Capsem 发布 Rust 超轻量级 AI 代理沙箱：基于 KVM 实现秒级启动与 MCP 策略隔离

A Rust-powered hypervisor that sandboxes every AI coding agent in its own air-gapped Linux VM. See everything, control everything.

$ curl -fsSL https://capsem.org/install.sh | sh Learn More

Ready to code, out of the box

A fully configured Linux dev environment with your favorite AI agents, MCP tools, and packages pre-installed. Boot to prompt in under 10 seconds.

Broad agent support

All major AI coding agents, pre-installed and auto-configured for sandbox mode.

Claude Code AnthropicGemini CLI GoogleCodex OpenAI

Native MCP endpoint

Policy-checked tool access over vsock. Built-in tools plus custom MCP servers via fastmcp.

fetch_http Fetch and extract web contentgrep_http Search web pages with regexhttp_headers Inspect HTTP headers and status

Preconfigured environment

Python, Node.js, and 30+ packages ready to go. No setup required.

Python 3Node.js 24gituvnumpypandasscipyscikit-learnrequestshttpxbeautifulsoup4pytestrichmatplotlibfastmcp

Coming soon

Active development. Here's what's next.

• VM checkpointing and restore
• Linux host support
• VS Code extension
• Custom MCP server marketplace

Demo video

Security without compromise

ISOLATION

Hardware-level sandboxing with Apple Virtualization.framework

Each agent session boots a lightweight Linux VM with a read-only rootfs, no swap, no kernel modules, no debugfs. Air-gapped networking with a dummy NIC and fake DNS ensures nothing reaches the real network without going through the MITM proxy.

• Ephemeral VMs -- fresh state every session
• Read-only rootfs with tmpfs workspace
• No systemd, no sshd, no cron -- minimal attack surface

Screenshot placeholderINSPECTION

See everything your AI agent does on the network

A transparent MITM proxy terminates TLS from the guest using per-domain minted certificates, inspects every HTTP request and response, and applies policy before forwarding to the real upstream. Full request/response bodies are logged to a per-session SQLite database.

• Per-domain TLS certificate minting
• Method + path policy rules per domain
• Full body capture for post-hoc analysis

Screenshot placeholderCONTROL

Enterprise-grade policy with profile and corp config layers

Each profile owns its enforcement, detection, MCP, plugin, and asset configuration. Corp-level config at /etc/capsem/corp.toml (MDM-distributed) locks down policy and reporting with enterprise overrides that users cannot bypass.

• Profile-owned CEL enforcement rules
• Detection rules with Sigma import/export
• Corp config locks and reports profile behavior

Screenshot placeholder

How it works

A native macOS hypervisor creates an air-gapped Linux VM for each session. All network traffic is forced through an inspecting proxy on the host.

macOS Host Desktop App GUI + CLI interface MITM Proxy TLS termination + HTTP inspection Policy Engine Domain + HTTP + MCP rules Session Telemetry SQLite DB per session vsock terminal HTTPS + MCP Linux VM (air-gapped) AI Agent Claude / Gemini / Codex PTY Agent Terminal I/O over vsock Net Proxy TCP-to-vsock relay (iptables) MCP Server Tool relay over vsock Internet (via host MITM proxy only)FAQ

Frequently Asked

Questions

Still have a question?

Open an issue on GitHub

All guest HTTPS traffic is redirected through an iptables rule to a local TCP relay, which bridges to the host via vsock. The host terminates TLS using per-domain minted certificates (signed by a static Capsem CA baked into the guest's trust store), inspects the HTTP request, applies policy, and forwards to the real upstream.

Download Capsem

Open source, native macOS and Linux packages, boots in under 10 seconds.

$ curl -fsSL https://capsem.org/install.sh | sh

or download the package from the stable channel

Download Package (opens in new tab) View on GitHub (opens in new tab)

Requires macOS 14+ on Apple Silicon or Debian/Ubuntu Linux with KVM. Capsem uses Apple Virtualization.framework on macOS and KVM on Linux.