COMMUNITY EDITION · EARLY ACCESS

Run Attestree free on your own fleet.

The Community Edition is the full platform, self-hosted with docker compose up — free for up to 50 Windows endpoints. No Azure, no Entra. First endpoint reconciled in five minutes.

Request early access

Early access — request access rather than a public download right now. Free up to 50 endpoints.

COMMUNITY vs COMMERCIAL

Run it: docker compose up; Aspire → AKS
Identity: Local users, roles, TOTP MFA; Entra SSO, every tier
Endpoints: Up to 50; 5K–25K
Audit signing: Local file-backed key; AKV Managed HSM
Price: Free; Commercial

WHAT YOU GET, FREE

The same product, scaled down.

One inventory, every manager

See what is actually installed across your fleet — winget and Chocolatey today, managed under one control plane; more package managers as they land. Per-user installs are attributed to the user who actually has them, not flattened into a machine row.

Ring-promoted upgrades

Deploy, upgrade, and roll back in rings (canary → pilot → broad) with auto-rollback on bad signals. The agent even ships its own updates through the same rings.

SBOM + attestation, free

Every package is detonated in a real sandbox — Hyper-V and Proxmox/KVM today — for a signed SBOM and attestation. Endpoints install only from your own feed, pinned to the SHA-256 you approved, and the feed serves the attested installer bytes itself, from local disk or Azure Blob.

Fleet reconciliation

Declarative desired state; drift surfaces as telemetry. The full control plane, self-hosted — including the operational controls: pause or abort a live agent rollout, tune ring soak floors, decommission an endpoint and revoke its token, all in-product.

No Azure, no Entra

Local accounts with real access control: four roles (admin, catalog author, auditor, read-only) enforced at the policy layer, TOTP two-factor with recovery codes, and break-glass recovery if you lock yourself out. Runs on a single box with Docker, nothing in the cloud unless you opt in.

Private by default

Opt-in, anonymized telemetry — default off, and every event is visible to you. No package IDs, no hostnames.

QUICKSTART

From zero to first endpoint in five minutes.

One image, a Postgres sidecar, and a Docker volume. No subscription, no cloud account. Pull it, bring it up, enroll your first endpoint.

~/attestree

# Community Edition — early access (pre-GA)
$ cp .env.example .env
#   set POSTGRES_PASSWORD + WEP_PUBLIC_BASE_URI — boot fails without them
$ docker compose up -d
#   platform + Postgres sidecar, no Azure required
#   open http://localhost:18080  →  first-run setup creates your admin
#   generate an enrollment token, drop it on an endpoint
#   first endpoint reconciled in ~5 minutes

Honest about the audit posture. The Community Edition signs its audit chain with a local, file-backed key. It exports real evidence bundles that verify offline — but the key's custody is not hardware-attested, and the console says so on the export itself, so this is not built for regulatory submission. Need HSM-attested key custody or an on-prem appliance? That is what the commercial tiers are for.

Compliance tiers

JOIN IN

A small community, building in the open.

GitHub

Star the repo, file issues, and ask questions in Discussions. The Apache-2.0 installer shim is open source.

Repository goes public at launch

Roadmap

See what is shipping next across inventory, transforms, drivers, and Windows Updates.

View the roadmap

Discord

Real-time chat opens once the community grows past the first wave. For now, Discussions is home.

Coming soon

Outgrow 50 endpoints?

The commercial tiers lift the cap and add Entra SSO, hardware-backed signing, an on-prem appliance, and the evidence bundles your auditors ask for — same product, same data, no re-enrollment.

See pricing Request access