diff --git a/apps/system/components/DebugConsole/kata-shell/Cargo.toml b/apps/system/components/DebugConsole/kata-shell/Cargo.toml
index 7ed0633..a56b218 100644
--- a/apps/system/components/DebugConsole/kata-shell/Cargo.toml
+++ b/apps/system/components/DebugConsole/kata-shell/Cargo.toml
@@ -19,6 +19,7 @@ default = [
     "TEST_TIMER_SERVICE",
 ]
 CONFIG_DEBUG_BUILD = []
+CONFIG_PRINTING = []
 CONFIG_KERNEL_MCS = []
 # Commands that are likely not useful
 FRINGE_CMDS = []
diff --git a/apps/system/components/DebugConsole/kata-shell/src/lib.rs b/apps/system/components/DebugConsole/kata-shell/src/lib.rs
index ee56000..b454a4e 100644
--- a/apps/system/components/DebugConsole/kata-shell/src/lib.rs
+++ b/apps/system/components/DebugConsole/kata-shell/src/lib.rs
@@ -119,6 +119,7 @@ pub fn repl<T: io::BufRead>(
     cmds.extend([
         ("builtins",            builtins_command as CmdFn),
         ("bundles",             bundles_command as CmdFn),
+        ("capscan",             capscan_command as CmdFn),
         ("kvdelete",            kvdelete_command as CmdFn),
         ("kvread",              kvread_command as CmdFn),
         ("kvwrite",             kvwrite_command as CmdFn),
@@ -231,12 +232,12 @@ fn ps_command(
 ) -> Result<(), CommandError> {
     #[cfg(feature = "CONFIG_DEBUG_BUILD")]
     unsafe {
-        kata_os_common::sel4_sys::seL4_DebugDumpScheduler();
+        sel4_sys::seL4_DebugDumpScheduler();
         Ok(())
     }
 
     #[cfg(not(feature = "CONFIG_DEBUG_BUILD"))]
-    Ok(writeln!(output, "Kernel support not configured!")?)
+    Ok(writeln!(output, "Kernel support not configured with CONFIG_DEBUG_BUILD!")?)
 }
 
 fn bundles_command(
@@ -258,6 +259,47 @@ fn bundles_command(
     Ok(())
 }
 
+/// Implements a "capscan" command that dumps seL4 capabilities to the console.
+#[allow(unused_variables)]
+fn capscan_command(
+    args: &mut dyn Iterator<Item = &str>,
+    _input: &mut dyn io::BufRead,
+    output: &mut dyn io::Write,
+    _builtin_cpio: &[u8],
+) -> Result<(), CommandError> {
+    #[cfg(feature = "CONFIG_PRINTING")]
+    match args.next() {
+        Some("console") => unsafe { sel4_sys::seL4_DebugDumpCNode(SELF_CNODE); }
+        Some("memory") => { let _ = kata_memory_interface::kata_memory_capscan(); }
+        Some("process") => { let _ = kata_proc_interface::kata_proc_ctrl_capscan(); }
+        Some("mlcoord") => { let _ = kata_mlcoord_capscan(); }
+        Some("security") => { let _ = kata_security_interface::kata_security_capscan(); }
+        Some("storage") => { let _ = kata_storage_interface::kata_storage_capscan(); }
+        Some("timer") => { let _ = kata_timer_interface::timer_service_capscan(); }
+        Some(bundle_id) => {
+            if let Err(e) = kata_proc_interface::kata_proc_ctrl_capscan_bundle(bundle_id) {
+                writeln!(output, "{}: {:?}", bundle_id, e)?;
+            }
+        }
+        None => {
+            writeln!(output, "capscan <target>, where <target> is one of:")?;
+            writeln!(output, "  console (DebugConsole)")?;
+            writeln!(output, "  memory (MemoryManager)")?;
+            writeln!(output, "  process (ProcessManager)")?;
+            writeln!(output, "  mlcoord (MlCoordinator)")?;
+            writeln!(output, "  securiy (SecurityCoordinator)")?;
+            writeln!(output, "  storage (StorageManager)")?;
+            writeln!(output, "  timer (TimerService)")?;
+            writeln!(output, "anything else is treated as a bundle_id")?;
+        }
+    }
+
+    #[cfg(not(feature = "CONFIG_PRINTING"))]
+    writeln!(output, "Kernel not configured with CONFIG_PRINTING!")?;
+
+    Ok(())
+}
+
 fn collect_from_cpio(
     filename: &str,
     cpio: &[u8],
diff --git a/apps/system/components/MemoryManager/kata-memory-component/src/run.rs b/apps/system/components/MemoryManager/kata-memory-component/src/run.rs
index f3beb46..1eda7a4 100644
--- a/apps/system/components/MemoryManager/kata-memory-component/src/run.rs
+++ b/apps/system/components/MemoryManager/kata-memory-component/src/run.rs
@@ -163,3 +163,13 @@ pub unsafe extern "C" fn memory_debug() -> MemoryManagerError {
 
