Capsem — The fastest way to ship with AI securely.

CAPSEM

curl -fsSL https://capsem.org/install.sh | sh

Install Capsem, build and preview a website in an AGY VM, explicitly create a separate Email productivity VM through the TUI, then open the GUI and create four more sessions. Type a different prompt in each tab while earlier agents keep working independently in their own VMs.

Your favorite AIs.

Switch anytime — or use all of them in parallel.

Claude Code
Claude Code
Codex
Codex
Gemini CLI

Paste into your agent to get started.
Antigravity

Paste into your agent to get started.
Ollama

Paste into your agent to get started.

Everything you need, out of the box.

Make it yours. Your tools. Your MCP servers. Your own images.

Build your environment

Built to help you move fast.

Nothing slows you down.

1.2s

Launch an environment

3kreq/s

Network that keeps up

60ms

Duplicate your environment

Recorded benchmarks · May–June 2026

Measurement details

Environment launch and duplication: macOS ARM64, June 2026, means of 3 runs (1,132.2 ms and 55.9 ms), rounded conservatively to 1.2 s and 60 ms. Network: historical May 2026 proxy baseline, 3,042.6 requests/s at 10 concurrent requests over 10 seconds. These isolated benchmarks do not measure agent readiness or external network speed. Results vary by hardware and workload.

Secure by default
so you can focus on your goal.

Isolation, protected credentials, and checks on what goes in and out.

Legend

Components, inputs and outputs
No host-permission level assigned by this diagram.
Control and processing
Components or stages that manage and process operations.
Host-held credentials
Credential material stays outside the VM.
Per-VM ownership
Dashed boundary groups components assigned to one VM.
VM hardware boundary
Separates the Linux VM and its workload from host processes.

From	Connection	To
Isolated Linux VM	uses	Security engine — — Access rules — Privacy scanning — Credential interposition
Credentials — Kept outside the VM	uses · control	Security engine — — Access rules — Privacy scanning — Credential interposition
Security engine — — Access rules — Privacy scanning — Credential interposition	uses	AI models
Security engine — — Access rules — Privacy scanning — Credential interposition	uses	MCP tools
Security engine — — Access rules — Privacy scanning — Credential interposition	uses	Web & APIs
Security engine — — Access rules — Privacy scanning — Credential interposition	uses · control	Logging & reporting — Activity. Decisions. Evidence.

Explore the security architecture

Stay in control.

See everything.

Every action, request, and decision is recorded.

Interactions

Tool call09:41:03trace a8f2 · turn 1

fetch_httpcapsemallow

Arguments

{"url":"https://example.com"}

Observed response

200 OK · text/html · 2.4 KB

Model response09:41:04

Full control.

Seamlessly set boundaries at the semantic level.

CEL rules

Restrict MCP toolsdeny

mcp.tool_call.name == "delete_file"

Choose agent modelsallow

model.provider == "openai"

Restrict websitesdeny

http.host == "untrusted.example"

Detect threats.

Flag access to password files and secrets.

How to write a detection rule

title: Password file accessedlevel: highdetection:  selection:    file.read.name: passwords.txt  condition: selection

Password file accessedHigh

file.read.name = passwords.txt