Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A new model version changes agent behavior even if your code stays the same. A change control routine: pin the version, test, canary and roll back fast.
Yes, if the assistant is connected to your scan data through MCP. Without a connection it can only guess. Here is how it works and what to lock down.
No. The MCP spec bans form mode requests for passwords and API keys and requires URL mode instead. Here is what each mode does and what clients must show.
How MCP lets an AI assistant call a security scanner, what to check before connecting one, and how to keep it from changing more than you intend.
Yes. A local process can claim a known client identity and catch the sign in redirect on a localhost port. Here is how the attack works and what to check.
Text inside a pull request can act as instructions to an AI reviewer. Here is a safe, five-case test for whether your tool can be steered by what it reads.
Build agent controls when needs are narrow and stable; buy when coverage, upkeep and audit evidence outgrow a small team. Use six tests to decide.
Move an AI agent from suggesting to acting in steps, with written criteria for each promotion and a clear trigger for stepping the agent back down.
Roll out agent controls in three phases: audit to learn, warn to teach, then block what matters. Give each phase an exit test so none drags on forever.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
