Local-first spreadsheet verification for agent workflows

Know whether a recalculated workbook is safe to use.

Recalc Verify opens .xlsx/.xlsm files locally, recalculates without network access, and emits a deterministic, machine-readable report. Unsupported, blocked, and unavailable evidence are refusals—not guessed values.

Download the CLI Get the open-source engine Discuss a production integration

One command, explicit outcome

Install: download the archive for your platform from the latest release, check it against SHA256SUMS, and unpack it. No runtime, no Rust toolchain, no account. Linux archives are static binaries; macOS covers Apple silicon and Intel; Windows ships as a zip. Every archive carries build provenance you can check with gh attestation verify.

tar -xzf recalc-v0.1.1-x86_64-unknown-linux-musl.tar.gz
./recalc verify examples/demo.xlsx --policy examples/recalc-policy.toml --json report.json

Exit 0 is PASS, 1 is a measured FAIL, 2 is FALLBACK when a safe calculation or requested evidence is unavailable, and 64 is a usage error. Reports use recalc.verify.report/v1. The archive includes a passing demo workbook and a stale one that fails with the changed cells named. Add --baseline BASELINE.xlsx for an explicit local comparison; identified pinned-Excel results remain a separate evidence mode.

Evidence, not adjectives

Computed

Values produced by the engine are reported with workbook and policy hashes.

Compared

Stored values, a supplied baseline, or an explicitly supplied Excel result are labelled separately.

Refused

#UNSUPPORTED!, #BLOCKED!, parse failures, external references, and resource limits remain visible.

A local cached-value match is useful workflow evidence, but it is not an independent pinned-Excel oracle result.

Private by default

The verifier reads and writes only paths you provide. It makes no formula network calls and does not upload workbook content. Diagnostic bundles are explicit and opt-in.

Read the Verify contract Security contact