Aleph Alpha

Safeguard ships its own remote MCP (Model Context Protocol) server, so you can connect Aleph Alpha (Germany) directly to your software supply chain security data and ask questions in plain language. The endpoint is https://mcp.safeguard.sh/mcp. Once connected, any Aleph Alpha MCP-capable client can query your vulnerabilities, SBOMs, packages, licenses, findings, and compliance data, generate AI remediation plans, compare SBOMs, manage SCM integrations, and enforce policy gates. The server offers hundreds of tools and also supports MCP resources and prompts; a new workspace starts with a small read-only set, and an administrator turns on the rest per tool.

What you can do

• Query vulnerabilities, SBOMs, packages, licenses, findings, and compliance data across your tenant.
• Generate AI-powered remediation plans for npm, pip, Maven, Go, and Cargo projects.
• Compare SBOMs in both CycloneDX and SPDX formats.
• Manage SCM integrations: GitHub, GitLab, Bitbucket, and Azure DevOps.
• Run risk scoring and compliance reporting.
• Enforce policy-gate checks for deployment readiness.

Connect

1. Create your Safeguard account at https://app.safeguard.sh, or sign in if you already have one.
2. Open the MCP configuration in your Aleph Alpha MCP-capable client.
3. Add a remote MCP server (Streamable HTTP) with the URL https://mcp.safeguard.sh/mcp.
4. If the client supports OAuth for MCP servers, it opens Safeguard's sign-in page: sign in, check the app name and the host the authorization code will be sent to, then click Authorize access. If it can only send a fixed header, use an MCP key instead (see Authentication).
5. Reload your client — your enabled Safeguard security tools are now available. Start asking questions.

Nothing needs installing: Safeguard hosts the server. Safeguard does not publish an npm package or a local bridge for it, so treat any package that claims to be the Safeguard MCP server as untrusted.

Authentication

You need a Safeguard account first. If you don't have one, create it at https://app.safeguard.sh. The Safeguard MCP server accepts two kinds of credential:

• OAuth 2.0: when your client supports it, it opens Safeguard's sign-in page. Sign in, check the app name and the host the page says the authorization code will be sent to, then click Authorize access. No keys to copy.
• MCP key: for a client that can only send a fixed header. In Safeguard, open Settings → Developer, create a key of the type MCP key, and send it as Authorization: Bearer sg_sk_.... If you don't see the Developer tab or the MCP key type, ask your Safeguard administrator: API-key access to MCP is turned on per workspace.

Example prompts

List my security projects
Find critical vulnerabilities
Show me all SBOMs
Generate a remediation plan for my npm project
Which packages violate my license policy?

Endpoints