Relicta
Relicta is an open-source CLI for controlling software changes before they reach production.
What Relicta is
Relicta is an open-source CLI for controlling software changes before they reach production. Its workflow spans commit analysis, version planning, release-note creation, approval checks, and publishing. A weighted risk assessment uses seven factors and learns from prior releases and incidents, though governance is disabled by default. The tool lists OpenAI, Anthropic, Gemini, Azure, and Ollama for AI-assisted release notes, plus publishing plugins for GitHub, npm, Docker, Slack, Jira, and Helm. A native MCP server lets AI agents plan releases, assess risks, approve changes, and publish. Relicta can run locally or in CI without a SaaS or cloud dependency; its maker says data stays in the user’s environment. Decisions are kept in an immutable SHA-256 hash chain, and the tool creates in-toto v1 attestations signed through Sigstore and generates software bills of materials. Plugins run in isolated processes with capability-based access restrictions, while API keys and tokens are redacted from output and logs by default. The CLI supports macOS, Linux, and Windows on x86_64 or arm64 and is licensed under MIT.
Good
- Release workflow includes approval checks and publishing.
- Seven-factor risk assessment learns from releases and incidents.
- Runs locally or in CI without a cloud dependency.
- Governance decisions use an immutable SHA-256 hash chain.
- Supports macOS, Linux, and Windows.
Watch out
- Governance is disabled by default.
- The CLI requires x86_64 or arm64 hardware.
- AI-assisted release notes list specific provider options.
Who it suits
Relicta is aimed at platform engineers, release managers, security and compliance teams, and teams adopting AI agents. It may suit teams that want release governance to run locally or in CI rather than through a SaaS service.
Verdict
Relicta brings risk assessment, approvals, release records, and publishing into a CLI workflow. Note that governance starts disabled, so teams must account for that setting when adopting it.
The facts
Each one read from Relicta's own pages, with the date it was checked.
What it does
- AI agents
- Relicta provides a native MCP server through which AI agents can plan, assess risk, approve, and publish releases.checked 4 Oct 2026
- AI agent support
- Relicta provides a native MCP server through which AI agents can plan, assess risk, approve, and publish releases.checked 3 Oct 2026
- AI providers
- AI release notes are supported through OpenAI, Anthropic, Gemini, Azure OpenAI, and local Ollama, with provider API keys required for AI features.checked 4 Oct 2026
- Attestation
- Relicta says it creates in-toto v1 attestations signed via Sigstore.checked 3 Oct 2026
- Audit trail
- Governance decisions are recorded in an immutable SHA-256 hash chain.checked 3 Oct 2026
- Integrations
- The docs describe publishing plugins for GitHub, npm, Slack, Docker, and other channels, plus a GitHub Action for CI/CD.checked 4 Oct 2026
- Intended users
- The maker identifies platform engineers, release managers, security and compliance teams, and teams adopting AI agents as audiences.checked 4 Oct 2026
- License
- The maker describes the CLI as open source under the MIT license.checked 4 Oct 2026
- Plugin security
- The maker says plugins run in isolated processes with capability-based restrictions on filesystem, network, and environment access.checked 4 Oct 2026
- Purpose
- Relicta is a CLI that governs software changes and automates semantic versioning, release notes, approvals, and publishing.checked 4 Oct 2026
- Release workflow
- Its release workflow can analyze commits, bump versions, generate release notes, apply approval checks, and publish releases.checked 4 Oct 2026
- Risk analysis
- Relicta describes a seven-factor weighted risk calculation that learns from past releases and incidents.checked 3 Oct 2026
- Risk assessment
- Its Change Governance Protocol evaluates releases using factors including blast radius, actor trust, and security impact; governance is disabled by default.checked 4 Oct 2026
- Secret handling
- The maker says API keys and tokens are automatically redacted from output and logs by default.checked 3 Oct 2026
- Security
- The maker says Relicta runs locally or in CI without a SaaS or cloud dependency and records governance decisions in an immutable SHA-256 hash chain.checked 4 Oct 2026
- Supply chain
- Relicta describes in-toto v1 attestations signed via Sigstore and software bill of materials generation.checked 4 Oct 2026
- Supply-chain feature
- The maker lists software bill of materials generation for supply-chain transparency and compliance.checked 3 Oct 2026
- Supported operating systems
- The CLI requirements list macOS, Linux, and Windows for x86_64 or arm64.checked 4 Oct 2026
Alternatives to Relicta
- 1
Octopus Deploy
Free planWebAPILinuxSelf-hosted7.3From $4,330 a year - 2
MidVision RapidDeploy
Free planWebAPILinuxmacOS7.1From $50 a year - 3
Devtron Release Orchestration
Free planWebAPISelf-hosted6.9From $499 a month - 4
Planview AdaptiveWork
AndroidiOSWebAPI6.9 - 5
Copado
Free planWebAPI6.7From $99 a year - 6
Ozone
Free planWebSelf-hosted6.6From $1,000 a month