CAPE Sandbox
7.4#3 in malware analysis sandboxesFree planFree planWebAPILinuxSelf-hosted
VisitCAPE Sandbox vs Malwagon
What both publish
| Fact | CAPE Sandbox | Malwagon |
|---|---|---|
| Documentation depth | The documentation covers installation, guests, networking, cloud deployment, API usage, customization, distributed mode, and troubleshooting, while warning that some material may be outdated. | The documentation covers submission modules, analysis options, report interpretation, exports, visibility, retention, REST endpoints, MCP methods, errors and rate limits. |
| Dynamic analysis | It captures behavioral activity, files created or changed during execution, network traffic in PCAP format, screenshots, and memory dumps. | Dynamic analysis records ETW kernel telemetry, memory forensics, hypervisor introspection, network capture and JA3/JA4 fingerprints. |
| Integrations | The documentation covers integrations with Box-js, LibreNMS, and Suricata, and describes CAPE's modular design for integrating external services. | The service provides a bearer-token REST API, an MCP server at https://malwagon.com/mcp, and a Python CLI installable with pip. |
| REST API | CAPE exposes Django REST Framework endpoints for submissions, tasks, reports, screenshots, files, PCAPs, machines, and status. | The public API uses bearer authentication and provides seven JSON routes under /api/v1 for scans, uploads, bulk submission, status, reports, indicators and hashes. |
CAPE Sandbox plans
- CAPE SandboxFree
- Public demonstration instanceFree
Malwagon plans
- CommunityFree
- Free scanFree
- Pro$79 a month
- Business$199 a month
- Team / EnterprisePriced on request
Pick CAPE Sandbox if…
CAPE suits security teams and researchers who need to inspect suspicious files and automate analysis. It requires users to manage a host-and-guest deployment and take responsibility for using the tool.
Pick Malwagon if…
It suits security teams and researchers who need to analyze suspicious files, URLs or commands and review evidence-backed results. Unauthenticated users can also submit untrusted attachments and read reports.