Capsem：Rust 驅動的 Linux VM 沙箱，隔離 AI 代理
Capsem – a Rust hypervisor sandboxing AI agents in air-gapped Linux VMs
Capsem 是一個用 Rust 開發的雲端虛擬機器，為每個 AI 代理提供獨立的空氣隔離 Linux VM 沙箱，支援 Claude、Gemini、Codex 等主流代理，啟動時間不到 10 秒。
Capsem 提供硬體層隔離 AI 代理沙箱，便於安全開發與監控，並可即時檢視網路行為，支援多主流 AI 編碼代理。
A Rust-powered hypervisor that sandboxes every AI coding agent in its own air-gapped Linux VM. See everything, control everything.
curl -fsSL https://capsem.org/install.sh | sh
A fully configured Linux dev environment with your favorite AI agents, MCP tools, and packages pre-installed. Boot to prompt in under 10 seconds.
Broad agent support
All major AI coding agents, pre-installed and auto-configured for sandbox mode.
Claude Code Anthropic
Gemini CLI Google
Codex OpenAI
Native MCP endpoint
Policy-checked tool access over vsock. Built-in tools plus custom MCP servers via fastmcp.
fetch_http Fetch and extract web content
grep_http Search web pages with regex
http_headers Inspect HTTP headers and status
Preconfigured environment
Python, Node.js, and 30+ packages ready to go. No setup required.
Python 3Node.js 24gituvnumpypandasscipyscikit-learnrequestshttpxbeautifulsoup4pytestrichmatplotlibfastmcp
Coming soon
Active development. Here's what's next.
- VM checkpointing and restore
- Linux host support
- VS Code extension
- Custom MCP server marketplace
Demo video
ISOLATION
Hardware-level sandboxing with Apple Virtualization.framework
Each agent session boots a lightweight Linux VM with a read-only rootfs, no swap, no kernel modules, no debugfs. Air-gapped networking with a dummy NIC and fake DNS ensures nothing reaches the real network without going through the MITM proxy.
- Ephemeral VMs -- fresh state every session
- Read-only rootfs with tmpfs workspace
- No systemd, no sshd, no cron -- minimal attack surface
Screenshot placeholder
INSPECTION
See everything your AI agent does on the network
A transparent MITM proxy terminates TLS from the guest using per-domain minted certificates, inspects every HTTP request and response, and applies policy before forwarding to the real upstream. Full request/response bodies are logged to a per-session SQLite database.
- Per-domain TLS certificate minting
- Method + path policy rules per domain
- Full body capture for post-hoc analysis
Screenshot placeholder
CONTROL
Enterprise-grade policy with profile and corp config layers
Each profile owns its enforcement, detection, MCP, plugin, and asset configuration. Corp-level config at /etc/capsem/corp.toml (MDM-distributed) locks down policy and reporting with enterprise overrides that users cannot bypass.
- Profile-owned CEL enforcement rules
- Detection rules with Sigma import/export
- Corp config locks and reports profile behavior
Screenshot placeholder
A native macOS hypervisor creates an air-gapped Linux VM for each session. All network traffic is forced through an inspecting proxy on the host.
macOS Host
Desktop App
GUI + CLI interface
MITM Proxy
TLS termination + HTTP inspection
Policy Engine
Domain + HTTP + MCP rules
Session Telemetry
SQLite DB per session
Linux VM (air-gapped)
AI Agent
Claude / Gemini / Codex
PTY Agent
Terminal I/O over vsock
Net Proxy
TCP-to-vsock relay (iptables)
MCP Server
Tool relay over vsock
Internet (via host MITM proxy only)
Open source, native macOS and Linux packages, boots in under 10 seconds.
curl -fsSL https://capsem.org/install.sh | sh
or download the package from the stable channel
Requires macOS 14+ on Apple Silicon or Debian/Ubuntu Linux with KVM. Capsem uses Apple Virtualization.framework on macOS and KVM on Linux.