Relicta
What it is
Relicta is a free, MIT-licensed CLI for governing software changes before production. Its workflow handles commit analysis, semantic version planning, release notes, approval checks, and publishing, with rollback tracking and release audit trails. A seven-factor weighted risk calculation considers release history and incidents; the Change Governance Protocol includes factors such as blast radius, actor trust, and security impact, but governance is disabled by default. AI-assisted release notes can use OpenAI, Anthropic, Gemini, Azure, or Ollama. Publishing plugins are listed for GitHub, npm, Docker, Slack, Jira, and Helm. A native MCP server lets AI agents plan, assess risk, approve, and publish releases. Relicta runs locally or in CI without a SaaS or cloud dependency, and the maker says data remains in the user’s environment. Decisions are stored in an immutable SHA-256 hash chain. It creates in-toto v1 attestations signed through Sigstore, generates software bills of materials, isolates plugins, and redacts API keys and tokens from output and logs. macOS, Linux, and Windows are supported on x86_64 or arm64.
For and against
For
- Open-source MIT-licensed CLI
- Seven-factor release risk calculation
- Native MCP server for AI agents
- Immutable SHA-256 governance trail
- Runs locally or in CI
Against
- Governance is disabled by default
- Requires command-line deployment
- Plugin capabilities are restricted
- Supported systems are limited to listed architectures
The verdict
Relicta combines release workflow automation, risk assessment, approvals, and supply-chain records in a local-first CLI. Its open-source model and MCP support suit engineering teams that want governance without SaaS dependence.
Who it suits
Relicta is aimed at platform engineers, release managers, security and compliance teams, and organizations adopting AI agents. It fits teams wanting local or CI-based release governance.
On the record
- AI agents
- Relicta provides a native MCP server through which AI agents can plan, assess risk, approve, and publish releases.relicta.tech · read 4 Oct 2026
- AI agent support
- Relicta provides a native MCP server through which AI agents can plan, assess risk, approve, and publish releases.relicta.tech · read 3 Oct 2026
- AI providers
- AI release notes are supported through OpenAI, Anthropic, Gemini, Azure OpenAI, and local Ollama, with provider API keys required for AI features.docs.relicta.tech · read 4 Oct 2026
- Attestation
- Relicta says it creates in-toto v1 attestations signed via Sigstore.relicta.tech · read 3 Oct 2026
- Audit trail
- Governance decisions are recorded in an immutable SHA-256 hash chain.relicta.tech · read 3 Oct 2026
- Integrations
- The docs describe publishing plugins for GitHub, npm, Slack, Docker, and other channels, plus a GitHub Action for CI/CD.docs.relicta.tech · read 4 Oct 2026
- Intended users
- The maker identifies platform engineers, release managers, security and compliance teams, and teams adopting AI agents as audiences.relicta.tech · read 4 Oct 2026
- License
- The maker describes the CLI as open source under the MIT license.relicta.tech · read 4 Oct 2026
- Plugin security
- The maker says plugins run in isolated processes with capability-based restrictions on filesystem, network, and environment access.relicta.tech · read 4 Oct 2026
- Purpose
- Relicta is a CLI that governs software changes and automates semantic versioning, release notes, approvals, and publishing.docs.relicta.tech · read 4 Oct 2026
- Release workflow
- Its release workflow can analyze commits, bump versions, generate release notes, apply approval checks, and publish releases.relicta.tech · read 4 Oct 2026
- Risk analysis
- Relicta describes a seven-factor weighted risk calculation that learns from past releases and incidents.relicta.tech · read 3 Oct 2026
- Risk assessment
- Its Change Governance Protocol evaluates releases using factors including blast radius, actor trust, and security impact; governance is disabled by default.docs.relicta.tech · read 4 Oct 2026
- Secret handling
- The maker says API keys and tokens are automatically redacted from output and logs by default.relicta.tech · read 3 Oct 2026
- Security
- The maker says Relicta runs locally or in CI without a SaaS or cloud dependency and records governance decisions in an immutable SHA-256 hash chain.relicta.tech · read 4 Oct 2026
- Supply chain
- Relicta describes in-toto v1 attestations signed via Sigstore and software bill of materials generation.relicta.tech · read 4 Oct 2026
- Supply-chain feature
- The maker lists software bill of materials generation for supply-chain transparency and compliance.relicta.tech · read 3 Oct 2026
- Supported operating systems
- The CLI requirements list macOS, Linux, and Windows for x86_64 or arm64.docs.relicta.tech · read 4 Oct 2026
