Capability Host Protocol
CHP is the open protocol for declaring, governing, and proving what agents, tools, and systems do — the single signed plane where a human approval, an agent's action, and a system call become the same governed, tamper-evident, replayable event.
The hook is simple:
See what your agents and tools actually did — and what governed it.
Try it in two minutes
Your coding agent reads files, runs commands, calls tools. This puts a governed boundary at the point of action — no application code changes:
pip install chp-core
chp hooks install
chp hooks install --all-harnesses
Use your agent normally, then look at what it did:
chp session list
chp session tree <session_id>
Every tool call is a typed evidence event, hash-chained and stored locally in ~/.chp/evidence.sqlite. A denial is a first-class event with a reason code — not a swallowed exception — and the chain is tamper-evident, so someone who did not run the agent can still tell whether the record is intact.
Prefer to drive the protocol directly? chp serve-demo starts a governed host and prints a copy-pasteable first invocation.
Full guide: docs/quickstart.md · why it exists: docs/why-chp.md · docs site: docs.capabilityhostprotocol.com
What you get back
Replay is by correlation ID, and the record answers more than "what happened" — from examples/agent-operations-demo/:
[
{"sequence": 1, "event_type": "execution_started", "capability_id": "trace_execution", "outcome": null},
{"sequence": 3, "event_type": "execution_completed", "capability_id": "trace_execution", "outcome": "success"},
{"sequence": 7, "event_type": "execution_started", "capability_id": "tool.add", "outcome": null},
{"sequence": 12, "event_type": "execution_started", "capability_id": "tool.multiply", "outcome": null},
{"sequence": 13, "event_type": "execution_completed", "capability_id": "tool.multiply", "outcome": "success"}
]
You can also ask what a policy would have done to a run that already happened:
{
"invariant": {"id": "deny_multiply_tool", "kind": "capability_id_matches"},
"would_have_denied": true,
"violating_events": [{"capability_id": "tool.multiply", "event_type": "execution_started"}]
}
Why a protocol, not a library
CHP is not another agent framework, tool protocol, or workflow engine. It is the governed evidence plane at the capability boundary: what ran and what governed it (policy, risk tier, safety checks, human approval, autonomy budgets, denial) emit onto one signed, correlated record. Observability tools split execution across separate, optional, unsigned signals and carry no governance; CHP unifies both and proves them.
Status: CHP is a pre-1.0 release candidate (v0.9.3) — a frozen, additive wire surface backed by two independent implementations (Python + TypeScript) that pass conformance. chp-core ships on PyPI.
What CHP Defines
- Capability descriptors
- Host descriptors
- Invocation envelopes
- Correlation context
- Structured execution evidence
- Outcome, error, and denial semantics
- Replay queries and results
- Replay by correlation ID
- Minimal conformance requirements
Install
pip install chp-core
pip install 'chp-core[schema]'
pip install 'chp-core[signing]'
npm install @capabilityhostprotocol/sdk
chp host verify smoke-tests the install in under a second and reports whether input-schema validation is enforced.
From this checkout: python -m pip install -e packages/python.
Minimal Capability
from chp_core import LocalCapabilityHost, capability
host = LocalCapabilityHost("example-host")
@capability(
id="math.add",
version="1.0.0",
description="Add two numbers.",
)
def add(a: int, b: int):
return {"sum": a + b}
host.register(add)
result = host.invoke(
"math.add",
{"a": 2, "b": 3},
correlation_id="demo-correlation",
)
print(result.outcome)
print(result.data)
for event in host.replay("demo-correlation"):
print(event.event_type)
The host emits execution_started and execution_completed evidence for the invocation. If execution fails, it emits execution_failed. If the host denies invocation, it emits execution_denied.
Repository Map
spec/README.md: the specification index — core (v0.1), governance
vocabulary, invocation pipeline, HTTP binding, evidence integrity + anchors
(v0.2), reserved names, test vectors, changelog, proposal processschemas/: JSON Schemas for protocol objectspackages/python/chp_core/: reference host (Python)packages/chp-sdk/ + packages/chp-host-ts/: the second implementation (TypeScript)examples/capability-host-endpoint-demo/: HTTP-served host demoexamples/agent-operations-demo/: agent/tool observability demoexamples/codex-self-observation-demo/: Codex dogfooding demoexamples/mcp-bridge-demo/: experimental MCP-style bridge prototypeconformance/: conformance runnerdocs/quickstart.md: install, first run, serving, meshdocs/why-chp.md: the problem and the thesisdocs/adapter-authoring.md: writing your own capability adapterdocs/production-runbook.md: operations, backup/restore, key compromisedocs/comparisons/chp-vs-mcp.md: precise MCP comparisondocs/comparisons/chp-and-opentelemetry.md: OpenTelemetry alignment notedocs/comparisons/landscape.md: adjacent framework comparisondocs/security/threat-model-v0.1.md: v0.1 threat model
Production Posture
The reference implementation is hardened for production operation: WAL
multi-writer safety with hot backup (chp store backup --verify), SIGTERM
drain (in-flight work completes before exit), a fail-loud auth flag
(CHP_HOST_REQUIRE_AUTH=1), scheduled retention, and operator metrics (store
size, witness-loop liveness, revocation counts, internal errors). Operations,
backup/restore, rolling upgrades, and the key-compromise runbook:
docs/production-runbook.md. Vulnerability
reporting: SECURITY.md.
CHP vs MCP
MCP exposes tools and context to AI applications. CHP governs and evidences execution of capabilities.
They fit together. MCP can be a source of capability invocation, and CHP adds correlation, replay, evidence, denial semantics, and governance at the execution boundary.
Read more: docs/comparisons/chp-vs-mcp.md.
Contributing
Read CONTRIBUTING.md first. One thing to know before you open a pull request: this repository is a generated mirror of a private development repository. CI rejects pull requests that touch packages/, docs/, spec/, schemas/, or examples/ from a branch that is not sync/*, so a code PR against those paths will fail by construction no matter how good it is.
That is not a brush-off — it is the publishing model, and we would rather say so up front than let you find out from a red check. Issues, spec proposals, comparisons, and discussion are the highest-bandwidth way in today; open an issue and we will route the change through the internal flow with attribution.
Open Source Boundary
Open source should include local visibility:
- spec and schemas
- local host
- SDK primitives
- conformance
- local replay
- agent observability wrapper
- experimental MCP bridge prototype
Commercial value can remain around production trust:
- hosted capability graph
- multi-host trace stitching
- retention
- team workspaces
- advanced explanation
- invariant libraries
- assurance derivation
- compliance exports
- enterprise identity and RBAC
Guiding rule:
Local visibility should be free. Production trust should be paid.
License
CHP is dual-licensed by asset:
- Code (
packages/, conformance/, examples/, scripts/): Apache License 2.0 — see LICENSE.
- Specification, schemas & docs (
spec/, schemas/, docs/): Creative Commons Attribution 4.0 (CC BY 4.0) — see LICENSE-DOCS. Implementing the specification is additionally covered by a royalty-free patent grant — see PATENTS.
- Trademarks: "CHP" and "CHP-Certified" — see
TRADEMARK.md.
Contributions are accepted under the Contributor License Agreement; see CONTRIBUTING.md.
Copyright © 2026 Project Auxo, Inc. See NOTICE.