01 / VERIFY
Verify
Check the integrity of captured session evidence and identify where an event chain has changed or become incomplete.
Secuarden CLI · Available now
Verifiable provenance for AI-written code
Capture supported coding-agent activity, verify evidence offline and export a Context Bill of Materials—with no source code leaving your environment. Use configurable CI thresholds to flag or fail changes based on observed risk signals.
Local-firstOpen sourceWorks offlineCI-ready
Inside the CLI
Your capture setup, at a glance
Run secuarden status to inspect configured agents, capture settings, recent activity and evidence status.
Agent Sessions Ledger
See what the coding agent actually did
Git records the resulting code. Secuarden CLI preserves supported agent and tool activity, developer identity, repository context and resulting changes—then connects new events through a per-session SHA-256 hash chain.
02 / EXPORT
Export
Produce a portable Context Bill of Materials from the already-redacted local evidence store.
03 / EVALUATE
Evaluate
Apply configurable risk thresholds in CI and return a non-zero exit code when captured changes require intervention.
Supported agents
Built for Claude Code and OpenAI Codex
Capture activity through native hooks, including sessions, developer prompts, tool calls and results. Works with Claude Code’s official VS Code extension; Codex capture requires a compatible, enabled hook runtime.
Choose metadata-only capture to keep prompt, command, output and diff content out of the evidence store.
Context Bill of Materials
Portable provenance, ready for review
Export structured evidence without rereading source files or requiring a network connection.
$ secuarden c-bom --since 30d > secuarden-context-bom.json
- Agent and model context
- Developer identity
- Repository and branch
- Files changed
- File-content hashes
- Session and event references
- Tamper-evident event hashes
- Explainable risk signals
- Evidence-integrity status
CI risk threshold · Available now
Detect high-risk AI changes before they ship
Run configurable, deterministic risk checks in GitHub Actions, GitLab CI or any shell-based delivery pipeline. The CLI can flag or fail captured changes when they meet your selected threshold; it does not replace enterprise authorization, approval or policy enforcement.
$ secuarden gate --since 24h --fail-on high
Low
Medium
High
Critical
Risk signals cover authentication, payments, secrets, cryptographic material, infrastructure, database migrations and sensitive configuration. Every result includes its contributing reasons.
Policy Enforcement Engine · Available now
From detecting risk to enforcing enterprise policy
Secuarden’s Policy Enforcement Engine will evaluate agent actions against repository policy, enforce permission boundaries and required approvals, and bind every allow, block and exception to the agent session and exact code change.
The CLI provides the local provenance and verification foundation for this broader assurance model.
- Repository-specific policy evaluation
- Agent and human permission boundaries
- Required approval conditions
- Allow, block and exception records
- Evidence bound to sessions and code changes
Explainable by design
A governance signal you can inspect
Documentation and test changes can receive lower risk ratings. Sensitive paths can receive higher ratings with transparent reasons. Secuarden complements SAST, dependency scanning and licence analysis by preserving how an AI-assisted change was produced and evaluating the evidence surrounding it.
Existing databases upgrade automatically. Older events remain available and are clearly identified as predating hash chaining. No Secuarden account or cloud connection is required.
Release announcement
The latest from Secuarden CLI
Follow the newest release update directly from the Secuarden team.
Read the latest Secuarden CLI release announcement from the Secuarden team.
View post on X →