CAPSEM

The fastest way to ship with AI securely.

Download Capsem

Choose your platform

macOSApple Silicon · .pkgLinuxx86_64 · .debLinuxARM64 · .deb
Release details ↗
curl -fsSL https://capsem.org/install.sh | sh
elie — zsh
$ curl -fsSL https://capsem.org/install.sh | sh

Animated demonstration: install Capsem, launch the agy image, build and preview a website, then launch a separate Codex VM and summarize fictional emails.

Your favorite AIs.

Switch anytime — or use all of them in parallel.

  • Claude Code
  • Codex
  • Gemini CLI
  • Antigravity
  • Ollama

Everything you need, out of the box.

Code

  • Python
  • Node.js
  • NumPy
  • pandas
  • SciPy
  • scikit-learn
  • Matplotlib
  • pytest

Tools

  • Git
  • GitHub CLI
  • uv
  • tmux
  • curl
  • FastMCP

MCP tools

  • fetch_http
  • grep_http
  • http_headers

Make it yours. Your tools. Your MCP servers. Your own images.

Build your environment

Built to help you move fast.

Nothing slows you down.

1.2s

Launch an environment

3kreq/s

Network that keeps up

60ms

Duplicate your environment

Recorded benchmarks · May–June 2026
Measurement details

Environment launch and duplication: macOS ARM64, June 2026, means of 3 runs (1,132.2 ms and 55.9 ms), rounded conservatively to 1.2 s and 60 ms. Network: historical May 2026 proxy baseline, 3,042.6 requests/s at 10 concurrent requests over 10 seconds. These isolated benchmarks do not measure agent readiness or external network speed. Results vary by hardware and workload.

Secure by default
so you can focus on your goal.

Isolation, protected credentials, and checks on what goes in and out.

An isolated agent workspace, hosted in a low-privilege process, connects to models and tools through Capsem’s security engine. Credentials stay outside the VM. Rules, privacy scanning, logging and reporting apply at the security boundary.Low-privilege processIsolated Linux VMYour workspaceAI agentTools & filesNo direct network accessSecurity engineAccess rulesPrivacy scanningCredential interpositionCredentialsKept outside the VMAI modelsMCP toolsWeb & APIsLogging & reportingActivity. Decisions. Evidence.
Explore the security architecture

Stay in control.

See everything.

Every action, request, and decision is recorded.

Interactions
Tool calltrace a8f2 · turn 1
fetch_httpcapsemallow

Arguments

{"url":"https://example.com"}

Observed response

200 OK · text/html · 2.4 KB

Model response09:41:04

Full control.

Seamlessly set boundaries at the semantic level.

CEL rules
Restrict MCP toolsdeny
mcp.tool_call.name == "delete_file"
Choose agent modelsallow
model.provider == "openai"
Restrict websitesdeny
http.host == "untrusted.example"

Detect threats.

Flag access to password files and secrets.

How to write a detection rule
title: Password file accessedlevel: highdetection:  selection:    file.read.name: passwords.txt  condition: selection
Password file accessedHigh

file.read.name = passwords.txt

Explore observabilityDeploy for your team
Illustrative examples