Atlantis: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project (CNCF Sandbox since 2024-06-18)
Owner: no company; a Series of LF Projects, LLC; three listed maintainers employed by Lambda, Slalom and Meetup, plus three core contributors
Engine: runs the Terraform or OpenTofu binary and Terragrunt through workflow steps
Licence: Apache-2.0; no paid edition and no vendor selling support in the sources read
Latest release: v0.48.1 (2026-10-07), a security fix
Support lifecycle: no supported-versions statement; upgrade by new tag; breaking changes arrive in minor versions (v0.42.0, 2026-04)
Next milestone: v0.49.0 stops bundling Terraform and OpenTofu in the container images (announced 2026-09-22, no date)
Targets: Terraform at whatever version you configure (no 1.5.x ceiling found in the sources read, 2026-10-15; v0.48.0 only dropped end-of-life versions), OpenTofu since v0.30.0 (2024-09), Terragrunt through workflows; self-hosted on a VM, Kubernetes or Fargate; GitHub, GitLab, Bitbucket and Azure DevOps
Tier: IaC management platform
Archetype: Dependable builder
Evidence grade: B. Repository, release pages, MAINTAINERS.md, policy docs and the CNCF project page were read from primary sources (2026-10-15). Release years before 2026 are inferred from the sequence on the GitHub release pages, which carry no year. The 2017 to 2023 capability states are inferred from the project description, since the notes read start at v0.28.

Not ranked: Fails inclusion test 4: drift detection is an alpha API behind a flag since v0.45.0 (2026-06-28)

Scorecard

Dimension	Score	Direction
Capability today	34.7 / 100	higher is better
Momentum since end of 2022	+12.6 points (2017 to 2022: +0.0)	higher is better
Credibility	15.5 / 25	higher is better
Sustainability risk	11.0 / 25	lower is better
Technical lock-in	2.5 / 25	lower is better
Integrator fit	6.0 / 20	higher is better
AI leverage	1.5 / 20	higher is better
Ledger Index	46.0 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	n/a	1.5	1.5	2.5
Configuration management depth (12)	n/a	0	0	0
State, planning and safety (12)	n/a	2	2	3
Language and authoring (10)	n/a	1	1	1
Orchestration and self-service (10)	n/a	1.5	1.5	2.5
Scale and control plane (8)	n/a	1	1	2
Security and compliance (10)	n/a	1.5	1.5	2.5
Bare metal and day-2 operations (8)	n/a	0	0	0
Ecosystem and integrations (8)	n/a	2	2	3
AI assistance (7)	n/a	0	0	0
Total / 100	n/a	22.1	22.1	34.7

Year by year: 2017: 22.1 · 2018: 22.1 · 2019: 22.1 · 2020: 22.1 · 2021: 22.1 · 2022: 22.1 · 2023: 22.1 · 2024: 29.9 · 2025: 31.7 · 2026: 34.7

What moved the score

Year	Domain	Change	Points	Trigger
2024	Ecosystem and integrations	2 → 3	+1.6	2024-06: CNCF Sandbox acceptance; four VCS, Slack and a Helm chart
2024	Orchestration and self-service	1.5 → 2	+1.0	v0.31.0 (2024-11): auto-merge method flag
2024	Provisioning breadth	1.5 → 2.5	+3.0	v0.30.0 (2024-09): OpenTofu support
2024	Security and compliance	1.5 → 2	+1.0	v0.32.0 (2024-12): image attestation; delegated authorisation in v0.30.0
2024	State, planning and safety	2 → 2.5	+1.2	v0.29.0 (2024-08): policy approval controls on top of conftest policy checks
2025	Orchestration and self-service	2 → 2.5	+1.0	v0.39.0 (2025-12): atlantis cancel for queued operations; mergeability reasons in v0.37.0
2025	Scale and control plane	1 → 1.5	+0.8	v0.35.0 (2025-06): parallel plan and apply in one workspace
2026	Scale and control plane	1.5 → 2	+0.8	v0.44.0 (2026-06): Redis cluster lock backend; apply fails closed when the lock backend is unreachable (v0.44.1)
2026	Security and compliance	2 → 2.5	+1.0	v0.44.0 (2026-06): sticky policy approvals; ruleset reviewer approvals in v0.42.0
2026	State, planning and safety	2.5 → 3	+1.2	v0.48.0 (2026-09): apply plans hashed and persisted; drift APIs alpha since v0.45.0 count half

