COMMUNITY EDITION · EARLY ACCESS

Run Attestree free on your own fleet.

The Community Edition is the full platform, self-hosted withdocker compose up — free for up to50 Windows endpoints. No Azure, no Entra. First endpoint reconciled in five minutes.

Request early access Star on GitHub

Early access — the image is in pre-GA validation. Free up to 50 endpoints.

COMMUNITY vs COMMERCIAL

Run it: docker compose up; Aspire → AKS
Identity: Local users, roles, TOTP MFA; Entra SSO, every tier
Endpoints: Up to 50; 5K–25K
Audit signing: Local dev key; AKV Managed HSM
Price: Free; Commercial

WHAT YOU GET, FREE

The same product, scaled down.

One inventory, every manager

See what is actually installed across your fleet — winget and Chocolatey today, managed under one control plane; more package managers as they land. Per-user installs are attributed to the user who actually has them, not flattened into a machine row.

Ring-promoted upgrades

Deploy, upgrade, and roll back in rings (canary → pilot → broad) with auto-rollback on bad signals. The agent even ships its own updates through the same rings.

SBOM + attestation, free

Every package is detonated in a real sandbox — Hyper-V and Proxmox/KVM today, more backends in the pipeline — for a signed SBOM and attestation. Endpoints install only from your own feed, pinned to the exact SHA-256 you approved — and the feed can serve the attested installer bytes itself, over your LAN. That byte-store can point at object storage (Azure Blob today), configured in-product with the credential encrypted at rest; moving the bytes between backends is an in-product migration, hash-verified per blob, with the backend switch gated on a readiness check that fails closed.

Fleet reconciliation

Declarative desired state; drift surfaces as telemetry. The full control plane, self-hosted — including the operational controls: pause or abort a live agent rollout, tune ring soak floors, decommission an endpoint and revoke its token, all in-product.

No Azure, no Entra

Local accounts with real access control — four roles (admin, catalog author, auditor, read-only) enforced at the policy layer, not just hidden buttons. TOTP two-factor with recovery codes, admin-driven resets, and host-side break-glass recovery if you lock yourself out. Runs on a single box with Docker, nothing in the cloud unless you opt in.

Private by default

Opt-in, anonymized telemetry — default off, and every event is visible to you. No package IDs, no hostnames.

QUICKSTART

From zero to first endpoint in five minutes.

One image, a Postgres sidecar, and a Docker volume. No subscription, no cloud account. Pull it, bring it up, enroll your first endpoint.

~/attestree

# Community Edition — early access (pre-GA)
$ cp .env.example .env
#   set POSTGRES_PASSWORD + WEP_PUBLIC_BASE_URI — boot fails without them
$ docker compose up -d
#   platform + Postgres sidecar, no Azure required
#   open http://localhost:18080  →  first-run setup creates your admin
#   generate an enrollment token, drop it on an endpoint
#   first endpoint reconciled in ~5 minutes

Honest about the audit posture. The Community Edition signs its audit chain with a local, dev-grade key — great for a homelab, not for regulatory submission. Need auditor-ready evidence, hardware-backed keys, or an on-prem appliance? That is what the commercial tiers are for.

Compliance tiers

JOIN IN

Outgrow 50 endpoints?

The commercial tiers lift the cap and add Entra SSO, hardware-backed signing, an on-prem appliance, and the evidence bundles your auditors ask for — same product, same data, no re-enrollment.

See pricing Request access