dsh-capsule

README describes a clear Thin Adapter + Trusted Core architecture with a Python runtime, TypeScript adapter, CLI, SDK, and security test framework, but no CI, test coverage, or install command is visible.

Explicit deny-by-default Docker baseline (read-only, network none, cap-drop ALL, non-root, no host mounts) plus short-lived session-bound Capability Leases and zero-secret credential resolution indicate strong security design, though it is self-described as not VM-level isolation.

Addresses a real and growing pain point of safely running untrusted third-party agent tool plugins with scoped, revocable permissions rather than handing over long-lived credentials.

Last updated 2026-09-03 with 19 stars and an active roadmap, but the README admits the DSH Adapter tool-registration chain is still being wired up, so it is a developer preview rather than production-ready.

README is thorough on architecture, security model, and lease semantics with diagrams, but lacks an install command and concrete usage examples, and the excerpt cuts off mid-sentence.