CAPE Sandbox

CAPE Sandbox is ranked #7 of 24 in malware analysis sandboxes on The Geeks Club. It runs on API, Linux, Self-hosted, Web, Windows. There is a free plan.

CAPE Sandbox plans and pricing

All plans

CAPE Sandbox Free Open-source software · self-hosted setup capev2.readthedocs.io · 2 Oct 2026

Compared on malware analysis sandboxes

URL analysis: Yes
API access: Yes
Network traffic analysis: Yes
IOC extraction: Yes
Deployment model: hybrid

Best CAPE Sandbox alternatives

See all 12

8.0 ANY.RUN Free plan 7.4 Bitdefender Total Security Free trial $5/mo

7.4 Hybrid Analysis Free plan 7.3 Retrace Free plan

7.2 Malwagon Free plan

7.1 CrowdStrike Falcon Pro Free trial $8.33/mo

CAPE Sandbox

Purpose: CAPE is an open-source malware sandbox that runs suspicious files in an isolated environment while monitoring behavior and collecting forensic artifacts.
Dynamic analysis: It captures behavioral activity, files created or changed during execution, network traffic in PCAP format, screenshots, and memory dumps.
Unpacking and extraction: CAPE adds automated dynamic malware unpacking, YARA-based classification of unpacked payloads, and static and dynamic malware configuration extraction.
Debugger: Its debugger can be programmed with YARA signatures for custom unpacking or configuration extractors, anti-sandbox countermeasures, and instruction traces.
Input types: Documented analysis targets include Windows executables, DLLs, PDFs, Office files, URLs, HTML, scripts, ZIP files, and Java JARs.
Web interface: The Django web interface supports submitting files, browsing reports, and searching analysis results.
Automation: CAPE offers a REST API and Python submission functions for automating file and URL analysis.
Integrations: The documentation covers integrations with Box-js, LibreNMS, and Suricata, and describes CAPE's modular design for integrating external services.
AI clients: The CAPE MCP server connects CAPE instances with MCP-compliant clients, with examples for Claude Desktop, Gemini CLI, and Antigravity.
Security controls: The MCP documentation describes API token authentication, restricting submitted files to an allowed directory, and disabling selected tools.
Deployment: The documented architecture runs each analysis in a fresh isolated virtual machine; GNU/Linux, preferably Ubuntu LTS, is the recommended host, with Windows 10 or Windows 11 23H2 as the recommended guest.
Limits and setup: CAPE requires a host and guest machines, and its installation guide cautions that changing packages installed by its setup script can break the KVM/libvirt/CAPE installation.
Support: The project points users to its FAQ, community discussion, and GitHub issue tracker, and says beta or development builds generally do not receive support.
Warranty: CAPE is distributed without warranty, and the documentation says use of the tool is the user's responsibility.
Price from: Free

Visit site Alternatives

Where it ranks on The Geeks Club

Best Malware Analysis Sandboxes in 2026#7 of 24

Is CAPE Sandbox yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote CAPE Sandbox

Sources

capev2.readthedocs.io/en/latest/introduction/what.html· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/usage/web.html· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/usage/submit.html· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/integrations/index.html· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/usage/mcp.html· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/installation/host/installatio· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/development/development_notes· checked 2 Oct 2026
capev2.readthedocs.io/en/latest/introduction/license.html· checked 2 Oct 2026
capesandbox.com· checked 28 Sept 2026
capev2.readthedocs.io/en/latest/finalremarks/· checked 2 Oct 2026