Agent Shield beta · wrap Claude Code, Cursor and your MCP servers in a runtime contract →

[ The capability firewall for npm ]

Your dependencies run with root. Take it back.

Android-style runtime permissions for node_modules. Every package you install can read process.env, spawn processes and open sockets, the exact powers behind every npm supply-chain attack to date. Capwall makes those powers explicit and blocks every one you didn't grant.

[ Scan your repo free ]$ npx @extodan/capwall init

Apache-2.0 · Node ≥ 20.6 · Fail-closed by default

Built on peer-reviewed research

Mir · RWXi membranes · CCS 2021Defensive Capability Analysis · 72.9% of npm needs zero caps · ASE 2026NodeShield & GHunter · import locks · gadget isolation · CCS 2025in-toto · signed attestations · USENIX 2019Runtime Contracts & DIFC · taint lattices · MCP-ITP · 2025–26

or try: · ·

[ The problem ]

Ambient authority is the bug. Scanners can't see it.

01

A string-padding utility can read your Stripe key.

Every package eight levels deep inherits your app's full permissions: env vars, filesystem, network and shell.

02

Hijacked releases arrive signed and clean.

When a maintainer token is stolen, the malicious version is an official release with no CVE. Static scanners have nothing to flag.

03

Agents follow instructions they shouldn't.

Coding agents install packages, run scripts and obey text hidden in issues, READMEs and MCP tool descriptions.

[ How it works ]

One file decides what every package can touch.

capabilities.lock sits on exactly one hop: between their packages and your secrets, processes and network. Your own code is never restricted.

  1. 01

    Scan

    AST-scans node_modules, a registry tarball or a GitHub repo, with zero install, and writes what each package reaches for.

    $ npx @extodan/capwall init → wrote capabilities.lock
  2. 02

    Revoke

    Deny what you don't trust, allow what you do. The lockfile is plain text, so every change shows up in review.

    $ capwall deny some-package child_process $ capwall allow stripe env.read:STRIPE_SECRET_KEY → net.connect:api.stripe.com:443 scoped
  3. 03

    Enforce

    Loader hooks, module patches and guarded globals. A package stepping outside its grant stops the process cold.

    $ capwall run -- node app.js ERR_CAPWALL_CAPABILITY_DENIED
12 CAPABILITIESRWXi + scoped predicateseverything a package can do to hurt you
env.readimport.guardenv.writechild_processnet.connectnet.listenhttp.requestdns.resolvefs.readfs.writedynamic-codeworker_threads
AUDIT ➔ ENFORCE ROLLOUTStart in audit or learn mode in staging/prod with zero disruption · every undeclared call is logged and diffed. Flip to enforce to block unauthorized syscalls and .env reads in < 0.05ms before a single byte leaves the process.
HONEST BOUNDARIESIn-process V8 hooks neutralize pure-JS supply-chain hijacks, lateral imports (NodeShield) and prototype pollution gadgets (GHunter). Native .node addons (dlopen) are gated by default, and capwall wrap adds OS-level process isolation for agents and lifecycle scripts.

[ Agent Shield · beta ]

Agent safety is a runtime contract, not a prompt.

A system prompt is a suggestion. Capwall sits between your agent and every tool it calls, and tracks what the session has touched, so one poisoned issue can't turn your agent against you.

01
Taint tracking + FIDES handles. Read a secret and the session can't reach outside sinks; high-risk values are hidden behind labeled handles instead of flooding context. Read untrusted input and destructive tools need approval.
02
MCP-ITP tool-poisoning scanner. Flags hidden instructions in MCP tool descriptions and SKILL.md files before they reach the model · and capwall mcp lock pins each schema digest against rug-pull mutations.
03
Evidence gate. No push, merge or migration until a real test run passes after the last file change.
$ npx @extodan/capwall wrap -- claude$ npx @extodan/capwall mcp scan ./mcp.json
[ Explore Agent Shield ]
capwall / capability-diffBlocked · new permissions requested

Bumping axios 1.14.0 → 1.14.1 adds transitive package plain-crypto-js@4.2.1, which requests:

+ r process.env.*new
+ x net.connect(*)new
+ x child_process.execnew
Checked by capwall · free for open sourceAdd it to your repo →

[ PR bot · free for open source ]

Review permissions, not just code.

Capability diff on every PR. Renovate, Dependabot or an agent bumps a package? You see exactly what new power it asks for. Free for public repos and up to 3 private ones.

Merge gates on Team. Turn the comment into a required check that only a signed security-owner approval can clear.

Fleet-wide quarantine. A worm breaks out at 2 a.m. Push a signed policy to every node in seconds, without a redeploy.

[ Install the GitHub app · free ]

[ Free scanner · no signup ]

How many packages can read your secrets right now?

Example result1,048 packages
312packages can read process.env
env access312
network88
shell41

Illustrative numbers. Your report shows the real counts and every package by name.

[ Pricing ]

Free on your laptop. Paid when your team needs a control plane.

Free
$0forever
· CLI & V8 runtime enforcer, all 12 RWXi capabilities + GHunter gadget guards· Local capwall wrap & capwall mcp scan for Claude Code, Cursor & MCP servers· in-toto + DSSE local attestations & CycloneDX Security-Enhanced SBOM export· PR capability-diff bot: unlimited public repos + 3 private repos (50 PR checks/mo)
[ Install the GitHub app ]
TeamPopular
$39per active developer / month
· Everything in Free + Unlimited private repos & PR checks· Blocking PR merge gates + signed security-owner approval· Org-wide MCP schema pinning & Agent Evidential Contract PR checks· Cloud dashboard with interactive dependency capability graph· Live audit/enforce telemetry alerts (Slack, PagerDuty, Webhooks)· 1-Click remote policy hot-patch across up to 25 production nodes (zero redeploy)
[ Start free trial ]
Enterprise & compliance
$2k+per month
· Everything in Team· Signed in-toto SBOM & Runtime BOM (RBOM) retention + zkSBOM proofs· Automated SOC 2, ISO 27001 & PCI DSS 4.0 (Req. 6.4.3 / 11.6.1) evidence packs· Immutable Base L2 cryptographic timestamp registry & HSM key custody· Unlimited nodes, Kubernetes admission controller & SAML SSO
[ Talk to us ]
Compare all features →

[ Open challenge ]

Break the wall.

We put a funded wallet key behind Capwall. Ship a malicious dependency that gets the key out, and the wallet is yours. Bounty: $500 USDC (Verified On-Chain).

[ Take the challenge ][ Read the rules ]