Safeguard CLI
Command-line interface for Safeguard software supply chain security
Safeguard CLI
The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds.
Overview
The CLI allows you to:
- Scan a directory, a Git repository, a container image or an existing SBOM for vulnerabilities
- Find hardcoded secrets and misconfigurations
- Validate SPDX, CycloneDX and VEX documents
- Run platform-assigned scan jobs locally, uploading SBOMs and findings but never source
- Fix and review code with the built-in assistant, interactively or in CI with
safeguard exec
Quick Start
Install it — macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bashWindows:
irm https://cli.safeguard.sh/install.ps1 | iexThen open the terminal and sign in:
safeguardType /login to authenticate, then /scan . to scan the folder you are in.
Or just ask it something — "how many critical vulns do we have" works.
Key Features
| Feature | Description |
|---|---|
| Vulnerability scanning | safeguard scan builds an SBOM and matches it against vulnerability databases |
| Secrets and misconfigurations | safeguard detect, with table, JSON or SARIF output |
| SBOM validation | safeguard validate for CycloneDX, SPDX and VEX |
| Local runner | Executes the platform's scan jobs on your machine; only results leave it |
| Assistant | safeguard agent interactively, safeguard exec non-interactively |
| Offline databases | safeguard update --import loads a vulnerability database downloaded elsewhere |
Policies and gates are evaluated in the platform, not by the CLI. See Policies & gates.
Documentation
Installation
Install and set up the CLI
Interactive terminal
The terminal you get when you run safeguard
Slash commands
Every command inside the terminal
Usage Guide
Common commands and workflows
Configuration
Configure CLI settings
Troubleshooting
Resolve common issues
Support Matrix
Supported languages and platforms
System Requirements
The CLI is a single static binary. There is no runtime to install alongside it — no Node, no Python, no JVM.
| Requirement | Minimum |
|---|---|
| Operating System | macOS, Linux, or Windows — see Platforms |
| Architecture | x86_64 or arm64 (Windows ships x86_64 only) |
| Disk Space | ~40MB for the binary, plus the scanners it downloads on first use |
Getting Help
# View all commands
safeguard --help
# Get help for a specific command
safeguard scan --help
safeguard detect --help