Give your AI agents the minimum permission they need. No more, no less.
git clone https://github.com/iamGodofall/capkit.git cd capkit npm install npm run demo # See it work!
Current AI agents have root access to your systems. One prompt injection = disaster.
CapKit issues cryptographically signed, time-bound capabilities:
- β
Scoped:
postto/twitter, not delete - β Time-bound: Expires in 10min
- β Signed: HMAC-SHA256 verification
- β Auditable: Every action logged
- β Zero deps: Sovereign-first (Node crypto only)
Threat Model:
1. Agent prompt injection β Capability stays scoped
2. Key compromise β Time-bound limits damage
3. Network failure β Works offline
4. Malicious actor β HMAC prevents tampering
npm install capkit
import { issueCapability, verifyCapability, checkPolicy } from 'capkit'; // Issue scoped permission const cap = issueCapability({ action: 'post', resource: '/twitter', key: 'your-secret-key', expiresIn: '10m' }); // Agent uses capability if (verifyCapability({ capability: cap, key: 'your-secret-key' }).valid) { console.log('β Agent authorized'); }
Part of the Agent Builder Suite
β capkit: Scoped capabilities for agents
β quickbench: Reproducible agent evaluation
β edge-run: Offline-first orchestration (coming soon)
β connector-starter: Generate adapters fast (coming soon)
Built for builders who ship. MIT licensed. Local-first by design.
MIT