chainloop
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, che
What is chainloop?
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.
Overview of chainloop
What it is
Chainloop is agentic SDLC infrastructure. It collects what happens across software delivery, from the first prompt to the release, into one trusted graph. Every AI coding session, pull request, build, SBOM, scan, and test report becomes a signed, timestamped record in your own registry or bucket. Rules live in git. Break one and the pipeline fails. It is built on Sigstore and in-toto. It is open source under Apache 2.0 and self-hostable. It has been in production on critical infrastructure at highly regulated enterprises since 2024.
Key features
- Collects signed, timestamped records of AI coding sessions, pull requests, builds, SBOMs, scans, and test reports into your own OCI registry, S3, or Azure Blob.
- Defines guardrails via workflow contracts and policies written in Rego or WASM.
- Enforces continuously: checks every record against the contract and its policies; if it fails, the pipeline fails and violations are signed into the record.
- One set of rules for people, pipelines, and AI agents; no separate AI governance track.
- Rules are code (Rego or WASM), not prompts, giving deterministic answers.
- Evidence is a signed in-toto attestation in your own storage, verifiable with standard tools.
- Supports starting report-only (gate: false) and later gating (gate: true).
Use cases
- Governing AI coding agent sessions and enforcing approved models and no secrets in prompts.
- Enforcing CI/CD pipeline compliance: every release must have an SBOM, tests must pass, scans must be clean.
- Collecting signed audit evidence for compliance without manual collection.
- Closing the verification loop: agents fix work based on policy failures printed in the pipeline.
Getting started
Install the CLI and log in: bash curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss chainloop auth login Collect signals from CI/CD: bash chainloop attestation init --workflow build --project my-app chainloop attestation add --value sbom.cyclonedx.json chainloop attestation push For AI coding sessions, use chainloop trace. See the repository README for more details.
License and pricing
Licensed under Apache 2.0. The CLI and self-hosting are free and unlimited. Chainloop Cloud is free for 14 days.
Based on the project's public README and repository metadata.
