{
  "markdown": "# Capability Host Protocol\n\n[![PyPI](https://img.shields.io/pypi/v/chp-core?label=chp-core)](https://pypi.org/project/chp-core/)\n[![Python](https://img.shields.io/pypi/pyversions/chp-core)](https://pypi.org/project/chp-core/)\n[![npm](https://img.shields.io/npm/v/@capabilityhostprotocol/sdk?label=%40capabilityhostprotocol%2Fsdk)](https://www.npmjs.com/package/@capabilityhostprotocol/sdk)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)\n[![Docs](https://img.shields.io/badge/docs-capabilityhostprotocol.com-informational)](https://docs.capabilityhostprotocol.com)\n\nCHP is the open protocol for declaring, **governing**, and **proving** what agents, tools, and systems do — the single signed plane where a human approval, an agent's action, and a system call become the same governed, tamper-evident, replayable event.\n\nThe hook is simple:\n\n> See what your agents and tools actually did — and what governed it.\n\n## Try it in two minutes\n\nYour coding agent reads files, runs commands, calls tools. This puts a governed boundary at the point of action — no application code changes:\n\n```bash\npip install chp-core\nchp hooks install                        # hooks Claude Code\nchp hooks install --all-harnesses        # ...or Claude Code + Codex + Gemini CLI\n```\n\nUse your agent normally, then look at what it did:\n\n```bash\nchp session list\nchp session tree <session_id>\n```\n\nEvery tool call is a typed evidence event, hash-chained and stored locally in `~/.chp/evidence.sqlite`. A denial is a first-class event with a reason code — not a swallowed exception — and the chain is tamper-evident, so someone who did not run the agent can still tell whether the record is intact.\n\nPrefer to drive the protocol directly? `chp serve-demo` starts a governed host and prints a copy-pasteable first invocation.\n\n**Full guide:** [`docs/quickstart.md`](docs/quickstart.md) · **why it exists:** [`docs/why-chp.md`](docs/why-chp.md) · **docs site:** [docs.capabilityhostprotocol.com](https://docs.capabilityhostprotocol.com)\n\n## What you get back\n\nReplay is by correlation ID, and the record answers more than \"what happened\" — from [`examples/agent-operations-demo/`](examples/agent-operations-demo/):\n\n```json\n[\n  {\"sequence\": 1,  \"event_type\": \"execution_started\",   \"capability_id\": \"trace_execution\", \"outcome\": null},\n  {\"sequence\": 3,  \"event_type\": \"execution_completed\", \"capability_id\": \"trace_execution\", \"outcome\": \"success\"},\n  {\"sequence\": 7,  \"event_type\": \"execution_started\",   \"capability_id\": \"tool.add\",        \"outcome\": null},\n  {\"sequence\": 12, \"event_type\": \"execution_started\",   \"capability_id\": \"tool.multiply\",   \"outcome\": null},\n  {\"sequence\": 13, \"event_type\": \"execution_completed\", \"capability_id\": \"tool.multiply\",   \"outcome\": \"success\"}\n]\n```\n\nYou can also ask what a policy *would* have done to a run that already happened:\n\n```json\n{\n  \"invariant\": {\"id\": \"deny_multiply_tool\", \"kind\": \"capability_id_matches\"},\n  \"would_have_denied\": true,\n  \"violating_events\": [{\"capability_id\": \"tool.multiply\", \"event_type\": \"execution_started\"}]\n}\n```\n\n## Why a protocol, not a library\n\nCHP is not another agent framework, tool protocol, or workflow engine. It is the **governed evidence plane** at the capability boundary: what ran *and* what governed it (policy, risk tier, safety checks, human approval, autonomy budgets, denial) emit onto one signed, correlated record. Observability tools split execution across separate, optional, unsigned signals and carry no governance; CHP unifies both and proves them.\n\n**Status:** CHP is a pre-1.0 **release candidate (v0.9.3)** — a frozen, additive wire surface backed by two independent implementations (Python + TypeScript) that pass conformance. `chp-core` ships on PyPI.\n\n## What CHP Defines\n\n- Capability descriptors\n- Host descriptors\n- Invocation envelopes\n- Correlation context\n- Structured execution evidence\n- Outcome, error, and denial semantics\n- Replay queries and results\n- Replay by correlation ID\n- Minimal conformance requirements\n\n## Install\n\n```bash\npip install chp-core                 # zero runtime dependencies\npip install 'chp-core[schema]'       # enforce declared input_schema\npip install 'chp-core[signing]'      # ed25519 — signed hosts, bundles, mandates\nnpm install @capabilityhostprotocol/sdk   # TypeScript client + verifier (alpha)\n```\n\n`chp host verify` smoke-tests the install in under a second and reports whether input-schema validation is enforced.\n\nFrom this checkout: `python -m pip install -e packages/python`.\n\n## Minimal Capability\n\n```python\nfrom chp_core import LocalCapabilityHost, capability\n\nhost = LocalCapabilityHost(\"example-host\")\n\n@capability(\n    id=\"math.add\",\n    version=\"1.0.0\",\n    description=\"Add two numbers.