Install

Understand code change risk before it ships. Runs locally.

Ledgerful analyzes Git repositories locally and produces risk, provenance, verification, and SOC 2-style evidence without uploading source code by default.

Install Ledgerful
See how it works
v0.2.8 with SHA-256 checksums, SBOM, and cosign signing. Public — see release notes.

What Ledgerful does

Four capabilities, all running on your machine. Nothing uploads by default.

Track every change

On commit, Ledgerful writes a signed, tamper-evident record of what changed and why — an audit trail for code inside the normal git workflow.

  • Signed record on commit
  • Tamper-evident audit trail
  • Git-integrated workflow

Assess risk

Before a commit, Ledgerful analyzes the blast radius of a change — affected files, which tests to run, risk level, and complexity hotspots.

  • Blast radius analysis
  • Affected files
  • Tests to run
  • Complexity hotspots

Prove what happened

Ledgerful generates offline-verifiable evidence — signed ledger entries and a SOC 2-style evidence export — that an auditor can check without trusting anyone's word.

  • Signed ledger
  • SOC 2-style export
  • Offline-verifiable chain-of-custody

Ask your codebase

Ledgerful builds a local knowledge graph of the codebase and answers plain-English questions grounded in the actual code.

  • Local knowledge graph
  • Plain-English queries
  • Route and function mapping

Ask is local-model-capable (Ollama). Any cloud model (Gemini/OpenRouter) is strictly opt-in and user-configured — nothing uploads by default.

Sample signed receipt

tx_id:        e09f48ab-0afe-4881-833f-8fd80048ea34category:     BUGFIXentity:       src/invoice.rschange_type:  Modifysummary:      fix(invoice): [DEMO] fix rounding error in tax calculationreason:       Switch tax calculation from f64 to Decimal to eliminate floating-point rounding.committed_at: 2026-07-14T01:47:02.876335722+00:00signed:       yessignature:    f3e27176…39807
Signed provenance record — one row from the verified sample-soc2 exportledger.csv — signed entry

The volume of change has outpaced the evidence for it.

More commits, more repositories, more evidence rebuilt after the fact.

More change, reviewed the same way

AI-assisted commits keep raising the volume of change a team produces, while most of it still gets the same diff-sized review it always did.

Risk spreads across repositories

Once work spans more than one repository, risk collects across all of them at once — and no single diff view shows that picture.

Evidence gets reconstructed after the fact

When an audit or incident review happens, evidence is usually rebuilt afterward from commit messages and memory, instead of captured at the time of the change.

What a scan actually produces

Each output is a captured artifact from a real v0.2.8 run.

Risk summary

Ledgerful local dashboard showing Project Health and Recent Changes for a scanned sample repository, with per-file risk state
Local dashboard receipthttp://127.0.0.1:52001/dashboard

Verification plan

Verification Steps:  • git diff --cached --check (timeout: 400s)  • git diff --check (timeout: 400s)  • npm run build (timeout: 400s)Dry run mode: verification plan displayed above. No commands were executed.
Verification plan — sample-repo capture on v0.2.8ledgerful verify --dry-run

Evidence export

{  "generatedAt": "2026-07-14T01:47:02.982622805+00:00",  "files": [    { "name": "chain_head.json", "sha256": "3a0555a3cdc06156530aaff441232247bae2c105ea7c199b8c9a77f836cba68f", "size": 431 },    { "name": "ledger.csv", "sha256": "25ca4a8d…2927b63", "size": 3266 },    { "name": "verification_history.csv", "sha256": "56ef6d6a…6ed0e84", "size": 57 }  ],  "entryCount": 7}
Evidence export manifest — tamper-evidence hashes, sample-soc2 exportmanifest.json

What's available today

Local CLI, dashboard, signed provenance, and SOC 2-style evidence export are implemented now. Team sync is beta. Hosted and enterprise features are planned — see the full breakdown on the editions page.

Local by default

The engine, ledger, and dashboard run on your machine. Hosted sync is planned, not live — see the architecture page and the trust page.

ledgerful 0.2.8 (c99779aa2b9b)
Binary version — captured from v0.2.8ledgerful --version
✓ Doctor: ready for publish env · 6 warning(s)Ledgerful Doctor - Environment Health Check==================================================Environment:         WslActive Shell:        UnknownLEDGERFUL_PLATFORM:  os=linux, arch=x86_64, family=unix, target_triple=x86_64-unknown-linux-gnuTools:  git                Found (/usr/bin/git)  gemini             NOT FOUNDCurrent Path:        /tmp/neutral-repoPath Type:           NativeWork root:           /tmp/neutral-repoState dir:           /tmp/neutral-repo/.ledgerfulActive Ask Backend:  Local (127.0.0.1)Native Graph:        Ready (CozoDB active, 0 nodes, 0 edges)Index Health:  • Gate mode: observe (no ledger transition history yet)  • Search index: Empty (0 documents — run 'ledgerful index')  • [warn] [graph-empty] Graph state: Empty (never indexed)  • [warn] [impact-missing] Impact report: None (run 'ledgerful scan --impact')  • [warn] [search-empty] Search index: present but empty (0 documents); full-text search unusable until populated    ledgerful index    # first search also rebuilds when empty:    # ledgerful search "<query>"    ledgerful doctor --json  • [warn] [sig-pin] no intent.trusted_public_keys pinned; crypto-valid signatures report VALID (unknown key). Pin keys after init or re-sign. Local signing identity not found under ~/.ledgerful/keys; complete init/signing before pinning.    ledgerful init    # or complete first signing so ~/.ledgerful/keys/public.pem exists, then:    ledgerful doctor --json    # follow the sig-pin remediation once the public key is readable  • [warn] [sig-version] intent.min_sig_version=1 still accepts legacy v1 signatures. All LOCAL rows already have sig_version >= 2; set min_sig_version=2 to close the downgrade path.    ledgerful config set intent.min_sig_version=2    ledgerful verify --signatures── Optional Accelerators ──────────────────────Embedding Model:     unreachable (Local embedding model server at http://127.0.0.1:8083 is unreachable after 1 retries)Completion Model:    Not configured9 hygiene finding(s) collapsed — run doctor --fullGPU VRAM:            n/a (Windows-only monitoring)
Environment health check — captured from v0.2.8ledgerful doctor
Verification Health CheckChecking verification dependencies...  Checking git...  [OK] git is available.  Checking ledger state...  [NOTE] No impact report found. Run 'ledgerful scan --impact' after making changes.  [OK] Runner: cargo test (nextest not available)All verification dependencies are available.
Verification dependency check — captured from v0.2.8ledgerful verify --health

Real output from a v0.2.8 run on Linux x86_64. Source files in public/evidence/. Program stdout is reproduced verbatim.

See the public ledger

Ledgerful's own development change ledger is published at /ledger — signed for provenance; v1 sample rows verify offline in the browser, with a v2 honesty fence when redacted fields block full re-verify.

Start where you sit

Pick the entry point that matches your role.

Developer

Install the CLI and run a scan against a real repository on your own machine.

Go to install steps

Engineering manager

Compare available, beta, and planned editions before committing a team to one.

See editions

Security or compliance reviewer

Read the trust posture: what runs locally, what is opt-in, and what evidence exports contain.

Read the trust page

Get launch updates

Ledgerful v0.2.8 is installed today. If you want launch announcements and changelog updates, leave your email. Open the full form.

Launch announcements and changelog updates. Double opt-in — you confirm from your inbox.

Install now, or read the docs first

The full install guide has platform-specific binaries and verification steps.

Open the install guideDocs