Intro

Capsem runs AI agents and tools from container images inside isolated Linux VMs on your computer. It provides a security layer for inspecting requests, applying access rules, and recording activity.

Like Docker, Capsem runs as a service that you can control from command-line tools or code. Use it for interactive work through the terminal interface (TUI) or graphical Capsem UI, or integrate it into your own product and evaluation workflows with the Python, TypeScript, or Rust SDK.

Legend

• Components, inputs and outputs
  No host-permission level assigned by this diagram.
• Control and processing
  Components or stages that manage and process operations.
• VM hardware boundary
  Separates the Linux VM and its workload from host processes.

From	Connection	To
TUI · Capsem UI · SDK — AI agent via MCP	use	Capsem — Controls access · records activity
Capsem — Controls access · records activity	runs	ISOLATED LINUX VMs

Install Capsem

Install Capsem on your computer first. Installation sets up the service, command-line tools, and Capsem UI.

Choose how to use it

After installation, choose your use case:

• Work interactively: create a VM and access it through the TUI or Capsem UI to run your agent and work with its files.
• Automate evaluations or integrate into a product: create a VM and run commands with the SDK, then integrate VM workflows into your application.
• Deploy for an organization: manage policy, credentials, and images for your team.