     KATA_MEMORY.debug().into()
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn memory_capscan() {
+    let recv_path = CAMKES.get_current_recv_path();
+    // NB: make sure noone clobbers the setup done in memory__init
+    CAMKES.assert_recv_path();
+    Camkes::debug_assert_slot_empty("memory_debug", &recv_path);
+
+    let _ = Camkes::capscan();
+}
diff --git a/apps/system/components/MemoryManager/kata-memory-interface/src/lib.rs b/apps/system/components/MemoryManager/kata-memory-interface/src/lib.rs
index 92a384e..d3840a0 100644
--- a/apps/system/components/MemoryManager/kata-memory-interface/src/lib.rs
+++ b/apps/system/components/MemoryManager/kata-memory-interface/src/lib.rs
@@ -703,3 +703,13 @@ pub fn kata_memory_debug() -> Result<(), MemoryManagerError> {
     unsafe { memory_debug() };
     Ok(())
 }
+
+#[inline]
+pub fn kata_memory_capscan() -> Result<(), MemoryManagerError> {
+    extern "C" {
+        // NB: this assumes the MemoryManager component is named "memory".
+        fn memory_capscan();
+    }
+    unsafe { memory_capscan() };
+    Ok(())
+}
diff --git a/apps/system/components/MlCoordinator/kata-ml-component/src/run.rs b/apps/system/components/MlCoordinator/kata-ml-component/src/run.rs
index 2567b99..9f7fbf4 100644
--- a/apps/system/components/MlCoordinator/kata-ml-component/src/run.rs
+++ b/apps/system/components/MlCoordinator/kata-ml-component/src/run.rs
@@ -132,3 +132,8 @@ pub unsafe extern "C" fn data_fault_handle() {
 pub unsafe extern "C" fn mlcoord_debug_state() {
     ML_COORD.lock().debug_state();
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn mlcoord_capscan() {
+    let _ = Camkes::capscan();
+}
diff --git a/apps/system/components/MlCoordinator/kata-ml-interface/src/lib.rs b/apps/system/components/MlCoordinator/kata-ml-interface/src/lib.rs
index 5d9fa59..79fb31a 100644
--- a/apps/system/components/MlCoordinator/kata-ml-interface/src/lib.rs
+++ b/apps/system/components/MlCoordinator/kata-ml-interface/src/lib.rs
@@ -79,3 +79,12 @@ pub fn kata_mlcoord_debug_state() {
     }
     unsafe { mlcoord_debug_state() };
 }
+
+#[inline]
+pub fn kata_mlcoord_capscan() -> Result<(), MlCoordError> {
+    extern "C" {
+        fn mlcoord_capscan();
+    }
+    unsafe { mlcoord_capscan() };
+    Ok(())
+}
diff --git a/apps/system/components/ProcessManager/kata-proc-component/src/run.rs b/apps/system/components/ProcessManager/kata-proc-component/src/run.rs
index cf82d79..c990fec 100644
--- a/apps/system/components/ProcessManager/kata-proc-component/src/run.rs
+++ b/apps/system/components/ProcessManager/kata-proc-component/src/run.rs
@@ -138,3 +138,21 @@ pub unsafe extern "C" fn proc_ctrl_get_running_bundles(
         Err(e) => e,
     }
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn proc_ctrl_capscan() {
+    let _ = Camkes::capscan();
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn proc_ctrl_capscan_bundle(
+    c_bundle_id: *const cstr_core::c_char
+) -> ProcessManagerError {
+    match CStr::from_ptr(c_bundle_id).to_str() {
+        Ok(str) => match KATA_PROC.capscan(str) {
+            Ok(_) => ProcessManagerError::Success,
+            Err(e) => e,
+        },
+        Err(_) => ProcessManagerError::BundleIdInvalid,
+    }
+}
diff --git a/apps/system/components/ProcessManager/kata-proc-interface/src/lib.rs b/apps/system/components/ProcessManager/kata-proc-interface/src/lib.rs
index a950f2e..957a48b 100644
--- a/apps/system/components/ProcessManager/kata-proc-interface/src/lib.rs
+++ b/apps/system/components/ProcessManager/kata-proc-interface/src/lib.rs
@@ -57,6 +57,7 @@ pub trait BundleImplInterface {
     fn stop(&mut self) -> Result<(), ProcessManagerError>;
     fn suspend(&self) -> Result<(), ProcessManagerError>;
     fn resume(&self) -> Result<(), ProcessManagerError>;
+    fn capscan(&self) -> Result<(), ProcessManagerError>;
 }
 
