Capability Host Protocol
Capability Host Protocol (CHP) is an open protocol that places a governed boundary at the point where an AI agent's intent becomes an effect, ensuring every action is checked against policy and recorded as tamper-evident, replayable evidence. It provides one-command instrumentation for agent CLIs like Claude Code, Codex, and Gemini CLI, capturing every tool call as a signed, hash-chained event that includes first-class denials with stable reason codes. This enables security, compliance, and engineering teams to prove what agents did, whether it was allowed, and to replay the entire session for audits or reviews.
- Regulatory & Compliance Technology
- Developer Tools
- Cybersecurity
- Artificial Intelligence
- AI Agents
- Enterprise Software
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
AI agents now execute consequential actions—reading files, running commands, publishing content—unattended, yet existing systems only manage access (who can enter) and leave accountability (what was done, whether it was allowed, and proof of it) unresolved. Security reviews, auditors, and regulators increasingly demand per-action evidence, but scattered, mutable logs cannot answer whether an action was permitted or denied, and the absence of a record for a denial is indistinguishable from the guardrail never firing.
Solution
Capability Host Protocol (CHP) is an open protocol that places a governed boundary at the point where an agent's intent becomes an effect. Every capability is declared with a stable ID, version, and policy; every invocation is checked against a fixed pipeline of policy, invariants, authority, and safety checks before it runs, with outcomes including first-class denials with stable reason codes. Each attempt—success, failure, or denial—is recorded as a signed, SHA256 hash-chained evidence event tied to a correlation ID, enabling full session replay across hosts and organizations. The protocol is implemented today via adapters for Claude Code, Codex, and Gemini CLI, requiring one command with no application code changes, and it standardizes the same governed event plane for human approvals and product API calls.
Target Audience
Primary users are security, compliance, and engineering teams at organizations deploying AI agents in software development, financial services, insurance, healthcare, and legal workflows, specifically those needing to pass security reviews, respond to audits, or satisfy regulatory requirements with provable action records.
Features
- One-command agent instrumentation that captures every tool call (Bash, Read, Edit, Write) as typed evidence events without code changes
- SHA256 hash-chained, tamper-evident evidence local to the host, where altering a block breaks the chain and is detectable
- First-class denial events with stable reason codes (e.g., policy_blocked), subject attribution, and retryability flags
- Unified evidence plane where human approvals, agent tool calls, and product API invocations are the same kind of governed, provable event
- Correlation IDs that tie a process spanning machines, services, and partners into a single ordered, replayable trace
- A fixed governance pipeline (policy, invariants, authority, autonomy, safety) that can allow, condition, or deny before an invocation executes
- Capability discovery through a capabilities.txt standard and managed product surfaces with stable contracts
- HTTP, OpenAPI, and GraphQL adapters that wrap existing APIs as CHP capabilities