{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"OMP Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"omp-integration","__idx":0},"children":["OMP Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connect OMP (Oh My Pi) to Capsule Security for complete visibility into AI coding agent activity, including tool execution, sessions, prompts, agent replies and user-run shell and Python - with inline blocking on policy-violating tool calls."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This integration uses ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://omp.sh/docs/extension-authoring"},"children":["OMP's extension system"]}," to capture and govern AI coding agent activity. The Capsule extension ships as an OMP plugin, runs in-process inside OMP, forwards every hook event to your Capsule tenant over HTTPS, and applies policy verdicts to tool calls before they execute."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following hooks are configured:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Hook Event"},"children":["Hook Event"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tool_call"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Blocking"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool execution requests - can block the call and return the policy reason to the model"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tool_result"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool output after execution"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tool_execution_start"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool execution began"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tool_execution_end"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool execution finished"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["session_start"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Session initialization"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["session_shutdown"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Session termination and cleanup"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["agent_start"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Low-level agent run started"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["agent_end"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Low-level agent run finished"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["before_agent_start"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The prompt the developer submitted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["turn_start"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An LLM response and tool-call cycle began"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["turn_end"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An LLM response and tool-call cycle finished, including the agent reply"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["user_bash"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Commands run with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["!"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["!!"]}," outside the tool loop"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["user_python"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Python run with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$$"]}," outside the tool loop"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["context"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Full model context, only when ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allowConversationAccess"]}," is enabled"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_bash"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_python"]}," run outside OMP's tool loop and do not accept a verdict, so those commands are audited but not enforced."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OMP"]}," installed"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," account with admin access"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Network access from your developer machines to your Capsule agentsecurity endpoint (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://agents.capsule.security"]},")"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-generate-an-extension-token","__idx":3},"children":["Step 1: Generate an Extension Token"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," and locate ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OMP"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Install"]}," - Capsule generates a JWT scoped to your tenant and OMP environment. The token contains the tenant and environment claims required by the agentsecurity endpoint; treat it as a secret."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Copy the generated token. You will reference it from your Capsule extension configuration in Step 3."]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-install-the-plugin","__idx":4},"children":["Step 2: Install the Plugin"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Install the Capsule extension from npm as an OMP plugin:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"omp plugin install @capsulesecurity/omp-capsule\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To pin a version, use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["omp plugin install @capsulesecurity/omp-capsule@1.1.0"]},". Run ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["omp plugin list"]}," to confirm it is installed."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-configure-the-extension","__idx":5},"children":["Step 3: Configure the Extension"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Capsule extension reads its settings from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.omp/capsule.json"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"endpoint\": \"https://agents.capsule.security\",\n  \"token\": \"<token-from-step-1>\",\n  \"blockOnRisk\": true,\n  \"failOpen\": true,\n  \"timeoutMs\": 5000,\n  \"allowConversationAccess\": false\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuration-options","__idx":6},"children":["Configuration Options"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every option can also be supplied as an environment variable."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["endpoint"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}," come from the environment when both are set there, otherwise from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.omp/capsule.json"]},", and"," ","the remaining settings come from that same source. Environment variables still override the other options. A"," ","project-level ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".omp/capsule.json"]}," is never read, so cloning an untrusted repository cannot redirect your prompts and"," ","tool calls to someone else's server or turn enforcement off."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Option"},"children":["Option"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Env var"},"children":["Env var"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Default"},"children":["Default"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["endpoint"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_ENDPOINT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"em","attributes":{},"children":["(required)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Capsule agentsecurity endpoint, e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://agents.capsule.security"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_TOKEN"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"em","attributes":{},"children":["(required)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JWT generated in Step 1, scoped to your tenant and environment"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["blockOnRisk"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_BLOCK_ON_RISK"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["boolean"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Apply server ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["block"]}," decisions inline. Set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}," to run in observe-only mode"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failOpen"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_FAIL_OPEN"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["boolean"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When Capsule is unreachable or returns an error, allow the tool to run. Set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}," to fail closed"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["timeoutMs"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_TIMEOUT_MS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["number"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["5000"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Per-request timeout in milliseconds"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allowConversationAccess"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_ALLOW_CONVERSATION_ACCESS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["boolean"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},", forward the model context transcript to Capsule. Required for full conversation observability and policies that rely on conversation context"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_USER"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["process.env.USER"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User identifier sent on every event"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["endpoint"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}," the extension logs a warning and stays inactive. It never breaks the agent loop."