 // NB: struct's marked repr(C) are processed by cbindgen to get a .h file
@@ -71,6 +72,7 @@ pub enum ProcessManagerError {
     BundleNotFound,
     BundleFound,
     BundleRunning,
+    BundleNotRunning,
     UnknownError,
     DeserializeError,
     SerializeError,
@@ -83,6 +85,7 @@ pub enum ProcessManagerError {
     // TODO(sleffler): for use if/when ProcessManagerInterface grows
     SuspendFailed,
     ResumeFailed,
+    CapScanFailed,
 }
 
 // Interface to underlying facilities (StorageManager, seL4); also
@@ -95,6 +98,7 @@ pub trait ProcessManagerInterface {
     fn uninstall(&mut self, bundle_id: &str) -> Result<(), ProcessManagerError>;
     fn start(&mut self, bundle: &Bundle) -> Result<Box<dyn BundleImplInterface>, ProcessManagerError>;
     fn stop(&mut self, bundle_impl: &mut dyn BundleImplInterface) -> Result<(), ProcessManagerError>;
+    fn capscan(&self, bundle_impl: &dyn BundleImplInterface) -> Result<(), ProcessManagerError>;
 }
 
 // NB: bundle_id comes across the C interface as *const cstr_core::c_char
@@ -112,6 +116,7 @@ pub trait ProcessControlInterface {
     fn start(&mut self, bundle_id: &str) -> Result<(), ProcessManagerError>;
     fn stop(&mut self, bundle_id: &str) -> Result<(), ProcessManagerError>;
     fn get_running_bundles(&self) -> Result<BundleIdArray, ProcessManagerError>;
+    fn capscan(&self, bundle_id: &str) -> Result<(), ProcessManagerError>;
 }
 
 impl From<postcard::Error> for ProcessManagerError {
@@ -231,6 +236,26 @@ pub fn kata_proc_ctrl_stop(bundle_id: &str) -> Result<(), ProcessManagerError> {
     unsafe { proc_ctrl_stop(cstr.as_ptr()) }.into()
 }
 
