CAPE Sandbox

Web · Linux · Self-hosted · API

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedPlans, terms and facts published

CAPE Sandbox is ranked #7 of 22 in sandbox software on Freedom251. It runs on API, Linux, Self-hosted, Web. There is a free plan.

CAPE Sandbox plans and pricing

All plans

CAPE Sandbox Free Open-source project; self-hosted installation; free online demonstration instance github.com · 7 Oct 2026

Compared on sandbox software

Isolation method: snapshot
Network controls: Yes
API or CLI access: Yes
Deployment: both

Best CAPE Sandbox alternatives

See all 20

Two bars ANY.RUN Free tier No. 1Free6.7 Two bars Daytona Free tier No. 2Free6.6 Two bars Docker Desktop Free tier No. 3$9/mo6.6 Two bars Northflank Free tier No. 4Free6.6 Two bars Anthropic Sandbox Runtime Free tier No. 5Free6.5 Two bars microsandbox Free tier No. 6$49/mo6.5

The record

Purpose: CAPE is a malware sandbox that executes malicious files in an isolated environment while recording behavior and collecting forensic artifacts.
Analysis output: Its core capabilities include API-hook behavioral instrumentation, file-change capture, PCAP network capture, malware classification, desktop screenshots, and full memory dumps.
Unpacking and extraction: CAPE adds automated dynamic malware unpacking and static and dynamic malware configuration extraction.
Debugger: A debugger programmable through YARA signatures supports custom unpacking and config extractors, anti-sandbox countermeasures, and instruction traces.
Classification: Malware classification can use YARA scans of unpacked payloads, Suricata scans of network captures, and behavioral signatures over API-hook output.
Parser integrations: Configuration parsing supports CAPE's framework as well as RATDecoders, DC3-MWCP, MalDuck, and MaCo.
API and distributed use: The documentation includes a REST API, distributed CAPE setup, and API endpoints for tasks, reports, files, PCAPs, and machines.
Other integrations: The documentation lists integrations for Box-js, Curtain, LibreNMS, and Suricata.
Security reporting: The repository security policy directs vulnerability reports to [email protected] or the CAPE Sandbox Twitter account.
Supported versions: The published security policy marks versions 5.1.x and 4.0.x as supported and 5.0.x and versions below 4.0 as unsupported.
Deployment requirements: The project recommends Ubuntu 24.04 LTS for installation, Windows 10 or Windows 11 23H2 as the target, and KVM as the hypervisor.
Unpacking limitation: Active unpacking is off by default because it may affect detonation quality.
Intended users: The project invites contributions of signatures, parsers, and bypasses for additional malware families, indicating a community of malware analysts and researchers.
Founded: 2016
Price from: Free

Where it ranks on Freedom251

Best Sandbox Software in 2026#7 of 22

Is CAPE Sandbox yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote CAPE Sandbox

Sources

github.com/kevoreilly/CAPEv2· checked 7 Oct 2026
capev2.readthedocs.io/en/latest/· checked 7 Oct 2026
github.com/kevoreilly/CAPEv2/blob/master/SECURITY.· checked 7 Oct 2026