ChatGPT (OpenAI)

Safeguard exposes a REST/OpenAPI surface and an MCP (Model Context Protocol) server, so you can bring your software supply chain security data into ChatGPT by OpenAI. The recommended path is to add Safeguard to ChatGPT as a custom MCP server at https://mcp.safeguard.sh/mcp and sign in with OAuth. A Custom GPT Action that imports Safeguard's OpenAPI schema from https://mcp.safeguard.sh/openapi.json is an alternative with a smaller set of tools. Once connected, ChatGPT can query your vulnerabilities, SBOMs, packages, licenses, findings, and compliance data, generate AI remediation plans, compare SBOMs, manage SCM integrations, and enforce policy gates. The server offers hundreds of tools; a new workspace starts with a small read-only set, and an administrator turns on the rest per tool.

What you can do

• Query vulnerabilities, SBOMs, packages, licenses, findings, and compliance data across your tenant.
• Generate AI-powered remediation plans for npm, pip, Maven, Go, and Cargo projects.
• Compare SBOMs in both CycloneDX and SPDX formats.
• Manage SCM integrations: GitHub, GitLab, Bitbucket, and Azure DevOps.
• Run risk scoring and compliance reporting.
• Enforce policy-gate checks for deployment readiness.

Connect

1. Create your Safeguard account at https://app.safeguard.sh, or sign in if you already have one.
2. In ChatGPT, open Plugins, select the plus button, then Add custom MCP server.
3. Enter a name (for example Safeguard Security) and a description.
4. Under Connection, enter the MCP server URL https://mcp.safeguard.sh/mcp.
5. Configure authentication with OAuth. ChatGPT registers itself with Safeguard, so there is no client ID or key to copy. Review the risk warning, select I understand and want to continue, then select Create as a plugin.
6. When ChatGPT sends you to Safeguard, sign in, check the app name and the host the authorization code will be sent to, then click Authorize access.
7. Your enabled Safeguard security tools are now available in ChatGPT. Start asking questions.

Account and workspace policies apply to adding and using custom MCP servers in ChatGPT. If you don't see the option, ask your ChatGPT workspace administrator. Nothing needs installing: Safeguard hosts the server. Safeguard does not publish an npm package or a local bridge for it, so treat any package that claims to be the Safeguard MCP server as untrusted.

Alternative: Custom GPT Action

A Custom GPT Action calls the tools in Safeguard's OpenAPI schema with a fixed key:

1. In ChatGPT, create a Custom GPT and open the Configure tab, then Actions, then Create new action.
2. Choose Import from URL and enter the OpenAPI schema URL https://mcp.safeguard.sh/openapi.json.
3. Under Authentication, select API Key with Auth Type Bearer, and paste a Safeguard MCP key (sg_sk_..., see Authentication).
4. Save the GPT. Your enabled Safeguard tools from the schema are now available.

The action uses the one key you paste for everyone who can use that GPT, and the key acts as you. Keep the GPT private.

Authentication

You need a Safeguard account first. If you don't have one, create it at https://app.safeguard.sh. The Safeguard MCP server accepts two kinds of credential:

• OAuth 2.0 (the custom MCP server above): sign in to Safeguard when ChatGPT asks, check the app name and the host the page says the authorization code will be sent to, then click Authorize access. No keys to copy.
• MCP key (the Custom GPT Action): in Safeguard, open Settings → Developer and create a key of the type MCP key. It is sent as Authorization: Bearer sg_sk_.... If you don't see the Developer tab or the MCP key type, ask your Safeguard administrator: API-key access to MCP is turned on per workspace.

Example prompts

List my security projects
Find critical vulnerabilities
Show me all SBOMs
Generate a remediation plan for my npm project
Which packages violate my license policy?

Endpoints