Gemini (Google)

Safeguard ships its own remote MCP (Model Context Protocol) server, so you can connect Gemini by Google directly to your software supply chain security data and ask questions in plain language. The Gemini endpoint is https://mcp.safeguard.sh/mcp/gemini. Once connected, Gemini can query your vulnerabilities, SBOMs, packages, licenses, findings, and compliance data, generate AI remediation plans, compare SBOMs, manage SCM integrations, and enforce policy gates. The server offers hundreds of tools and also supports MCP resources and prompts; a new workspace starts with a small read-only set, and an administrator turns on the rest per tool.

What you can do

• Query vulnerabilities, SBOMs, packages, licenses, findings, and compliance data across your tenant.
• Generate AI-powered remediation plans for npm, pip, Maven, Go, and Cargo projects.
• Compare SBOMs in both CycloneDX and SPDX formats.
• Manage SCM integrations: GitHub, GitLab, Bitbucket, and Azure DevOps.
• Run risk scoring and compliance reporting.
• Enforce policy-gate checks for deployment readiness.

Connect

1. Create your Safeguard account at https://app.safeguard.sh, or sign in if you already have one.

2. In Gemini CLI, add Safeguard as an HTTP server:

   gemini mcp add --transport http safeguard https://mcp.safeguard.sh/mcp/gemini

   Or add it to ~/.gemini/settings.json (all projects) or .gemini/settings.json (one project) yourself:

   {
     "mcpServers": {
       "safeguard": {
         "httpUrl": "https://mcp.safeguard.sh/mcp/gemini"
       }
     }
   }

   httpUrl is Gemini CLI's field for a Streamable HTTP server. Don't use url, which Gemini CLI reserves for SSE: Safeguard has no SSE endpoint.

3. Gemini CLI discovers Safeguard's OAuth sign-in when it first connects (/mcp auth safeguard starts it by hand). Sign in, check the app name and the host the authorization code will be sent to, then click Authorize access.

4. Your enabled Safeguard security tools are now available. Start asking questions.

Other Gemini tooling that supports remote MCP servers uses the same URL. Nothing needs installing: Safeguard hosts the server. Safeguard does not publish an npm package or a local bridge for it, so treat any package that claims to be the Safeguard MCP server as untrusted.

Authentication

You need a Safeguard account first. If you don't have one, create it at https://app.safeguard.sh. The Safeguard MCP server accepts two kinds of credential:

• OAuth 2.0: when your client supports it, it opens Safeguard's sign-in page. Sign in, check the app name and the host the page says the authorization code will be sent to, then click Authorize access. No keys to copy.
• MCP key: for a client that can only send a fixed header. In Safeguard, open Settings → Developer, create a key of the type MCP key, and send it as Authorization: Bearer sg_sk_.... If you don't see the Developer tab or the MCP key type, ask your Safeguard administrator: API-key access to MCP is turned on per workspace. In Gemini CLI the header goes in the server's headers object.

Example prompts

List my security projects
Find critical vulnerabilities
Show me all SBOMs
Generate a remediation plan for my npm project
Which packages violate my license policy?

Endpoints