+#[inline]
+#[allow(dead_code)]
+pub fn kata_proc_ctrl_capscan() -> Result<(), ProcessManagerError> {
+    extern "C" {
+        fn proc_ctrl_capscan();
+    }
+    unsafe { proc_ctrl_capscan() }
+    Ok(())
+}
+
+#[inline]
+#[allow(dead_code)]
+pub fn kata_proc_ctrl_capscan_bundle(bundle_id: &str) -> Result<(), ProcessManagerError> {
+    extern "C" {
+        fn proc_ctrl_capscan_bundle(c_bundle_id: *const cstr_core::c_char) -> ProcessManagerError;
+    }
+    let cstr = CString::new(bundle_id)?;
+    unsafe { proc_ctrl_capscan_bundle(cstr.as_ptr()) }.into()
+}
+
 // TODO(sleffler): move out of interface?
 #[cfg(test)]
 mod tests {
diff --git a/apps/system/components/ProcessManager/kata-proc-manager/Cargo.toml b/apps/system/components/ProcessManager/kata-proc-manager/Cargo.toml
index 7e53e0c..2774e18 100644
--- a/apps/system/components/ProcessManager/kata-proc-manager/Cargo.toml
+++ b/apps/system/components/ProcessManager/kata-proc-manager/Cargo.toml
@@ -13,6 +13,7 @@ default = []
 CONFIG_CAPDL_LOADER_CC_REGISTERS = []
 CONFIG_CAPDL_LOADER_WRITEABLE_PAGES = []
 CONFIG_DEBUG_BUILD = []
+CONFIG_PRINTING = []
 CONFIG_KERNEL_MCS = []
 CONFIG_SMP_SUPPORT = []
 
diff --git a/apps/system/components/ProcessManager/kata-proc-manager/src/lib.rs b/apps/system/components/ProcessManager/kata-proc-manager/src/lib.rs
index f2643c0..c764cdf 100644
--- a/apps/system/components/ProcessManager/kata-proc-manager/src/lib.rs
+++ b/apps/system/components/ProcessManager/kata-proc-manager/src/lib.rs
@@ -84,6 +84,9 @@ impl ProcessControlInterface for KataProcManager {
     fn get_running_bundles(&self) -> Result<BundleIdArray, ProcessManagerError> {
         self.manager.lock().as_ref().unwrap().get_running_bundles()
     }
+    fn capscan(&self, bundle_id: &str) -> Result<(), ProcessManagerError> {
+        self.manager.lock().as_ref().unwrap().capscan(bundle_id)
+    }
 }
 
 struct KataManagerInterface;
@@ -161,4 +164,9 @@ impl ProcessManagerInterface for KataManagerInterface {
         // TODO(sleffler): fill-in 1+2
         bundle_impl.stop()
     }
+    fn capscan(&self, bundle_impl: &dyn BundleImplInterface) -> Result<(), ProcessManagerError> {
+        trace!("ProcessManagerInterface::capscan");
+
+        bundle_impl.capscan()
+    }
 }
diff --git a/apps/system/components/ProcessManager/kata-proc-manager/src/proc_manager/mod.rs b/apps/system/components/ProcessManager/kata-proc-manager/src/proc_manager/mod.rs
index 7b70566..ec94b17 100644
--- a/apps/system/components/ProcessManager/kata-proc-manager/src/proc_manager/mod.rs
+++ b/apps/system/components/ProcessManager/kata-proc-manager/src/proc_manager/mod.rs
@@ -167,6 +167,21 @@ impl ProcessControlInterface for ProcessManager {
         }
         Ok(result)
     }
+
+    fn capscan(&self, bundle_id: &str) -> Result<(), ProcessManagerError> {
+        trace!("capscan bundle_id {}", bundle_id);
+        let bid = BundleId::from_str(bundle_id);
+        if let Some(bundle) = self.bundles.get(&bid) {
+            trace!("capscan state {:?}", bundle.state);
+            if bundle.state != BundleState::Running {
+                return Err(ProcessManagerError::BundleNotRunning)
+            }
+            self.manager.capscan(bundle.bundle_impl.as_deref().unwrap())
+        } else {
+            trace!("capscan {} not found", bundle_id);
+            Err(ProcessManagerError::BundleNotFound)
+        }
+    }
 }
 
