CLI Installation
Install the Safeguard CLI on your system
CLI Installation
Install the Safeguard CLI to start generating SBOMs and scanning for vulnerabilities from your terminal.
Installation Methods
npm (Recommended)
The easiest way to install the Safeguard CLI is via npm:
npm install -g @safeguard-sh/cliVerify the installation:
safeguard --versionHomebrew (macOS/Linux)
brew tap safeguard-sh/tap
brew install safeguard-cliDirect Download
Download pre-built binaries for your platform:
| Platform | Architecture | Download |
|---|---|---|
| Windows | x64 | safeguard-win-x64.exe |
| macOS | Intel | safeguard-darwin-x64 |
| macOS | Apple Silicon | safeguard-darwin-arm64 |
| Linux | x64 | safeguard-linux-x64 |
| Linux | ARM64 | safeguard-linux-arm64 |
After downloading, make the binary executable:
chmod +x safeguard-*
sudo mv safeguard-* /usr/local/bin/safeguardDocker
Run the CLI in a Docker container:
docker pull safeguard-sh/cli:latest
# Run a scan
docker run -v $(pwd):/workspace safeguard-sh/cli:latest sbom generate --source /workspaceAuthentication
After installation, authenticate with your Safeguard.sh account:
Interactive Login
safeguard auth loginThis opens your browser for secure authentication.
API Key Authentication
For CI/CD and automation, use an API key:
# Set via environment variable
export SAFEGUARD_API_KEY=your-api-key-here
# Or pass directly
safeguard --api-key your-api-key-here sbom generateGenerate API keys in Settings → API Keys in the Safeguard.sh web application.
Verify Authentication
safeguard auth statusConfiguration File
Create a configuration file for persistent settings:
safeguard config initThis creates ~/.safeguard/config.yaml:
# Safeguard CLI Configuration
api_key: ${SAFEGUARD_API_KEY}
default_format: cyclonedx
output_dir: ./sbom
organization: your-org-id
# Scanning options
scan:
include_dev: false
depth: unlimited
# Output options
output:
format: json
pretty: trueProxy Configuration
If you're behind a corporate proxy:
# Set proxy environment variables
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1
# Or configure in CLI
safeguard config set proxy.http http://proxy.example.com:8080
safeguard config set proxy.https http://proxy.example.com:8080Offline Installation
For air-gapped environments:
- Download the CLI binary and vulnerability database on a connected machine:
safeguard db download --output ./safeguard-db.tar.gz-
Transfer files to the air-gapped system
-
Install and configure:
safeguard config set db.path /path/to/safeguard-db.tar.gz
safeguard config set offline trueUpdating the CLI
npm
npm update -g @safeguard-sh/cliHomebrew
brew upgrade safeguard-cliCheck for Updates
safeguard update checkUninstalling
npm
npm uninstall -g @safeguard-sh/cliHomebrew
brew uninstall safeguard-cliManual
rm /usr/local/bin/safeguard
rm -rf ~/.safeguard