Inference API or MCP server
When to call models through Safeguard's inference API, and when to connect an AI assistant to Safeguard's MCP server instead. MCP is unlimited and never metered.
Safeguard offers two ways for AI to work with it, and they solve different problems.
- The inference API is for your own applications: you send prompts to a model you choose, and you pay per token.
- The MCP server is for AI assistants such as Claude, ChatGPT or Cursor: it gives them Safeguard's tools, so they can read and act on your security and compliance data, while the assistant's own model does the thinking.
Side by side
| Inference API | MCP server | |
|---|---|---|
| What it does | Runs a model you name on the prompts you send | Lets an assistant call Safeguard's tools: findings, SBOMs, packages, compliance and more |
| Who runs the model | The provider of the model you choose, through Safeguard | Your assistant's own provider |
| Address | https://api.safeguard.sh/gpt/v1 | mcp.safeguard.sh |
| Credentials | An sg-api- key with the inference scope | OAuth from your assistant, or an MCP key. See MCP. |
| What you pay Safeguard | Tokens, from prepaid credit, at the provider's list price with no markup | Nothing per call. MCP tool calls are unlimited on every plan, Free included, and never metered. |
| Data | Your prompts go to the provider of the model you choose | Tool calls read your Safeguard workspace with the signed-in person's permissions |
| Status | Early access, switched on per workspace by Safeguard | Available. Tools are enabled per workspace; see Tool availability. |
Choose the inference API when
- you are building a feature in your own product that needs a model to write, summarise or classify text;
- you want one key and one bill for models from several providers;
- you need a hard spend limit, per-request cost and a request log for that traffic.
Choose the MCP server when
- you want an assistant your team already uses to answer questions about your Safeguard data, such as "which reachable critical vulnerabilities are open in payments-service?";
- you want an agent to act in Safeguard, within the permissions of the person or key it runs as;
- you want no metering: the assistant's provider bills its own tokens, and Safeguard does not charge per tool call.
Using both
They are independent. An inference key cannot sign in to the MCP server, and an MCP key cannot call the inference API, so each key keeps to its own job. An application can use the inference API for its model calls while the people building it use the MCP server in their assistant.
Related
Console guide
A tour of the API Platform Console: Dashboard, Search, Workbench, API keys, Usage and Settings, and what each page shows.
Bring your own model
What version 1 of the API Platform supports for a model you bring with your own provider account or endpoint: the Workbench only, and no Safeguard fee.