is a local coding agent that writes and refactors securely by default, with security checks built in rather than bolted on afterward. This post explains what that means in practice, and how it fits with your existing setup.
What it is
Safeguard Code runs on your machine, in your terminal and in the desktop app. It works on your code like other coding agents: you describe a change, it proposes and makes edits.
The difference is what runs alongside the edits. The same platform that scans your dependencies and code is behind the agent, so checks happen as part of writing, not at the end of a pipeline.
We make no performance or quality comparisons here. Different agents suit different people, and many teams use more than one.
How to use it
- Install the Safeguard CLI. The package is
@safeguard-sh/cliand it needs Node 18 or later. Installation guidance is at cli.safeguard.sh. - Sign in to your Safeguard account.
- Open the repository you want to work on and start the agent in the terminal, or use the desktop app.
- Ask for the change in plain language, and review what it proposes.
npm install -g @safeguard-sh/cli
The CLI has interactive, headless and agent modes. Interactive is for you at a keyboard. Headless is for scripts and CI. Agent mode is for letting an agent drive.
Where your code goes
The local runner mode pulls the repository to your machine and scans locally. Only encrypted results are pushed back. If source code leaving your machine is the concern, that matters more than any feature of the agent.
The CLI scanner can use an LLM for source analysis, but it does not have to. Zero AI mode works with no model at all.
Working alongside other agents
You do not have to pick one. A common pattern: write with the agent you like, and let Safeguard check the result in your IDE, the CLI and your pull request gates. The next sections of this series cover that setup.
Try it yourself
Take a small function that handles user input. Ask your coding agent to refactor it. Then run a Safeguard scan on the result and read the findings. The demo below shows the local runner in the CLI.
Click through it at your own pace, or open it full screen.
Quick check
What runs on your machine in local runner mode?
The repository is pulled locally and scanned locally. Only encrypted results are pushed.
Does the scanner require an LLM?
No. Zero AI mode runs everything without a model.
