Secuarden CLI · v0.2.0 · Available now

Verifiable provenance for AI-written code

Capture supported coding-agent activity, verify evidence offline and export an AI Bill of Materials—with no source code leaving your environment. Use configurable CI thresholds to flag or fail changes based on observed risk signals.

Local-firstOpen sourceWorks offlineCI-ready
secuarden · local audit trail
$ secuarden verify

Verifying 14 sessions…
Checking 2,847 events…

✓ Hash chain intact
✓ All sessions verified
✓ Evidence remains local
Agent Sessions Ledger

See what the coding agent actually did

Git records the resulting code. Secuarden CLI preserves supported agent and tool activity, developer identity, repository context and resulting changes—then connects new events through a per-session SHA-256 hash chain.

01 / VERIFY

Verify

Check the integrity of captured session evidence and identify where an event chain has changed or become incomplete.

02 / EXPORT

Export

Produce a portable AI Bill of Materials from the already-redacted local evidence store.

03 / EVALUATE

Evaluate

Apply configurable risk thresholds in CI and return a non-zero exit code when captured changes require intervention.

AI Bill of Materials

Portable provenance, ready for review

Export structured evidence without rereading source files or requiring a network connection.

$ secuarden bom --since 30d > secuarden-ai-bom.json
  • Agent and model context
  • Developer identity
  • Repository and branch
  • Files changed
  • File-content hashes
  • Session and event references
  • Tamper-evident event hashes
  • Explainable risk signals
  • Evidence-integrity status
CI risk threshold · Available now

Detect high-risk AI changes before they ship

Run configurable, deterministic risk checks in GitHub Actions, GitLab CI or any shell-based delivery pipeline. The CLI can flag or fail captured changes when they meet your selected threshold; it does not replace enterprise authorization, approval or policy enforcement.

$ secuarden gate --since 24h --fail-on high
Low
Medium
High
Critical

Risk signals cover authentication, payments, secrets, cryptographic material, infrastructure, database migrations and sensitive configuration. Every result includes its contributing reasons.

Policy Enforcement Engine · Launching August 2026

From detecting risk to enforcing enterprise policy

Secuarden’s Policy Enforcement Engine will evaluate agent actions against repository policy, enforce permission boundaries and required approvals, and bind every allow, block and exception to the agent session and exact code change.

The CLI provides the local provenance and verification foundation for this broader assurance model.

  • Repository-specific policy evaluation
  • Agent and human permission boundaries
  • Required approval conditions
  • Allow, block and exception records
  • Evidence bound to sessions and code changes
Explainable by design

A governance signal you can inspect

Documentation and test changes can receive lower risk ratings. Sensitive paths can receive higher ratings with transparent reasons. Secuarden complements SAST, dependency scanning and licence analysis by preserving how an AI-assisted change was produced and evaluating the evidence surrounding it.

Existing databases upgrade automatically. Older events remain available and are clearly identified as predating hash chaining. No Secuarden account or cloud connection is required.

Release announcement

The latest from Secuarden CLI

Follow the newest release update directly from the Secuarden team.

secuarden
@secuarden

Read the latest Secuarden CLI release announcement from the Secuarden team.

View post on X →