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-06	Accepted into the CNCF Sandbox	Packaging	C
2024-08	v0.29.0: max comments per command; self-approve flag for policies	Security	C
2024-09	v0.30.0: OpenTofu support; delegated authorisation to external sources	Provisioning breadth	U
2024-12	v0.32.0: image attestation; configurable shells	Security	C
2025-02	v0.33.0: GitHub rate limit handling	Ecosystem	C
2025-06	v0.35.0: parallel plan and apply in one workspace	Scale	C
2025-11	v0.37.0: mergeability reasons; masked output in comments; Bitbucket Cloud API flag	Orchestration	C
2025-12	v0.39.0: atlantis cancel for queued operations	Orchestration	C
2026-01	v0.40.0: project name in the locking key	State and planning	C
2026-04	v0.42.0: breaking change to the undiverged requirement; ruleset reviewer approvals	Security	C
2026-06	v0.44.0: sticky policy approvals; Redis cluster support	Scale	C
2026-06	v0.45.0: drift detection and remediation APIs (alpha); localisation	State and planning	C
2026-06	v0.46.0: OpenTofu .tofu file detection; stricter apply validation	Provisioning breadth	U
2026-08	v0.47.0: drift API exposes plan output; separate plan store directory	State and planning	C
2026-09	v0.48.0: slim images; plans hashed and persisted; end-of-life Terraform versions removed; v0.49.0 to stop bundling binaries	Packaging	U
2026-10	v0.48.1: security fix (GHSA-fwc4-2f3p-7qm7)	Security	C

Centre of gravity: Security (4), State and planning (3), Packaging (2)
Blind spots (no items): Configuration management, Language, Bare metal, AI, Licensing
Driver mix: Vision 0%, Customer need 81%, Market window 0%, Upstream 19%, Portfolio 0%
Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 15.5 / 25

Criterion	Score	Basis
Cadence	3.5	16 tags in the 12 months to 2026-10-07, with a gap from September to November 2025 and four releases in June 2026
Roadmap transparency	3	Public repository and issues; breaking changes called out in release notes; no roadmap
Say-do	3	Little is promised; the v0.49.0 image change is announced and pending
Velocity	3	Drift APIs, plan store and sticky approvals in 2026 after a quiet 2025
Lifecycle stability	3	Breaking changes in minor versions (v0.29.0, v0.42.0); no LTS or supported-versions policy

Sustainability risk: 11.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	3.5	Three listed maintainers (Lambda, Slalom, Meetup) and three core contributors; no emeritus list
Backer health	3	CNCF Sandbox since 2024-06-18 under LF Projects; no company funds development; the website calls it volunteer powered
Licence-change risk	1	Apache-2.0 inside the CNCF; no licence change found
Abandonment signs	1.5	16 tags in 12 months and issues triaged in October 2026; releases paused from September to November 2025
Security response	2	Two advisories fixed in point releases (v0.47.1 on 2026-08-20, v0.48.1 on 2026-10-07); time from report to fix not published

Technical lock-in: 2.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	Plain Terraform or OpenTofu code; atlantis.yaml is the only project-specific file
Export path	0.5	Atlantis stores no state; remove the server and run the engine from CI
Stack coupling	1	Workflow YAML and pull request comment habits
Hardware / cloud coupling	0	Self-hosted anywhere; works offline except for the VCS connection
Skills and tooling coupling	0.5	Standard Terraform skills

Integrator fit: 6.0 / 20

Criterion	Score	Basis
Partner programme openness	1	No programme and no commercial support offer
Multi-tenancy and self-service	1	Repository and team allowlists only; one server per team in practice
API and infrastructure-as-code	2.5	HTTP API for plan, apply and locks; Helm chart and Fargate module; drift APIs alpha
Skills and certification	1.5	Documentation and community; no certification

AI leverage: 1.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	0	0	0	2017: None
AI platform stack	0	0	0	2017: None
AI-assisted operations	0	0	0	2017: None
Agent openness	1.5	1.5	1.5	2017: HTTP API for plan, apply and locks; drift APIs alpha since 2026-06; no MCP server found

Year by year: 2017: 1.5 · 2018: 1.5 · 2019: 1.5 · 2020: 1.5 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 1.5 · 2026: 1.5

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item was found in the website, README or release notes; the search allowance ran out before a dedicated search.

Atlantis has no AI feature and no MCP server in the sources read. Agents can only drive its HTTP API, which covers plan, apply and locks.

Reading

Atlantis is scored for reference only: it is the pull request workflow the paid platforms grew out of, and it remains free, self-hosted and easy to leave, with the lowest lock-in in the group. It is not ranked because drift detection exists only as an alpha API since v0.45.0, and the other platform functions (state, registries, self-service, SSO) are left to the engine, the VCS and the CI system. Sustainability risk is moderate: three volunteer maintainers and no funding company, offset by CNCF membership and a steady release record. The one thing to check is the v0.49.0 image change, after which you must supply the Terraform or OpenTofu binary yourself.

Open questions and items to re-score

Whether the drift detection and remediation APIs leave alpha, and when.
Release dates before 2026 are inferred from the release page order; the Atom feed and release page disagree on v0.48.0 (2026-09-29 versus 2026-09-22).
Original sponsoring company and any current corporate backing: not searched.
Any MCP or AI work: the issue search found none, a web search was not possible.
Supported-version policy and whether v0.49.0 ships on schedule.