Capsem -- The fastest way to ship with AI securely.

A Rust-powered hypervisor that sandboxes every AI coding agent in its own air-gapped Linux VM. See everything, control everything. curl -fsSL https://capsem.org/install.sh | sh A fully configured Linux dev environment with your favorite AI agents, MCP tools, and packages pre-installed. Boot to prompt in under 10 seconds. Broad agent support All major AI coding agents, pre-installed and auto-configured for sandbox mode. Claude Code AnthropicGemini CLI GoogleCodex OpenAI Native MCP endpoint Policy-checked tool access over vsock. Built-in tools plus custom MCP servers via fastmcp. fetch_http Fetch and extract web contentgrep_http Search web pages with regexhttp_headers Inspect HTTP headers and status Preconfigured environment Python, Node.js, and 30+ packages ready to go. No setup required. Python 3Node.js 24gituvnumpypandasscipyscikit-learnrequestshttpxbeautifulsoup4pytestrichmatplotlibfastmcp Coming soon Active development. Here's what's next. VM checkpointing and restore Linux host support VS Code extension Custom MCP server marketplace Demo videoISOLATION Hardware-level sandboxing with Apple Virtualization.framework Each agent session boots a lightweight Linux VM with a read-only rootfs, no swap, no kernel modules, no debugfs. Air-gapped networking with a dummy NIC and fake DNS ensures nothing reaches the real network without going through the MITM proxy. Ephemeral VMs -- fresh state every session Read-only rootfs with tmpfs workspace No systemd, no sshd, no cron -- minimal attack surface Screenshot placeholderINSPECTION See everything your AI agent does on the network A transparent MITM proxy terminates TLS from the guest using per-domain minted certificates, inspects every HTTP request and response, and applies policy before forwarding to the real upstream. Full request/response bodies are logged to a per-session SQLite database. Per-domain TLS certificate minting Method + path policy rules per domain Full body capture for post-hoc analysis Screenshot placeholderCONTROL Enterprise-grade policy with profile and corp config layers Each profile owns its enforcement, detection, MCP, plugin, and asset configuration. Corp-level config at /etc/capsem/corp.toml (MDM-distributed) locks down policy and reporting with enterprise overrides that users cannot bypass. Profile-owned CEL enforcement rules Detection rules with Sigma import/export Corp config locks and reports profile behavior Screenshot placeholder A native macOS hypervisor creates an air-gapped Linux VM for each session. All network traffic is forced through an inspecting proxy on the host. macOS Host Desktop App GUI + CLI interfaceMITM Proxy TLS termination + HTTP inspectionPolicy Engine Domain + HTTP + MCP rulesSession Telemetry SQLite DB per session Linux VM (air-gapped) AI Agent Claude / Gemini / CodexPTY Agent Terminal I/O over vsockNet Proxy TCP-to-vsock relay (iptables)MCP Server Tool relay over vsock Internet (via host MITM proxy only) Open source, native macOS and Linux packages, boots in under 10 seconds. curl -fsSL https://capsem.org/install.sh | sh or download the package from the stable channel Requires macOS 14+ on Apple Silicon or Debian/Ubuntu Linux with KVM. Capsem uses Apple Virtualization.framework on macOS and KVM on Linux.