Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Plain definitions of architecture, checkpoint, adapter, merge, quantized model, model card and ML BOM, and why each matters for supply chain records.
A minimum useful lineage record for ML: datasets, jobs, runs, versions and owners. What to capture so deletion and incident questions have answers.
Questions to put to a vendor offering an MCP server: token audience checks, minimal scopes, consent screens, session handling and logs you can read.
Which MCP tool controls are mandatory and which are only advice? A MUST versus SHOULD table for servers and clients, plus gaps you must cover yourself.
An MCP security evaluation should test token handling, tool changes, consent, SSRF and logging. Here are ten test cases drawn from the MCP specification.
Twelve questions to ask any vendor selling MCP guardrails: scope, enforcement point, logging, failure mode, identity and what happens on outage.
Three ways to control MCP use in a team: a static allowlist, a central proxy, or client approval prompts. What each catches, misses and costs in effort.
Two litellm releases on PyPI carried credential-harvesting code in March 2026. The affected versions, what it collected and what the advisory says to do.
Approval prompts only protect you if people read them. How to design agent approvals, limit their number and measure whether they still work over time.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
