Capability Host Protocol (CHP) is an open protocol that creates a governed boundary for AI agent actions, making every capability invocation provable and replayable as tamper-evident evidence. It standardizes how capabilities are declared, called, and governed, turning what an agent can do into a single signed record that includes policy checks, human approvals, and denials. CHP integrates with existing agent frameworks and MCP without replacing them, providing accountability for consequential actions like publishing content or executing financial transactions.
Funding
Funding not disclosed
Founders
Product
Problem
AI agents increasingly perform consequential actions—publishing content, executing trades, or issuing commands—but current systems provide no standard way to prove what an agent actually did, whether it was authorized, or what it was stopped from doing. Scattered logs lack governance context, making it impossible to answer accountability questions during security reviews, audits, or regulatory inquiries.
Solution
Capability Host Protocol (CHP) is an open protocol that puts a governed boundary at the point of action, capturing every capability invocation as structured, tamper-evident evidence on a single signed record. When an agent, person, or product invokes a capability through CHP, the protocol records what was attempted, what happened, and what governed it—including policy checks, risk tiers, safety conditions, human approvals, and any denials—all signed together. This makes a human approval, an agent's tool call, and a product's API call the same kind of governed, provable event, correlated across hosts via a single correlation ID. CHP is not a model provider, agent framework, or policy vendor; it standardizes one boundary—how capabilities are declared, called, governed, and proven—and works alongside MCP, OpenTelemetry, and existing authorization systems.
Target Audience
Primary customers are security reviewers, auditors, compliance officers, and engineering teams who need to prove what AI agents did—and what they were stopped from doing—in regulated industries including financial services, insurance, legal, healthcare, and software platforms. The protocol also serves organizations deploying agents for publishing, trading, machine control, and other consequential actions where accountability is critical.
Features
- One-command integration that hooks agent CLIs and captures every tool call (Bash, Read, Edit, Write) as replayable, tamper-evident evidence without application code changes
- First-class denial handling: when policy, entitlement, or safety checks fail, the denial is recorded as a structured outcome rather than a swallowed exception
- Hash-chained evidence blocks that verify integrity, with each block hashing the one before it to create a verifiable chain of custody
- Correlation IDs that tie multi-host, multi-org processes into a single ordered trace, enabling replay of work across machines, teams, and partners
- Capability declaration system with stable identity, versions, permission requirements, and per-invocation evidence for product APIs and services
- Governed human approval workflow that makes sign-offs, consents, and authorizations first-class provable events in the same record as agent actions
- capabilities.txt standard for hosts to advertise what they can do, complementing llms.txt and robots.txt for the agentic web
- Open-source core (Apache-2.0) with a public specification, enabling adoption across different agent frameworks and infrastructure