Capability Host Protocol · a governed boundary for what agents can do
Govern what your agents can actually do.
Your agent reads files, runs commands, calls tools. CHP puts a governed boundary at the point of action — every capability declared, every invocation allowed or denied against policy, every result captured as replayable, tamper-evident evidence. One command, no application code changes.
For anyone who has to control what their AI can do — and prove what it did — to a security review, an auditor, a regulator, or a customer. New to capability, invocation, evidence?
Start with agents
One command. Every tool call, captured.
# Two commands — no application code changes required
pip install chp-core
chp hooks install # --all-harnesses: + Codex + Gemini CLI
# → Hooks registered for Claude Code
# → Every tool call intercepted: Bash, Read, Edit, Write, WebFetch...
# → Evidence stored to ~/.chp/evidence.sqlite automatically
# Then inspect any session:
chp session list
chp session tree <session_id>
chp session autonomy-report <session_id>
chp session otel <session_id> --endpoint http://localhost:4318- Every tool call — Bash, Read, Edit, Write — captured as a typed evidence event.
- Replay any session by ID; denials are first-class, not swallowed exceptions.
- SHA256 hash-chained and local — the record a security or compliance review can replay and trust.
- Works with Claude Code, Codex, and Gemini CLI — and any Python host.
Provable today: local, tamper-evident replay. Hosted retention, role-based access, and compliance export are what we build with design partners.
How agent governance works →Inspect a real session
Evidence you can open — not just claims.
Every invocation, including a denial, is a hash-chained event you can inspect and replay. Open the denial to see its reason code; tamper a block and watch the chain break.
chp session tree · replayable
correlation_id=session-4a2f
agent://planning-assistant invoked schedule_technician — denied, granted, then completed. Click an event to inspect it.
The invocation was blocked at the boundary before anything ran.
denial.code = policy_blocked
service:dispatch entitlement is required
retryable = false · a first-class outcome, not an exception
- capability
- schedule_technician:1.0.0
- gate
- policy
evidence chain · tamper-evident
each block hashes the one before it — chain verifies ✓
tip: click a block to alter it
Applications
What people use it for.
The same evidence contract covers all of these — a human approval and an agent's action are the same kind of governed, provable event. Agents are where it is easiest to start.
See what an AI agent did
LiveCapture every tool call as replayable, tamper-evident evidence, and unblock the security review.
See how it works →Put a human approval in the record
LiveMake a sign-off, consent, or authorization a first-class, provable event — not a side note.
See how it works →Prove why an automated decision happened
LiveShow the reason a claim, credit, or eligibility decision went the way it did.
See how it works →Replay a process across hosts and orgs
LiveReconstruct work that crossed machines, teams, and partners as one correlated trace.
See how it works →Gate a high-risk action at the boundary
LiveDeny an action when policy, entitlement, or a safety check fails — recorded, not swallowed.
See how it works →Expose a product capability safely
LiveTurn an API or service into a governed, discoverable, provable boundary.
See how it works →The proof, end to end
From one action to a record you can defend.
The same four steps, whoever acts — scroll through them.
01
An action crosses the boundary.
A person, an agent, or a product invokes a capability. The moment it goes from intent to effect is the capability boundary — the one place to govern and prove what happens.
intent → effect
02
It emits a structured event.
The crossing produces a typed evidence event — outcome, subject, correlation — every time, by contract. Not a log someone remembered to write.
{
"event_type": "execution_completed",
"capability_id": "schedule_technician",
"correlation": { "id": "session-abc" },
"outcome": "success",
"subject": "agent://planner",
"hash": "9c7e…",
"redacted": true
}03
Events hash-chain.
Each event hashes the one before it. Alter one and every link after it breaks — tamper-evidence you can verify. Try it.
evidence chain · tamper-evident
each block hashes the one before it — chain verifies ✓
tip: click a block to alter it
04
The whole session replays.
One correlation id reconstructs the causal sequence across tools, agents, and hosts — in order, on demand. Denials and approvals included.
correlation: session-abc
one id · the actual ordered sequence, replayed
intent → effect
{
"event_type": "execution_completed",
"capability_id": "schedule_technician",
"correlation": { "id": "session-abc" },
"outcome": "success",
"subject": "agent://planner",
"hash": "9c7e…",
"redacted": true
}evidence chain · tamper-evident
each block hashes the one before it — chain verifies ✓
tip: click a block to alter it
correlation: session-abc
one id · the actual ordered sequence, replayed
By industry
Where governance matters most.
Software is live today. The same primitives — declared authority, governed invocation, tamper-evident evidence — carry into every regulated domain, and we build each vertical with design partners.
AI-native software
LiveProve what your agent did and unblock the security review.
See it →Insurance
Design partnersA provable record of why an automated claim decision went the way it did.
Build it with us →Legal
Design partnersChain of custody for AI-assisted review; privilege as governed decisions.
Build it with us →Healthcare
Design partnersAI acts, a clinician signs off, both land in one replayable trace.
Build it with us →Manufacturing
Design partnersHuman and agent commands governed by approval and safety invariants.
Build it with us →Financial services
Design partnersApprovals and model-risk checks captured as a replayable evidence bundle.
Build it with us →Why it is different
Evidence, not telemetry. A protocol, not a feature.
Tool protocols govern what an agent can call. Observability watches machines. CHP treats a human approval, an agent action, and a product call as the same governed, provable event — so you can prove an entire process end to end.
Tool protocols
MCP, tool-calling
Observability
traces, spans
CHP
evidence
Answers
Tool protocols
What can the agent call?
Observability
Is the system healthy?
CHP
What happened — and can I prove it?
Record
Tool protocols
Tool calls, if logged
Observability
Sampled traces, mutable
CHP
Mandatory, tamper-evident evidence
Denials
Tool protocols
Protocol errors
Observability
A failed span
CHP
First-class outcomes, with reason
Spans
Tool protocols
One agent, one app
Observability
One system
CHP
People, agents, products — one trace
Products
Built on the protocol.
Products are materialized capability systems — they provision governed capabilities rather than reimplementing them.
Go deeper
How it works
The mechanics — capability, contract, guarantees, evidence.
Read →Writing
Essays on evidence, the capability boundary, and each vertical.
Read →Protocol surface
The formal contract: descriptors, invocation, lifecycle, replay.
Read →Documentation
Concepts, quickstarts, the spec, schemas, and the registry.
Read →Build against the open protocol.
Spec, schemas, reference host, examples, and conformance suite are public.