AI Security
Does an MCP server need authentication?
MCP authorization is optional. Remote HTTP servers should use OAuth 2.1 based flows, while local stdio servers take credentials from the environment.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Does an AI assistant that sees PHI need a BAA?
If an AI service creates, receives, maintains or transmits PHI for a covered entity, it fits the business associate definition. Questions to ask first.
Oct 18, 20263 min read
AI Security
Do MCP roots restrict which files a server can read?
No. MCP roots are informational, not access control, and servers are not forced to stay inside them. Here is what to use instead to limit file access.
Oct 18, 20263 min read
AI Security
Data use clauses in security tool contracts: telemetry, benchmarking, training
Read the clause that says what a vendor may do with your data besides serving you: usage telemetry, benchmarking, product improvement and model training.
Oct 18, 20263 min read
AI Security
Using a personal AI chat account for legal matters: the risk
Anthropic's help center cites a 2026 ruling where a defendant's consumer AI use was not protected work product. What it means for personal chats.
Oct 18, 20263 min read
AI Security
Client ID Metadata Documents or dynamic registration for MCP?
The MCP spec prefers pre-registration, then Client ID Metadata Documents, then dynamic client registration as a fallback. Here is how the three differ.
Oct 18, 20263 min read
AI Security
Client credentials or user sign-in: which grant for an AI agent?
Should an AI agent act as itself with client credentials or as the user after sign in? A decision table based on the MCP spec and OWASP guidance.
Oct 18, 20263 min read
AI Security
Claude watermarks and Content Credentials: what a mark proves
Anthropic marks Claude output with text watermarks and C2PA Content Credentials. What a detected mark suggests, and why a missing mark proves nothing.
Oct 18, 20263 min read
AI Security
How to stop Claude using your chats for model training
Turn off Help improve our AI models in Claude privacy settings. Steps for web and mobile, what the switch changes, and what it cannot undo for you.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.