CapSeal
A trust layer for AI coding agents. It learns which changes fail on your codebase, gates risky actions before they run, and seals every action into a tamper-evident hash chain — so what an agent did to your repo is a checkable fact rather than a claim.
Verify a real receipt, right here
Below is an actual sealed run — a security-fixes session where an agent patched a command-injection bug. Verifying a receipt is deterministic arithmetic, so it needs no server: your browser recomputes every SHA-256 hash and walks the chain itself.
verifying…
Hashes are recomputed in your browser with SHA-256. Nothing is sent anywhere — edit a sealed field below and watch the chain break.
- 00code_edit
Fixed command injection in export_video: replaced shell=True subprocess with list-based arguments, sanitized title_slug
sealed 7fc7b7f1ff…computed … - 01code_edithuman_review (0.5)
Fixed command injection in both get_preview functions: replaced shell=True with list-based subprocess, added class_name validation
sealed 9cd9420d91…computed …link to previous ✗ severed - 02code_edithuman_review (0.5)
Fixed path traversal in load_domain_config: added regex validation and resolve() path containment check
sealed a43dd5ad68…computed …link to previous ✗ severed - 03code_edithuman_review (0.5)
Fixed SSRF in download_video: added URL validation blocking private/internal IPs, sanitized filename, added timeout
sealed 4935a8bee9…computed …link to previous ✗ severed - 04code_edithuman_review (0.5)
Fixed overly permissive CORS (configurable via CORS_ORIGINS env var) in __init__.py
sealed ecf74a3a17…computed …link to previous ✗ severed - 05code_edithuman_review (0.5)
Fixed error info leakage: replaced raw str(e) with generic error messages in code_generation.py
sealed 63082aa647…computed …link to previous ✗ severed - 06code_edithuman_review (0.5)
Fixed unsafe f-string JSON and error info leakage in video_rendering.py (3 locations)
sealed 480bdc8b0e…computed …link to previous ✗ severed - 07code_edithuman_review (0.5)
Fixed file_class parameter injection: added isidentifier() validation before subprocess use
sealed 2b78c8a3f7…computed …link to previous ✗ severed
manifest.chain_hash 2b78c8a3f7…
What a seal actually covers
Each action hashes a fixed set of canonical fields: its identity, its gate decision, its timestamp, its parent’s hash, and hashes of the instruction, input, and output — never the content itself. So a receipt stays a few kilobytes and leaks no source code, while any change to the underlying content still breaks the seal. Each action commits to its parent, so altering action three invalidates three and severs every link after it.
Gating before execution, not after
A receipt proves what happened. The gate decides whether it should happen at all. CapSeal learns per-codebase failure rates as Beta posteriors over risk features, then scores each proposed action before it runs. In this run, 7 of 8 actions were held for human review:
| Decision | Score | Risk features |
|---|---|---|
| human_review | 0.5 | simple + single-file + security-sensitive + bugfix + untested |
| human_review | 0.5 | simple + single-file + security-sensitive + bugfix + untested |
| human_review | 0.5 | simple + single-file + security-sensitive + bugfix + untested |
Those risk features are the model’s reasoning made legible: security-sensitive, single-file, untested. A human sees why something was stopped, not just that it was.
Inspecting a receipt from the CLI
Beyond the hash chain
A hash chain proves the log wasn’t edited after the fact. It doesn’t prove the run followed its own rules. For that, CapSeal also emits a transparent integrity proof — no trusted setup, post-quantum assumptions — built from an algebraic intermediate representation over the action trace, vector commitments, FRI folding, and a Merkle commitment, with written binding and soundness bounds.
- AIR
- agent_air_v1
- Constraints
- 25
- Trace rows
- 8
- Verified
- true
That part isn’t demoed live: proving is far too heavy to run in a browser tab, and a verifier for it would be a lot of JavaScript to show something most readers can’t distinguish from the hash chain they just watched break.
Stack
Python, MCP (official SDK), Rust, Semgrep, SHA-256 receipt chains. Runs as an MCP server, so any agent that speaks MCP is gated and sealed without changing how you work.