Cursor

Safeguard ships its own remote MCP (Model Context Protocol) server, so you can connect Cursor directly to your software supply chain security data and ask questions in plain language. Cursor connects to https://mcp.safeguard.sh/mcp and signs in with OAuth, so there is nothing to install and no key to copy. Once connected, Cursor can query your vulnerabilities, SBOMs, packages, licenses, findings, and compliance data, generate AI remediation plans, compare SBOMs, manage SCM integrations, and enforce policy gates. The server offers hundreds of tools and also supports MCP resources and prompts; a new workspace starts with a small read-only set, and an administrator turns on the rest per tool.

What you can do

• Query vulnerabilities, SBOMs, packages, licenses, findings, and compliance data across your tenant.
• Generate AI-powered remediation plans for npm, pip, Maven, Go, and Cargo projects.
• Compare SBOMs in both CycloneDX and SPDX formats.
• Manage SCM integrations: GitHub, GitLab, Bitbucket, and Azure DevOps.
• Run risk scoring and compliance reporting.
• Enforce policy-gate checks for deployment readiness.

Connect

1. Create your Safeguard account at https://app.safeguard.sh, or sign in if you already have one.

2. Open ~/.cursor/mcp.json (all projects) or .cursor/mcp.json in a project, and add this entry:

   {
     "mcpServers": {
       "safeguard": {
         "url": "https://mcp.safeguard.sh/mcp"
       }
     }
   }

3. Cursor supports OAuth for MCP servers. When it connects, it opens Safeguard's sign-in page: sign in, check the app name and the host the authorization code will be sent to, then click Authorize access.

4. Your enabled Safeguard security tools are now available in Cursor. Start asking questions.

Earlier versions of this page used https://mcp.safeguard.sh/mcp/cursor. That address reaches the same server, so an existing entry keeps working. Remove any npx/mcp-remote entry and SAFEGUARD_API_KEY setting from older instructions: Safeguard hosts the server, publishes no npm package or local bridge for it, and never reads that variable.

Authentication

You need a Safeguard account first. If you don't have one, create it at https://app.safeguard.sh. The Safeguard MCP server accepts two kinds of credential:

• OAuth 2.0 (what Cursor uses): sign in to Safeguard when Cursor asks, check the app name and the host the page says the authorization code will be sent to, then click Authorize access. No keys to copy.
• MCP key: only if you can't use OAuth. In Safeguard, open Settings → Developer, create a key of the type MCP key, and add "headers": { "Authorization": "Bearer sg_sk_..." } to the entry above. Keep that file out of source control. If you don't see the Developer tab or the MCP key type, ask your Safeguard administrator: API-key access to MCP is turned on per workspace.

Example prompts

List my security projects
Find critical vulnerabilities
Show me all SBOMs
Generate a remediation plan for my npm project
Which packages violate my license policy?

Endpoints