package caps

All checked builds pass
  1. Overview
  2. Docs
Capability types and rules for OCaml

Install 

dune-project
 Dependency

github.com Readme Changelog Edit opam file Versions (1)

Authors

  1. Y
    Yoann Padioleau <yoann.padioleau@gmail.com>

Maintainers

  1. Y
    Yoann Padioleau <yoann.padioleau@gmail.com>

Sources

0.1.0.tar.gz
md5=84dac271a62bd7f13776958561fa9056
sha512=85701a1dd5a584ea795e6b2101aa8a07b3d1ab616a302b013b1d18bf2d69e287e3392a6d30d06e228c8fbd30f41a137b6bbced02e75d9c72c99293b40e27dc9b

Description

Capability types (Cap.ml) enforcing restricted I/O access across a codebase.

Added to opam-repository:

README

ocaml-caps

Overview

Cap.ml is a small library providing capability types to use in a disciplined manner the UNIX system calls behind standard library functions such as Sys.command, Unix.fork, or even Stdlib.open_in. When combined with the use of the Semgrep tool and capability rules, it can offer stronger guarantees on a codebase.

Documentation

See https://aryx.github.io/ocaml-caps/caps.html for more information. My OCaml workshop 2026 presentation is also available here: https://www.youtube.com/watch?v=4t_2wLz9EOo and the slides here: https://aryx.github.io/ocaml-caps/

You might find also useful the related https://github.com/aryx/ocaml-commons project that provides a few additional modules using capabilities.

History

The library was developed in 2024 while I was working at Semgrep but got extracted in its own repository in August 2026 (mostly as support for my OCaml workshop 2026 presentation).

AI disclaimer

The OCaml code in this library was written by a human (me, Pad). The code is actually very small. The Semgrep rules were also written by me.

The scripts/ were written by Claude Code to compute usage statistics of capability types in OCaml projects. The Dockerfile, GHA workflows, and a few other configuration files were written by Claude Code, but mostly derived from my other projects (and written by me).

Dependencies (2)

  1. dune >= "3.7"
  2. ocaml >= "4.14"

Dev Dependencies (1)

  1. odoc with-doc

Optional Dependencies

None

Conflicts

None

Build status

Results of building caps with each compiler on check.ci.ocaml.org, run of against opam-repository 8a77e58. All results for this package.

Each result links to its build log. To keep crawlers from overloading the site, build logs require a GitHub sign-in (see ocurrent/opam-health-check). On your first log, GitHub asks you to “Authorize opam-health-check”, the OCurrent app that runs these checks; it sees only your public profile, not your repositories. The sign-in lasts 30 days.

Version OCaml 4.11 OCaml 4.14 OCaml 5.2 OCaml 5.4 OCaml 5.5
0.1.0 (this version) n/a good good good good
  • good Package successfully built
  • partial One of the dependencies failed to build
  • bad Package failed to build
  • n/a Package is not available in this environment
  • internal Internal failure