dev-capsem

name	dev-capsem
description	Capsem project overview and navigation: what it is, how the crates fit, which skill owns what. Start here when orienting on any task.

Capsem

Capsem sandboxes AI agents in air-gapped Linux VMs on macOS using Apple's Virtualization.framework (with KVM for Linux). Runs as a daemon service (like Docker). Built with Rust and Astro.

Crate map

Crate	What	Key modules
capsem-core	Shared library. All business logic lives here.	vm/ (machine, profile, vsock, serial), net/ (network intercept, CA, SSE/model parsing), security_engine/ (CEL rules, plugins, decisions), mcp/ (gateway, tools), hypervisor/ (Apple VZ, KVM), image.rs (ImageRegistry, fork/clone)
capsem-service	Daemon service. Axum HTTP over UDS, VM lifecycle.	main.rs (routes, IPC), api.rs (request/response types)
capsem-process	Per-VM process. Boots VM, bridges vsock, job store.	main.rs (vsock setup, IPC handler)
capsem	CLI client. HTTP over UDS to service.	main.rs (create, resume, shell, list, exec, run, stop, delete, persist, purge, info, logs, restart, version, doctor, fork, image)
capsem-mcp	MCP server for AI agents. Stdio, bridges to service.	main.rs (rmcp handler, UDS client)