Safeguard

Answer an auditor's question or comment in an audit engagement, as the workspace's Questions tab does; it is marked answered. Whether more evidence is needed is the auditor's call. Requires confirm: true after the user agreed.

safeguard_answer_audit_question

Approve a query review, allowing the associated action to proceed (e.g. deploying a remediation).

safeguard_approve_query_review

Archive an evidence record so it no longer counts towards any control (it expires today and is marked archived, with your reason), or restore an archived one to the validity it had. The record and its history stay. Archiving or restoring accepted evidence needs a compliance reviewer or administrator role. Collected evidence cannot be archived. Requires confirm: true after the user agreed.

safeguard_archive_compliance_evidence

Archive (cancel) a training assignment, as the assignment roster's "Archive" does: it stops assigning, reminding and counting, and stays in the history (include archived assignments to see it). Assignments are never deleted. Needs a tenant administrator. Requires confirm: true after the user agreed.

safeguard_archive_training_assignment

Ask questions about security data in natural language. The AI will convert your question into the appropriate query and return results. Examples: "Show me all critical npm vulnerabilities", "What packages in my SBOM have known exploits?"

safeguard_ask

Ask any how-do-I or what-is question about the Safeguard platform. The answer is generated by a language model from the integrated documentation — good for usage questions, concepts and troubleshooting, but verify exact commands and settings against the product itself.

safeguard_ask_docs

AI-GENERATED supplier assessment. Safeguard holds no supplier records, so contribution history, incidents, reputation and trust score are reasoned about, not measured. For what is actually recorded about a package, use safeguard_get_package_info.

safeguard_assess_supplier_risk

Get a high-level summary of all AI ecosystem assets across your workspace.

safeguard_asset_summary

Assign a task to a specific user. Optionally include a message to the assignee explaining the context or urgency of the task.

safeguard_assign_task

Attach evidence to a control: a link (https) to a document or system page, or a written attestation note, with a title, an optional collection cadence and valid-until date. It is filed as submitted, for a reviewer to accept or reject in Safeguard; the assistant cannot accept evidence. Files are uploaded in Safeguard itself. Requires confirm: true after the user agreed.

safeguard_attach_compliance_evidence

Attach evidence to an audit request, as the workspace's Requests tab does: upload a file (content_base64 up to 4 MB with file_name, upload_id from safeguard_create_compliance_upload, or file_path on a local stdio server; checked like any evidence upload), or give an https link, or link evidence that already exists by id. New evidence is filed for the request's first control (or control_id) and submitted for review. Submit the request with safeguard_update_audit_request. Requires confirm: true after the user agreed.

safeguard_attach_evidence_to_audit_request

Attach one or more skills to a workspace. Existing attached skills are preserved; new skill IDs are merged in (duplicates ignored).

safeguard_attach_skills_to_workspace

Bulk download data from Safeguard: vulnerability reports, SBOM exports, compliance reports, findings, and more.

safeguard_bulk_download

Download all compliance documents for an organisation, product, or project as a single ZIP archive. The ZIP contains all generated compliance PDFs (SOC 2, FedRAMP, NIST, SBOM exports, etc.).

safeguard_bulk_download_compliance_docs

Select EVERY repository or image discovered on a configuration in one call. Each selection creates its project and starts its scan, using the default branch/tag unless one is given. Use safeguard_select_repositories to pick specific ones instead.

safeguard_bulk_select_repositories

Cancel an access review campaign that is not completed: it stops, its accounts stay on the record, and it takes no more decisions. A completed campaign is evidence and cannot be cancelled or changed. Needs the campaign's owner or an administrator. Requires confirm: true after the user agreed.

safeguard_cancel_access_review

Cancel one of this workspace's own subscriptions, stopping future charges. Access already paid for is not refunded. Pass a subscription id from `safeguard_get_subscription` or `safeguard_list_billing_invoices`. Requires `confirm: true`.

safeguard_cancel_subscription

Have a multi-turn conversation about security topics, keeping context across turns. The reply is generated by a language model from your Safeguard data — treat it as analysis, not as a measured result, and confirm anything load-bearing with the tool that reads it directly. Returns the conversation id to pass back on the next turn.

safeguard_chat

AI-GENERATED assessment of possible package compromise. Safeguard stores no typosquatting, maintainer-change or malicious-package signals, so nothing here is looked up — a model reasons over the package names. Treat as a prompt for investigation, never as a clean bill of health.

safeguard_check_compromised_packages

Check license compliance for a project or SBOM. Identifies copyleft licenses (GPL, AGPL), proprietary licenses, unknown licenses, and policy violations. Reports which packages require disclosure.

safeguard_check_license_compliance

Security summary for a package: vulnerability counts by severity, risk score and recorded licences, read from its component record.

safeguard_check_package_security

Collect compliance evidence from every connected system now, as Compliance > Connectors > Collect evidence now does: each connector is read with its stored credentials and what it shows is filed as automated evidence (collected by the connector, accepted or rejected by its own checks), and the Academy training evidence is refreshed with it. It answers with what was collected per connector. Requires confirm: true after the user agreed.

safeguard_collect_connector_evidence

Write the training roster into compliance evidence now, as Compliance > Training > "Update evidence" does: the training controls' evidence records are refreshed from who completed what, and records no longer backed by the roster are marked stale. Answers which records were written. Requires confirm: true after the user agreed.

