Capability Matrix
Outcome
See what works today across channels, providers, and platforms,
including caveats.
Channels
| Telegram |
Verified |
Webhook mode + long-polling fallback supported. |
| Discord |
Verified |
Gateway + outbound flows supported. |
| Slack |
Implemented (smoke pending) |
Runtime wiring present; live smoke evidence pending. |
| Signal |
Implemented (smoke pending) |
Inbound polling, typing indicators, and append-time read receipts
are implemented; live smoke evidence pending. |
| Matrix / Element |
Implemented (smoke pending) |
Native matrix-sdk runtime with E2EE, encrypted SQLite
store, cross-signing bootstrap, SAS device verification
(cara matrix verify/accept/confirm/cancel), recovery-key
handling (CLI-only cara matrix recovery-key show/restore),
and store-key rotation (cara matrix rekey-store --new).
Live smoke evidence pending. |
| Hooks (automation) |
Verified |
Token-authenticated wake/agent/mapping endpoints. |
Providers
| Anthropic |
Verified |
Streaming + tools + cancellation. |
| OpenAI |
Verified |
Streaming + tools + cancellation. |
| Codex |
Verified |
OpenAI subscription-login auth profile via explicit
codex: routing. |
| Gemini |
Verified |
Streaming + tools + cancellation. |
| Vertex AI |
Verified |
Gemini (Google) via streamGenerateContent; third-party
publishers (Anthropic, Meta, Mistral, Nvidia) via
streamRawPredict. |
| Ollama |
Verified |
Local serving path supported. |
| Bedrock |
Verified |
SigV4 + streaming/event path wired. |
| NEAR AI Cloud |
Verified |
OpenAI-compatible provider wiring; Carapace does not independently
verify TEE attestation. |
| Venice AI |
Verified |
OpenAI-compatible wrapper/provider wiring. |
| Claude CLI |
Implemented |
Local Claude CLI-backed provider via explicit
claude-cli: routing. |
| Filesystem tools |
Verified |
file_read, directory_list,
file_stat, and file_search register when
filesystem.enabled = true. file_write and
file_move require
filesystem.writeAccess = true. Access stays inside
configured roots and excludes, and config changes require restart. |
Control UI (/ui) |
Foundation shipped |
Auth/session handling, status/channels, redacted config read + safe
patch path, task operator actions, pairing flow. |
| macOS sandboxing |
Verified |
Seatbelt + limits for sandbox-required subprocess paths. |
| Linux sandboxing |
Verified |
Landlock + limits for sandbox-required subprocess paths. |
| Windows sandboxing |
Partial |
Job Objects + AppContainer paths; unsupported deny-network spawn
paths fail closed. |
| Unsupported targets |
Verified fail-closed |
Sandbox-required subprocess flows are rejected rather than
unsandboxed. |
Source of truth