API Reference

Safeguard's programmatic surface today is the MCP server. The REST API is not yet generally available — see REST API below for what that means and what to use instead.

MCP Server

The Model Context Protocol server at https://mcp.safeguard.sh is the supported way to query Safeguard programmatically. It works with Claude, Cursor, Cline, and any other MCP-capable client.

Configuration

{
  "mcpServers": {
    "safeguard": {
      "url": "https://mcp.safeguard.sh",
      "apiKey": "YOUR_API_KEY"
    }
  }
}

Generate a key in Settings → API Keys.

Available tools

Six tools, all read-only. Scope — tenant, organization and product — comes from the key you connect with and is applied automatically; there is no scope argument to pass.

Arguments marked required must be supplied. Everything else is optional.

safeguard_list_products

Products in the active scope. Start here when you do not know which part of the estate you mean.

safeguard_list_projects

Projects in the active scope, with scan status and vulnerability counts.

safeguard_get_project

The full record for one project, including components, vulnerabilities and attestations.

safeguard_list_vulnerabilities

Vulnerabilities in the active scope.

safeguard_get_vulnerability

The full record for one CVE, including references.

safeguard_list_findings

Findings — vulnerability occurrences — for a specific SBOM or project.

Paging

List tools return a total alongside the rows. When the total exceeds the rows you received, page with offset rather than assuming you have everything.

CLI

Installation

See CLI installation for the current, supported method. Verify the checksum before running any downloaded installer.

Authentication

safeguard auth login

Or use an environment variable:

export SAFEGUARD_API_KEY="your-api-key"

Commands

# Generate SBOM
safeguard sbom generate --source . --name "my-app" --version "1.0.0"

# List projects
safeguard projects list

# Check security gate
safeguard gate check --policy production

# Search
safeguard search "severity:critical"

# Export SBOM
safeguard sbom export --id abc123 --format cyclonedx

REST API

The services behind api.safeguard.sh — authentication, the data plane, and the query service — are internal interfaces consumed by Safeguard's own clients. They require caller-supplied tenant, user, product and organization scoping headers, and their contracts change without notice. They are not documented here and are not supported for direct use.

A public REST API with API-key authentication is planned. If you have a use case the MCP tools do not cover, contact us and we will factor it into that design.

Single sign-on

The SSO endpoints under https://api.safeguard.sh/auth/api/v1/ are live and supported. See SSO configuration for the callback, metadata and access-request endpoints and their exact paths.

Webhooks

Receive notifications for events. See Webhooks and events for signing, replay protection and the full event list.

Configuration

1. Go to Settings → Webhooks
2. Click Add Webhook
3. Enter URL and select events
4. Save

Events

• sbom.created
• sbom.updated
• vulnerability.discovered
• gate.failed
• policy.violated

Payload

{
  "event": "vulnerability.discovered",
  "timestamp": "2025-01-03T10:00:00Z",
  "data": {
    "cve": "CVE-2025-1234",
    "severity": "critical",
    "affected_projects": ["project-1", "project-2"]
  }
}

Rate limits

Rate limits apply per API key. Current limits and the plans they attach to are published on the pricing page — that page is the source of truth, and this one no longer duplicates it.

SDKs