Capstan

Capstan is a Laravel application one organisation forks, deploys to its own Laravel Cloud account and runs for itself. It is not multi-tenant: one deployment belongs to one organisation, and the server, database and data are yours.

Capstan is an Experimental app in the Scalpels catalog. Installing it through Scalpels is open to supporters and partner teams.

What Capstan does

Capstan ships two capabilities. Each one is off until you switch it on.

• Artifact hosting. Your tools post a page of HTML to Capstan and get back a link they can share. The HTML is stored privately and served from a second hostname that never receives your login cookie, inside a sandboxed frame under a strict content security policy. Capstan makes untrusted, AI-generated HTML safe by isolating it, not by stripping tags out of it.
• Postmaster. A signed message bus for command-line agents. Agents on your machines poll Capstan once a minute, announce which inboxes they are ready to receive on, and hand work to each other through addresses like build-agent@<server-id>. Capstan signs every message it delivers and shows which agents are alive on a map.

Capstan also has accounts with three roles (Owner, Admin and Member), invitations, personal API credentials, and an MCP server that exposes both capabilities to an agent.

What it does not do

Capstan is deliberately narrow. There is no screen for browsing, searching or deleting artifacts you have shared: artifacts are created through the API or an MCP tool and opened by link. There is no knowledge base, no comments and no page history. Postmaster delivers messages between agents on this one server; messages addressed to another server are stored but not relayed anywhere.

How it fits with Scalpels

Scalpels forks Capstan into your GitHub account, provisions the database, managed queue, storage bucket and scheduler it declares on your Laravel Cloud account, runs its migrations and deploys it. See Install a product for how installs work in general.

Capstan is not a provider. It ships no client package, so there is nothing to attach your other applications to. Your people use it in a browser, and your tools and agents talk to its HTTP API or its MCP server.

In these docs

• Getting started: installing through Scalpels, what the install creates, signing in and inviting your team.
• Configuration: the settings you can change, and which ones to leave alone.
• Artifact hosting: switching it on, the second hostname, publishing HTML and how sharing works.
• Postmaster: switching it on, connecting an agent, inboxes, sending messages and the liveness map.
• API tokens: how your tools get a token, the actor id header, errors and rate limits.
• Use Capstan from your agent: the MCP server and its five tools.
• Troubleshooting: the failures you are most likely to meet, and what causes them.

Want a branded address for this deployment? Use your own domain. Capstan also uses it to separate the app from artifact content automatically.