Chp MCP server

Capability Host Protocol

CHP is the open protocol for declaring, governing, and proving what agents, tools, and systems do — the single signed plane where a human approval, an agent's action, and a system call become the same governed, tamper-evident, replayable event.

The hook is simple:

See what your agents and tools actually did — and what governed it.

Try it in two minutes

Your coding agent reads files, runs commands, calls tools. This puts a governed boundary at the point of action — no application code changes:

pip install chp-core
chp hooks install                        # hooks Claude Code
chp hooks install --all-harnesses        # ...or Claude Code + Codex + Gemini CLI

Use your agent normally, then look at what it did:

chp session list
chp session tree <session_id>

Every tool call is a typed evidence event, hash-chained and stored locally in ~/.chp/evidence.sqlite. A denial is a first-class event with a reason code — not a swallowed exception — and the chain is tamper-evident, so someone who did not run the agent can still tell whether the record is intact.

Prefer to drive the protocol directly? chp serve-demo starts a governed host and prints a copy-pasteable first invocation.

Full guide: docs/quickstart.md · why it exists: docs/why-chp.md · docs site: docs.capabilityhostprotocol.com

What you get back

Replay is by correlation ID, and the record answers more than "what happened" — from examples/agent-operations-demo/:

[
  {"sequence": 1,  "event_type": "execution_started",   "capability_id": "trace_execution", "outcome": null},
  {"sequence": 3,  "event_type": "execution_completed", "capability_id": "trace_execution", "outcome": "success"},
  {"sequence": 7,  "event_type": "execution_started",   "capability_id": "tool.add",        "outcome": null},
  {"sequence": 12, "event_type": "execution_started",   "capability_id": "tool.multiply",   "outcome": null},
  {"sequence": 13, "event_type": "execution_completed", "capability_id": "tool.multiply",   "outcome": "success"}
]

You can also ask what a policy would have done to a run that already happened:

{
  "invariant": {"id": "deny_multiply_tool", "kind": "capability_id_matches"},
  "would_have_denied": true,
  "violating_events": [{"capability_id": "tool.multiply", "event_type": "execution_started"}]
}

Why a protocol, not a library

CHP is not another agent framework, tool protocol, or workflow engine. It is the governed evidence plane at the capability boundary: what ran and what governed it (policy, risk tier, safety checks, human approval, autonomy budgets, denial) emit onto one signed, correlated record. Observability tools split execution across separate, optional, unsigned signals and carry no governance; CHP unifies both and proves them.

Status: CHP is a pre-1.0 release candidate (v0.9.3) — a frozen, additive wire surface backed by two independent implementations (Python + TypeScript) that pass conformance. chp-core ships on PyPI.

What CHP Defines

Shortened. The full README is on GitHub.