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"token-storage","__idx":7},"children":["Token Storage"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Never commit the JWT to version control. Recommended approaches:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep the token in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.omp/capsule.json"]}," outside any repository"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_TOKEN"]}," from your secret manager (1Password, AWS Secrets Manager, HashiCorp Vault) at shell startup"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For MDM-managed deployments, deliver it through the same channel that distributes the OMP configuration"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-restart-omp","__idx":8},"children":["Step 4: Restart OMP"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OMP does not rebuild extension modules in place, so ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/reload-plugins"]}," is not enough. Exit any running OMP sessions and start OMP again to load the extension."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5-verify-the-installation","__idx":9},"children":["Step 5: Verify the Installation"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Start a new OMP session and execute a simple task to generate activity:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Create a new file called test.txt with the content \"Hello World\"\n"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory > Agents"]}," and confirm your OMP agent appears. OMP has no persistent agent identifier, so an agent is identified by the working directory and the user running it."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click on the agent and review the audit logs to verify events are captured:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Session start event"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Tool execution (write tool)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The prompt you submitted and the agent reply"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Session activity"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To view the full conversation, navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Observability"]}," and filter by ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Activity Type - Session"]}," (requires ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allowConversationAccess: true"]},")"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"troubleshooting","__idx":10},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If events are not appearing:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify the endpoint is reachable"]}," from the host running OMP:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl -sS -o /dev/null -w \"%{http_code}\\n\" https://agents.capsule.security/health\n","lang":"bash"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify the configuration is found"]}," - the extension logs a warning on startup and stays inactive when ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["endpoint"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}," is missing. Check that ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["~/.omp/capsule.json"]}," is valid JSON."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Check for timeouts"]}," - if your network has high latency to the Capsule endpoint, increase ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["timeoutMs"]}," or confirm ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failOpen"]}," is set appropriately."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Confirm the plugin is healthy"]}," - run ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["omp plugin doctor"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["omp plugin list"]}," to check the plugin is enabled."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Contact Capsule Security support"]}," if issues persist."]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-considerations","__idx":11},"children":["Security Considerations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Capsule extension runs in-process inside OMP with full system permissions and observes every tool call, prompt and agent reply. Before deploying:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protect the JWT"]}," - anyone with the token can post events on behalf of your tenant. Rotate it through the portal if it is exposed."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Choose ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failOpen"]}," deliberately"]}," - ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failOpen: true"]}," (the default) prioritizes developer productivity; ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["failOpen: false"]}," prioritizes policy enforcement and will block tool execution when Capsule is unreachable."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Decide on conversation access explicitly"]}," - ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["allowConversationAccess: true"]}," forwards the model context to Capsule. Enable this only after reviewing the data residency and retention implications with your security and privacy teams."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Pin an extension version"]}," in production, using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["omp plugin install @capsulesecurity/omp-capsule@&lt;version&gt;"]},", and review changelogs before upgrading."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use TLS-only endpoints"]},". The extension sends a Bearer token on every request - never configure an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["http://"]}," endpoint."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Understand the coverage boundary"]}," - commands run with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["!"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["!!"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$$"]}," are audited but cannot be blocked."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":12},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},": support@capsule.security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Include"]},": Your organization ID, integration status, extension version, and any error messages"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"references","__idx":13},"children":["References"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://omp.sh/docs"},"children":["OMP Documentation"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://omp.sh/docs/extension-authoring"},"children":["OMP Extension API"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://omp.sh/docs/plugins"},"children":["OMP Plugins"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.npmjs.com/package/@capsulesecurity/omp-capsule"},"children":["Capsule OMP Extension on npm"]}]}]}]},"headings":[{"value":"OMP Integration","id":"omp-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Generate an Extension Token","id":"step-1-generate-an-extension-token","depth":2},{"value":"Step 2: Install the Plugin","id":"step-2-install-the-plugin","depth":2},{"value":"Step 3: Configure the Extension","id":"step-3-configure-the-extension","depth":2},{"value":"Configuration Options","id":"configuration-options","depth":3},{"value":"Token Storage","id":"token-storage","depth":3},{"value":"Step 4: Restart OMP","id":"step-4-restart-omp","depth":2},{"value":"Step 5: Verify the Installation","id":"step-5-verify-the-installation","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":3},{"value":"Security Considerations","id":"security-considerations","depth":2},{"value":"Support","id":"support","depth":2},{"value":"References","id":"references","depth":2}],"frontmatter":{"seo":{"title":"OMP Integration"}},"lastModified":"2026-10-22T19:33:57.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/omp","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}