PRODUCT

Inventory.

One inventory across every Windows package manager.

IN DEV
Request access

Currently in development — early-access slots available.

THE PROBLEM

What's broken without it.

Today, asking "what is installed across our fleet?" requires reconciling outputs from winget, Chocolatey, Scoop, npm, pip, .NET tools, PSGallery, and the registry. Each tool has its own version conventions, identity model, and gaps. Inventory drift goes unnoticed for months, and the picture you give the auditor is always at least 24 hours stale.

audit-trail.log · status quo
1 # T+0 install completes on 1,204 endpoints
2 # T+2d scanner runs across the fleet
3 # T+2d scanner flags 14 endpoints with vulnerable artifact
4 # T+3d helpdesk tickets begin to arrive
5 # T+5d incident response opens IR-2026-0418
6 # T+9d auditor asks: "who approved this artifact?"
7 # T+9d answer: nobody. it shipped because the CDN said so.
HOW ATTESTREE SOLVES IT

The approach.

Attestree Inventory unifies every Windows package manager into a single attested inventory model. Every install, upgrade, and uninstall emits a normalized event keyed by canonical artifact identity. The fleet view is live, queryable, and exportable as a signed bundle — the same one your auditor reads.

attestree.toml · inventory
1 # One inventory across every Windows package manager.
2 # Live today in the free Community Edition (winget;
3 # more managers as they land). Run it free -> /community
WHAT'S NEXT

Roadmap, in three moves.

Q4 2026

Canonical artifact IDs

Stable identity across winget, Choco, Scoop, npm, pip — no more reconciliation joins.

design-partner mode through GA

Live fleet query

GraphQL-style API for "show me every machine running X version Y or older."

Q2 2027

Drift alarms

Automatic alerts when a fleet diverges from its declared desired-state manifest.

Ready for inventory on your fleet?

Early-access slots are open through GA. Tell us about your fleet.