System integrity from the command line.

AuditWalk gives you visibility first, automation when you choose it. The free CLI helps you capture system state, establish a trusted baseline, and detect drift through a disciplined, evidence-first workflow.

Paid plans extend that foundation with trust and advisory workflows, watch automation, repair planning, and priority support, while keeping the same baseline-first safety model.

Start In 3 Steps

1. Open the User Guide

Follow the guided Linux install and first-run path.

User Guide

2. Run your first guided setup

Start the guided first-run flow.

auditwalk init

3. Continue with explicit CLI control

Use the CLI Guide for step-by-step scan run + baseline confirm control.

CLI Guide
auditwalk init is the guided quick path. For explicit scan run + baseline confirm first-run control, use the CLI Guide. If output is unclear, continue in Troubleshooting.

Scan observes. Baseline set is a decision.

These are separate steps for a reason. A scan captures what is present and makes no claim that the state is good. baseline confirm is your deliberate statement: "I have reviewed this and I trust it." That separation is part of the safety model.

01

scan run

Captures filesystem state. Observation only.

Free
02

baseline confirm

Your sign-off. Promotes the scan to trusted state.

Free
03

preflight run

Targeted verification of specific scopes.

Free
04

compare run

Full drift detection against the baseline.

Free
05

doctor run

Interprets drift evidence and recommends next steps.

Paid
06

repair plan

Generates reviewable repair plans.

Paid · v0.2

All operations are read-only unless you explicitly approve a repair plan. AuditWalk never mutates system state silently.

Free and paid commands at a glance.

AuditWalk’s free CLI gives you a practical baseline-first workflow on Linux today: capture current system state, establish a trusted reference, run scoped checks, compare for drift, inspect artifacts, and export structured evidence.

That free workflow is enough for many users to verify change, document outcomes, and build confidence in what their system is doing.

Paid capabilities extend that foundation with deeper advisory workflows, watch automation, extended retention, repair planning, expanded licensing, and priority support. For canonical grammar and advanced patterns, see the CLI Guide.

Command What it does Tier Status
scan run Captures current filesystem state into a versioned scan artifact Free Available
baseline confirm Promotes a selected scan artifact into the trusted reference state — your explicit sign-off Free Available
preflight run Runs a faster, scoped verification pass using the active baseline as reference Free Available
compare run Measures current system state against the active baseline and surfaces drift over time Free Available
inspect show Drills into a specific artifact, finding, or path for closer review Free Available
report render Produces structured output in Markdown, JSON, or PDF Free Available
status show Gives a quick overview of current baseline, trust, and working-state context Paid Available
trust show Displays trust-state context and related guardrails Paid Available
attention show Surfaces findings or paths that may require review or response Paid Available
diagnostic run Performs deeper examination of findings, targets, or modes such as semantic analysis before advisory judgment Paid · v0.2 Paid · v0.2
doctor run Interprets drift evidence and recommends next steps Paid Available
repair plan Generates a reviewable repair plan without silently modifying system state Paid · v0.2 Paid · v0.2

Availability markers: FreePaidPaid · v0.2

Start free. Upgrade when you need it.

Free covers evidence capture, baseline establishment, scoped verification, drift comparison, artifact inspection, and report export. Paid adds trust/advisory workflows, deeper interpretation, repair planning, watch automation, and priority support. Early Adopter pricing is $9 off standard rates.

Free

$0

forever

  • scan run, baseline confirm, preflight run
  • compare run, inspect show, report render
  • Versioned artifacts
  • Community support via GitHub
Open Install Guide

1 Year

$29

$20

*

early adopter rate · $29 at GUI launch

  • Includes everything in Free
  • Watch automation
  • status show, trust show, attention show
  • doctor run
  • repair plan (ships v0.2)
  • Priority support
  • Early access to macOS & Windows CLI
  • GUI included free for license term
Get 1-Year License

2 Years

$39

$30

*

about $15/year · $39 at GUI launch

  • Includes everything in Free
  • Watch automation
  • status show, trust show, attention show
  • doctor run
  • repair plan (ships v0.2)
  • Priority support
  • Early access to macOS & Windows CLI
  • GUI included free for license term
Get 2-Year License

3 Years — Best Value

$49

$40

*

about $13.33/year · $49 at GUI launch

  • Includes everything in Free
  • Watch automation
  • status show, trust show, attention show
  • doctor run
  • repair plan (ships v0.2)
  • Priority support
  • Early access to macOS & Windows CLI
  • GUI included free for license term
Get 3-Year License

*Early Adopter rate — $9 off standard pricing while the GUI is in development. The GUI is not yet included in the download, but when it ships it will be included at no extra charge for the duration of your license term. status show, trust show, attention show, and doctor run are paid workflows; repair plan ships in v0.2 for paid licenses. Standard pricing ($29 / $39 / $49) takes effect at GUI launch.

EARLY ADOPTER

Free covers evidence capture, baseline establishment, scoped verification, drift comparison, artifact inspection, and report export. Paid adds trust/advisory workflows, deeper interpretation, repair planning, watch automation, and priority support.

Start your first system baseline in under two minutes.

Install from the official Linux CLI release:

1) Open /help/user-guide/
2) Follow the Linux install steps
3) Return here for first-run commands

Run your first scan, set your baseline, and verify with preflight:

auditwalk scan run --profile full
auditwalk baseline confirm <scan_id>
auditwalk preflight run
auditwalk compare run

AuditWalk operates in observation mode by default. Nothing modifies your system unless explicitly approved.

Need term definitions while reading command output? Use the CLI Glossary.

macOS and Windows CLI are in development. Join the macOS waitlist or Windows waitlist.

Resources and Support