 #[cfg(test)]
@@ -192,6 +207,7 @@ mod tests {
         fn stop(&mut self) -> Result<(), ProcessManagerError> { Ok(()) }
         fn resume(&self) -> Result<(), ProcessManagerError> { Ok(()) }
         fn suspend(&self) -> Result<(), ProcessManagerError> { Ok(()) }
+        fn capscan(&self) -> Result<(), ProcessManagerError> { Ok(()) }
     }
     impl ProcessManagerInterface for FakeManager {
         fn install(&mut self, pkg_buffer: *const u8, pkg_buffer_size: u32) -> Result<String, pme> {
@@ -215,6 +231,9 @@ mod tests {
         fn stop(&mut self, bundle_impl: &mut dyn BundleImplInterface) -> Result<(), pme> {
             Ok(())
         }
+        fn capscan(&mut self, bundle_impl: &mut dyn BundleImplInterface) -> Result<(), pme> {
+            Ok(())
+        }
     }
 
     #[test]
diff --git a/apps/system/components/ProcessManager/kata-proc-manager/src/sel4bundle/mod.rs b/apps/system/components/ProcessManager/kata-proc-manager/src/sel4bundle/mod.rs
index a23b4ab..c6e2e31 100644
--- a/apps/system/components/ProcessManager/kata-proc-manager/src/sel4bundle/mod.rs
+++ b/apps/system/components/ProcessManager/kata-proc-manager/src/sel4bundle/mod.rs
@@ -608,4 +608,9 @@ impl BundleImplInterface for seL4BundleImpl {
         unsafe { seL4_TCB_Suspend(self.cap_tcb.slot) }
             .map_err(|_| ProcessManagerError::SuspendFailed)
     }
+    fn capscan(&self) -> Result<(), ProcessManagerError> {
+        #[cfg(feature = "CONFIG_PRINTING")]
+        unsafe { sel4_sys::seL4_DebugDumpCNode(self.cspace_root.objs[0].cptr); }
+        Ok(())
+    }
 }
diff --git a/apps/system/components/SecurityCoordinator/kata-security-component/src/run.rs b/apps/system/components/SecurityCoordinator/kata-security-component/src/run.rs
index 09184eb..54a2bed 100644
--- a/apps/system/components/SecurityCoordinator/kata-security-component/src/run.rs
+++ b/apps/system/components/SecurityCoordinator/kata-security-component/src/run.rs
@@ -239,6 +239,11 @@ fn test_mailbox_request(
     unsafe { KATA_SECURITY.test_mailbox() }
 }
 
+fn capscan_request() -> Result<(), SecurityRequestError> {
+    let _ = Camkes::capscan();
+    Ok(())
+}
+
 #[no_mangle]
 pub unsafe extern "C" fn security_request(
     c_request: SecurityRequest,
@@ -272,5 +277,7 @@ pub unsafe extern "C" fn security_request(
             delete_key_request(request_buffer, reply_buffer),
         SecurityRequest::SrTestMailbox =>
             test_mailbox_request(),
+        SecurityRequest::SrCapScan =>
+            capscan_request(),
     }.map_or_else(|e| e, |_v| SecurityRequestError::SreSuccess)
 }
diff --git a/apps/system/components/SecurityCoordinator/kata-security-interface/src/lib.rs b/apps/system/components/SecurityCoordinator/kata-security-interface/src/lib.rs
index bff01b4..ea69165 100644
--- a/apps/system/components/SecurityCoordinator/kata-security-interface/src/lib.rs
+++ b/apps/system/components/SecurityCoordinator/kata-security-interface/src/lib.rs
@@ -168,10 +168,14 @@ impl<'a> SecurityCapability for DeleteKeyRequest<'a> {}
 
 // SecurityRequestTestMailbox
 #[derive(Debug, Serialize, Deserialize)]
-pub struct TestMailboxRequest {
-}
+pub struct TestMailboxRequest {}
 impl SecurityCapability for TestMailboxRequest {}
 
+// SecurityRequestCapScan
+#[derive(Debug, Serialize, Deserialize)]
+pub struct CapScanRequest {}
+impl SecurityCapability for CapScanRequest {}
+
 // NB: this is the union of InstallInterface & StorageInterface because
 //   the camkes-generated interface code uses basic C which does not
 //   tolerate overlapping member names.
@@ -241,6 +245,7 @@ pub enum SecurityRequest {
     SrDeleteKey, // Delete key [bundle_id, key]
 
