Claude

Safeguard ships its own remote MCP (Model Context Protocol) server, so you can connect Claude by Anthropic directly to your software supply chain security data and ask questions in plain language. The Claude connector URL is https://mcp.safeguard.sh/mcp/anthropic — our MCP endpoint purpose-built for Claude. Once connected, Claude can query your vulnerabilities, SBOMs, packages, licenses, findings, and compliance data, generate AI remediation plans, compare SBOMs, manage SCM integrations, and enforce policy gates — all through a connector named Safeguard Security. The server offers hundreds of tools and also supports MCP resources and prompts; a new workspace starts with a small read-only set, and an administrator turns on the rest per tool.

What you can do

• Query vulnerabilities, SBOMs, packages, licenses, findings, and compliance data across your tenant.
• Generate AI-powered remediation plans for npm, pip, Maven, Go, and Cargo projects.
• Compare SBOMs in both CycloneDX and SPDX formats.
• Manage SCM integrations: GitHub, GitLab, Bitbucket, and Azure DevOps.
• Run risk scoring and compliance reporting.
• Enforce policy-gate checks for deployment readiness.

Add from Claude's connector directory

Safeguard is listed in Claude's connector directory. This is the shortest route — there is no URL to paste:

1. Open the directory entry: Safeguard in Claude's connector directory.
2. Select Safeguard and connect.
3. Sign in to Safeguard, check the app name and the host the authorization code will be sent to, then click Authorize access.

The directory lives inside Claude and needs you signed in to claude.ai — opened without a session, the link lands on the Claude home instead. If the directory isn't available on your Claude plan or in your workspace, the manual steps below always work.

Connect

1. Create your Safeguard account at https://app.safeguard.sh, or sign in if you already have one.
2. In Claude, open Customize → Connectors, click + Add, then Add custom connector.
3. Enter the name Safeguard Security and the URL https://mcp.safeguard.sh/mcp/anthropic, then click Continue.
4. Claude detects that Safeguard signs in with OAuth; click Continue. Under Authentication, choose Sign in now or Sign in when needed. Under OAuth client, choose Register automatically: Safeguard accepts only client IDs it issued itself. Click Add.
5. When Claude sends you to Safeguard, sign in, check the app name and the host the authorization code will be sent to, then click Authorize access.
6. That's it. Your enabled Safeguard security tools are now available to Claude. Start asking questions.

On a Team or Enterprise plan, an Owner or Primary Owner adds the connector first under Organization settings → Connectors (Add, then Custom, then Web, with the same name, URL and settings). Members then open Customize → Connectors, find Safeguard Security and click Connect. On the Free plan you can add one custom connector.

Claude Desktop

Claude Desktop uses the connectors in your Claude account: once you add Safeguard Security as above, it is available in Claude Desktop too. Don't add Safeguard to claude_desktop_config.json. That file is for local servers only, Safeguard's server is hosted, and Safeguard publishes no npm package or local bridge for it, so treat any package that claims to be the Safeguard MCP server as untrusted.

Authentication

You need a Safeguard account first. If you don't have one, create it at https://app.safeguard.sh. Claude connects with OAuth 2.0: when you add the Safeguard Security connector, Claude sends you to Safeguard, where you sign in (or create your account), check the app name and the host the page says the authorization code will be sent to, and click Authorize access. No keys to copy.

For a client that can only send a fixed header, the Safeguard MCP server also accepts an MCP key: in Safeguard, open Settings → Developer, create a key of the type MCP key, and send it as Authorization: Bearer sg_sk_.... If you don't see the Developer tab or the MCP key type, ask your Safeguard administrator: API-key access to MCP is turned on per workspace.

Example prompts

List my security projects
Find critical vulnerabilities
Show me all SBOMs
Generate a remediation plan for my npm project
Which packages violate my license policy?

Endpoints