Capframe
capability tokens for AI agent tool calls
Last verified:
What is Capframe?
Capframe is a capability-security toolkit for AI agents that call tools. It is built around the Model Context Protocol and is designed to help teams discover what an agent can touch, bind that authority with scoped tokens, and enforce runtime policies around every tool call.
The product is organized into three Rust modules: Find, Bind, and Guard. Find maps MCP servers and tool surfaces to expose unconstrained inputs and indirect-injection gaps. Bind mints capability tokens with scopes, limits, TTLs, and revocation. Guard evaluates tool calls against deterministic policy at runtime without an LLM in the decision path.
Capframe also generates compliance artifacts for security reviews and audits. Its reporting is mapped to OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS, and it can export HTML or PDF reports. The site positions it as both a local-first CLI for self-hosted use and, later, a hosted control plane for teams that want shared visibility.
It is aimed at AI engineering teams, security teams, and regulated organizations building or operating tool-using agents. The site specifically calls out MCP-based agents and frameworks such as Claude Desktop, Cursor, Continue, Cline, LangGraph via MCP bridge, and Rust/Python agent frameworks that speak MCP.
Capframe pricing
Pricing model: Freemium
Free: $0, self-hosted, includes all three modules, local-first CLI, full OWASP / NIST / ATLAS report generator, MIT license, sha256-verified installer, and ability to run anywhere. Pro: $199 per month, private early access / waitlist only, includes a hosted dashboard in build, findings history and cross-scan diffing, scheduled scans, Slack alerts, and up to 10 agents. Enterprise: custom pricing, on-prem or VPC deployment, SSO, audit logs, signed compliance reports, SLA, private Slack channel, and unlimited agents.
Capframe pros
- Three-module design
- Local-first CLI
- MCP-native architecture
- Finds indirect-injection gaps
- Maps unconstrained inputs
- Scoped capability tokens
- Revocable tokens
- Holder-of-key token model
- Deterministic runtime enforcement
- No LLM in decision path
- Single-digit-microsecond evaluation
- Audit-ready compliance reports
- OWASP LLM Top 10 mapping
- NIST AI RMF mapping
- MITRE ATLAS mapping
- HTML and PDF exports
- Open-source MIT license
- Runs self-hosted
- sha256-verified installer
- Works across multiple MCP tools
- Supports separate adoption paths for teams
Capframe cons
- Built around MCP only today
- Adapter support still on roadmap
- Hosted dashboard is in build
- Pro plan is private early access
- Hosted control plane is optional but not fully launched
- Enterprise features require direct contact
- No public self-serve Pro signup
- Bind and Guard may be overkill for simple agents
- Best fit is tool-using agents, not general chatbots
- Requires local CLI installation
- Security concepts may be complex for small teams
- Limited value if you do not use MCP
- Compliance depth may need extra internal review
- Some features depend on hosted sync in paid tiers
- Design partner access is limited
Frequently asked questions about Capframe
What does Capframe do?
Capframe is a capability-security toolkit for AI agents that use tools. It helps you discover the agent’s tool surface, assign scoped authority with capability tokens, and enforce allow/deny decisions at runtime with deterministic policy evaluation.
What are the three modules?
The three modules are Find, Bind, and Guard. Find scans MCP servers and tools for exposure and unconstrained inputs, Bind mints scoped and revocable capability tokens, and Guard enforces policy for every tool call without using an LLM in the decision path.
Does Capframe work without a hosted service?
Yes. The site says the CLI is local-first and the Free tier is self-hosted. Hosted control-plane features are positioned as optional paid offerings rather than required for core functionality.
Which protocol does Capframe support today?
Capframe is built around the Model Context Protocol. The site says support today is MCP-native, and adapter support for OpenAI function calling, Anthropic tool use, and LangGraph is on the roadmap.
What kinds of compliance reports does Capframe generate?
Capframe generates audit-ready artifacts mapped to OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS. The site says you can export reports in HTML or PDF and use them as evidence for security and compliance review.
How fast is Guard?
The site describes Guard as a Rust process with single-digit-microsecond evaluation. It also says there is no LLM in the decision path, so allow/deny decisions are deterministic.
What does Bind provide?
Bind mints capability tokens in a macaroon-style, attenuable, revocable model. The tokens can be scoped to specific tools and limits, include holder-of-key binding with ed25519, and produce signed denial receipts for audit evidence.
What does Find look for?
Find walks MCP servers, tool endpoints, and parameters to map what the agent can touch. It surfaces indirect-injection gaps and unconstrained inputs, then writes a structured findings file aligned to the OWASP LLM Top 10.
Who is the hosted Pro plan for?
The Pro plan is for AI teams shipping agents at speed. It includes a hosted dashboard in build, findings history and cross-scan diffing, scheduled scans, Slack alerts, and support for up to 10 agents, but it is currently in private early access.
Who is Enterprise for?
Enterprise is aimed at regulated organizations that want on-prem or VPC deployment, SSO, audit logs, signed compliance reports, an SLA, and a private Slack channel. The site says it is taking a small number of design partners.