safeguard_collect_training_evidence

Write an import's records, after the user reviewed the preview and agreed. Each row goes through the same save and checks as adding it by hand: policies arrive as drafts for review and approval in Safeguard, a vendor never approved, a risk never accepted, people only for a compliance reviewer, and evidence as pre-window history that never counts for an observation window. Rows with errors are not written; matched records are skipped or updated as chosen, so committing the same file again creates nothing twice. The answer reports created, updated, skipped and failed; a large import keeps running and safeguard_get_compliance_import follows it. Requires confirm: true.

safeguard_commit_compliance_import

Compare two products side by side across vulnerabilities, compliance status, risk score, and components. Useful for evaluating relative security posture before a release or architectural decision.

safeguard_compare_products

Compare two SBOMs by their components: what was added, what was removed, and which components changed version. Diffed from the stored component records of each SBOM.

safeguard_compare_sboms

Compare two SBOMs to detect drift — added and removed components and version changes. Identical to safeguard_compare_sboms; prefer that name.

safeguard_compare_sboms_advanced

Mark a task as completed. Optionally provide completion notes describing what was done, the resolution achieved, or any follow-up actions required.

safeguard_complete_task

Create an audit engagement, as Compliance > Audits > New engagement does: its name, type (soc2_type1, soc2_type2, iso27001_stage1, iso27001_stage2, iso27001_surveillance, hipaa, custom), the frameworks it covers, the audit firm and lead auditor, the observation window and scope. It starts in planning, with the standard evidence requests for its type unless use_template is false. Inviting the auditors is done by an administrator in Safeguard. Requires confirm: true after the user agreed.

safeguard_create_audit_engagement

Open a remediation task for a gap, as a control's or evidence record's "Fix this gap" does: for a control (ref <framework>:<control id>, e.g. soc2_type2:CC6.1) that is failing or has nothing behind it, or for an evidence record (ref = its id) that is missing, rejected or expiring. A title, a note, an owner and a due date are optional; Safeguard names the task when no title is given, and reuses an open task for the same gap. A control that is out of scope has no gap. Requires confirm: true after the user agreed.

safeguard_create_compliance_gap_task

Get a one-time upload link for an import file over 4 MB (up to 50 MB): a policy export ZIP, a large spreadsheet or an evidence archive. Give the import, the file name and its exact size in bytes; Safeguard checks the type against what that import takes and answers with an upload_id, a URL, the method (PUT) and the headers. PUT the bytes to the URL within 15 minutes, then pass upload_id to safeguard_add_compliance_import_file. Requires confirm: true.

safeguard_create_compliance_import_upload

Create a compliance task and assign its owner (by email; optionally their Safeguard user id and name), with a description, severity and due date. It opens with status open, source manual, as Compliance > Tasks > New does. Requires confirm: true after the user agreed.

safeguard_create_compliance_task

Get a one-time upload link for a compliance file over 4 MB (up to 50 MB): evidence, a vendor document or SOC report, a person document, or a Trust Center document. Give the file name and its exact size in bytes; Safeguard checks the type against what that upload accepts and the formats your organization allows, and answers with an upload_id, a URL, the HTTP method (PUT) and the headers to send. PUT the file's bytes to the URL before it expires, then pass upload_id to the tool that files it (safeguard_upload_compliance_evidence, safeguard_replace_compliance_evidence, safeguard_add_vendor_document, ...). The file is checked again before anything refers to it. Smaller files can go inline as content_base64 instead. Requires confirm: true.

safeguard_create_compliance_upload

Start a new named AI conversation. Useful for organising queries by topic or project. Returns the new conversation ID.

safeguard_create_conversation

Add a control of your own to a framework (a built-in one or a custom framework), as the framework page's Add control does: its id, name, description, category and owner. It starts pending, with nothing evaluated; a status that moves the score is a compliance reviewer's to set in Safeguard. Link compliance tests to it with safeguard_link_test_to_control and file evidence for it with safeguard_upload_compliance_evidence. Remove it again with safeguard_delete_custom_control. Requires confirm: true after the user agreed.

safeguard_create_custom_control

Add a framework of your own (an internal security baseline, a customer's requirements), as Compliance > Frameworks > Add custom framework does: its name, region, country, industry, type and description. Its check type is custom:<name>; add its controls with safeguard_create_custom_control. To ask Safeguard to support a published framework instead, use safeguard_request_framework. Remove it again with safeguard_delete_custom_framework. Requires confirm: true after the user agreed.

safeguard_create_custom_framework

Create a new MCP guardrail proxy. A guardrail sits between an AI client and an MCP server, scanning all traffic for security threats, enforcing policies, and providing audit logging. After creation, use the proxy_url instead of the original target_url.

safeguard_create_guardrail

Add a security questionnaire you received from a customer or prospect, as Compliance > Questionnaires > New and Import do: its name, who sent it, its format (SIG, CAIQ, CUSTOM or PDF), the due date, and its questions, given as a list or as CSV text (one question per row; name the question column, or the header question, prompt or text is used, else the first column; an optional category column). Up to 2000 questions. Then draft answers with safeguard_draft_questionnaire_answers and save them with safeguard_save_questionnaire_answer. Requires confirm: true after the user agreed.

safeguard_create_inbound_questionnaire

Create a mitigation record for a vulnerability. Use this to formally track how a vulnerability is being addressed — whether through patching, a workaround, accepted risk, or a false positive classification.

safeguard_create_mitigation

Create a new organization in the tenant. Optionally place it under a parent organization to build a hierarchy. Returns the created organization.

safeguard_create_organization