omp packages

@capsulesecurity/omp-capsule1.1.0

Capsule extension for OMP - forwards hook events to the Capsule agentsecurity service for centralized policy enforcement and audit.

lidanhazoutcapsule Published 6 hours ago Apache-2.0 ~0 downloads/mo

Built for omp

The author tagged this package omp-extension.

Did it work for you?

Result

One report per person. A new report replaces your old one.

Reports 0

No reports yet.

Readme

@capsulesecurity/omp-capsule

Capsule extension for OMP. Forwards OMP hook events to your Capsule agentsecurity tenant and applies the tool_call block verdict returned by Capsule policy.

Install

omp plugin install @capsulesecurity/omp-capsule

For local development, load the source directly with omp --extension ./plugins/omp-plugin.

Configure

The extension reads ~/.omp/capsule.json:

{
  "endpoint": "https://agents.capsule.security",
  "token": "<jwt-signed-with-tenant-OMP_SECRET>",
  "blockOnRisk": true,
  "failOpen": true,
  "timeoutMs": 5000,
  "allowConversationAccess": false
}

endpoint and token come from the environment when both are set there, otherwise from ~/.omp/capsule.json, and the rest of the settings come from that same source. Environment variables still override the other options. A project-level .omp/capsule.json is never read, so an untrusted repository cannot redirect your prompts and tool calls to its own server or turn enforcement off.

Option Env var Default Description
endpoint CAPSULE_ENDPOINT - Capsule agentsecurity base URL.
token CAPSULE_TOKEN - JWT with tid (tenant) and eid (env external ID) claims.
blockOnRisk CAPSULE_BLOCK_ON_RISK true Apply server block verdicts. Set to false for shadow mode.
failOpen CAPSULE_FAIL_OPEN true Allow the tool to run when Capsule is unreachable.
timeoutMs CAPSULE_TIMEOUT_MS 5000 Per-request timeout in ms.
allowConversationAccess CAPSULE_ALLOW_CONVERSATION_ACCESS false Forward the model context transcript on every LLM call.
user CAPSULE_USER process.env.USER or "unknown" User identifier sent on every event.

Without endpoint and token the extension logs a warning and stays inactive - it never breaks the agent loop.

Hooks

  • Blocking: tool_call. Awaited, bounded by timeoutMs, and the only hook whose verdict is applied.
  • Observation (fire-and-forget): tool_result, tool_execution_start, tool_execution_end, session_start, session_shutdown, agent_start, agent_end, before_agent_start, turn_start, turn_end, user_bash, user_python.
  • Conversation (fire-and-forget, only when allowConversationAccess is on): context.

user_bash fires for ! and !! commands and user_python for $ and $$, both outside the tool loop. OMP does not accept a block verdict there, so those commands are audited but not enforced.

Server contract

The extension POSTs to POST {endpoint}/v1/omp/hooks/events with:

{
  "hook": {
    "hook_event_name": "tool_call",
    "context": {
      "session_id": "...",
      "workspace_dir": "/home/dev/repo",
      "mode": "tui",
      "model": "claude-opus-5"
    },
    "timestamp": "2026-09-22T10:00:00.000Z",
    "toolName": "bash",
    "toolCallId": "...",
    "input": {}
  },
  "user": "user@acme.com",
  "plugin_version": "1.0.0"
}

A tool_call response of { "block": true, "reason": "..." } is returned to OMP unchanged, which stops the tool from running and returns the reason to the model as the tool error. Any other response allows the call.

License

Apache-2.0