\",\n)\ndef add(a: int, b: int):\n    return {\"sum\": a + b}\n\nhost.register(add)\n\nresult = host.invoke(\n    \"math.add\",\n    {\"a\": 2, \"b\": 3},\n    correlation_id=\"demo-correlation\",\n)\n\nprint(result.outcome)       # \"success\"\nprint(result.data)          # {\"sum\": 5}\n\nfor event in host.replay(\"demo-correlation\"):\n    print(event.event_type)  # execution_started, execution_completed\n```\n\nThe host emits `execution_started` and `execution_completed` evidence for the invocation. If execution fails, it emits `execution_failed`. If the host denies invocation, it emits `execution_denied`.\n\n## Repository Map\n\n- `spec/README.md`: **the specification index** — core (v0.1), governance\n  vocabulary, invocation pipeline, HTTP binding, evidence integrity + anchors\n  (v0.2), reserved names, test vectors, changelog, proposal process\n- `schemas/`: JSON Schemas for protocol objects\n- `packages/python/chp_core/`: reference host (Python)\n- `packages/chp-sdk/` + `packages/chp-host-ts/`: the second implementation (TypeScript)\n- `examples/capability-host-endpoint-demo/`: HTTP-served host demo\n- `examples/agent-operations-demo/`: agent/tool observability demo\n- `examples/codex-self-observation-demo/`: Codex dogfooding demo\n- `examples/mcp-bridge-demo/`: experimental MCP-style bridge prototype\n- `conformance/`: conformance runner\n- `docs/quickstart.md`: install, first run, serving, mesh\n- `docs/why-chp.md`: the problem and the thesis\n- `docs/adapter-authoring.md`: writing your own capability adapter\n- `docs/production-runbook.md`: operations, backup/restore, key compromise\n- `docs/comparisons/chp-vs-mcp.md`: precise MCP comparison\n- `docs/comparisons/chp-and-opentelemetry.md`: OpenTelemetry alignment note\n- `docs/comparisons/landscape.md`: adjacent framework comparison\n- `docs/security/threat-model-v0.1.md`: v0.1 threat model\n\n## Production Posture\n\nThe reference implementation is hardened for production operation: WAL\nmulti-writer safety with hot backup (`chp store backup --verify`), SIGTERM\ndrain (in-flight work completes before exit), a fail-loud auth flag\n(`CHP_HOST_REQUIRE_AUTH=1`), scheduled retention, and operator metrics (store\nsize, witness-loop liveness, revocation counts, internal errors). Operations,\nbackup/restore, rolling upgrades, and the key-compromise runbook:\n[docs/production-runbook.md](docs/production-runbook.md). Vulnerability\nreporting: [SECURITY.md](SECURITY.md).\n\n## CHP vs MCP\n\nMCP exposes tools and context to AI applications. CHP governs and evidences execution of capabilities.\n\nThey fit together. MCP can be a source of capability invocation, and CHP adds correlation, replay, evidence, denial semantics, and governance at the execution boundary.\n\nRead more: `docs/comparisons/chp-vs-mcp.md`.\n\n## Contributing\n\nRead [`CONTRIBUTING.md`](CONTRIBUTING.md) first. One thing to know before you open a pull request: **this repository is a generated mirror** of a private development repository. CI rejects pull requests that touch `packages/`, `docs/`, `spec/`, `schemas/`, or `examples/` from a branch that is not `sync/*`, so a code PR against those paths will fail by construction no matter how good it is.\n\nThat is not a brush-off — it is the publishing model, and we would rather say so up front than let you find out from a red check. Issues, spec proposals, comparisons, and discussion are the highest-bandwidth way in today; open an issue and we will route the change through the internal flow with attribution.\n\n## Open Source Boundary\n\nOpen source should include local visibility:\n\n- spec and schemas\n- local host\n- SDK primitives\n- conformance\n- local replay\n- agent observability wrapper\n- experimental MCP bridge prototype\n\nCommercial value can remain around production trust:\n\n- hosted capability graph\n- multi-host trace stitching\n- retention\n- team workspaces\n- advanced explanation\n- invariant libraries\n- assurance derivation\n- compliance exports\n- enterprise identity and RBAC\n\nGuiding rule:\n\n> Local visibility should be free. Production trust should be paid.\n\n## License\n\nCHP is dual-licensed by asset:\n\n- **Code** (`packages/`, `conformance/`, `examples/`, `scripts/`): Apache License 2.0 — see [`LICENSE`](LICENSE).\n- **Specification, schemas & docs** (`spec/`, `schemas/`, `docs/`): Creative Commons Attribution 4.0 (CC BY 4.0) — see [`LICENSE-DOCS`](LICENSE-DOCS). Implementing the specification is additionally covered by a royalty-free patent grant — see [`PATENTS`](PATENTS).\n- **Trademarks**: \"CHP\" and \"CHP-Certified\" — see [`TRADEMARK.md`](TRADEMARK.md).\n\nContributions are accepted under the [Contributor License Agreement](CLA.md); see [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\nCopyright © 2026 Project Auxo, Inc. See [`NOTICE`](NOTICE).\n",
  "bytes": 9454,
  "sha": "98f770fa465344865b20c33f2417fab52b8326749080d69d739974af6a1918d8",
  "repo_slug": "capabilityhostprotocol/chp-core",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_capabilityhostprotocol_chp_d4443460/readme"
}