     SrTestMailbox, // Run mailbox tests
+    SrCapScan, // Dump contents CNode to console
 }
 
 // Interface to underlying facilities; also used to inject fakes for unit tests.
@@ -489,3 +494,13 @@ pub fn kata_security_test_mailbox() -> Result<(), SecurityRequestError> {
         &mut [0u8; SECURITY_REPLY_DATA_SIZE],
     )
 }
+
+#[inline]
+#[allow(dead_code)]
+pub fn kata_security_capscan() -> Result<(), SecurityRequestError> {
+    kata_security_request(
+        SecurityRequest::SrCapScan,
+        &CapScanRequest {},
+        &mut [0u8; SECURITY_REPLY_DATA_SIZE],
+    )
+}
diff --git a/apps/system/components/StorageManager/kata-storage-component/src/run.rs b/apps/system/components/StorageManager/kata-storage-component/src/run.rs
index ed454a4..768e6df 100644
--- a/apps/system/components/StorageManager/kata-storage-component/src/run.rs
+++ b/apps/system/components/StorageManager/kata-storage-component/src/run.rs
@@ -75,3 +75,8 @@ pub unsafe extern "C" fn storage_delete(
         Err(_) => StorageManagerError::SmeKeyInvalid,
     }
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn storage_capscan() {
+    let _ = Camkes::capscan();
+}
diff --git a/apps/system/components/StorageManager/kata-storage-interface/src/lib.rs b/apps/system/components/StorageManager/kata-storage-interface/src/lib.rs
index 66d1444..c2071f3 100644
--- a/apps/system/components/StorageManager/kata-storage-interface/src/lib.rs
+++ b/apps/system/components/StorageManager/kata-storage-interface/src/lib.rs
@@ -139,3 +139,13 @@ pub fn kata_storage_write(key: &str, value: &[u8]) -> Result<(), StorageManagerE
     let cstr = CString::new(key)?;
     unsafe { storage_write(cstr.as_ptr(), value.len(), value.as_ptr()) }.into()
 }
+
+#[inline]
+#[allow(dead_code)]
+pub fn kata_storage_capscan() -> Result<(), StorageManagerError> {
+    extern "C" {
+        fn storage_capscan();
+    }
+    unsafe { storage_capscan() }
+    Ok(())
+}
diff --git a/apps/system/components/TimerService/kata-timer-component/src/run.rs b/apps/system/components/TimerService/kata-timer-component/src/run.rs
index c63d61a..e4d9978 100644
--- a/apps/system/components/TimerService/kata-timer-component/src/run.rs
+++ b/apps/system/components/TimerService/kata-timer-component/src/run.rs
@@ -87,3 +87,8 @@ pub unsafe extern "C" fn timer_interrupt_handle() {
     TIMER_SRV.lock().service_interrupt();
     assert!(timer_interrupt_acknowledge() == 0);
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn timer_capscan() {
+    let _ = Camkes::capscan();
+}
diff --git a/apps/system/components/TimerService/kata-timer-interface/src/lib.rs b/apps/system/components/TimerService/kata-timer-interface/src/lib.rs
index a55018a..78f99ba 100644
--- a/apps/system/components/TimerService/kata-timer-interface/src/lib.rs
+++ b/apps/system/components/TimerService/kata-timer-interface/src/lib.rs
@@ -81,3 +81,13 @@ pub fn timer_service_wait() -> seL4_Word {
 
     notification_badge
 }
+
+#[inline]
+#[allow(dead_code)]
+pub fn timer_service_capscan() -> Result<(), TimerServiceError> {
+    extern "C" {
+        fn timer_capscan();
+    }
+    unsafe { timer_capscan() }
+    Ok(())
+}
diff --git a/apps/system/components/kata-os-common/src/camkes/Cargo.toml b/apps/system/components/kata-os-common/src/camkes/Cargo.toml
index 2a14f8f..84abf95 100644
--- a/apps/system/components/kata-os-common/src/camkes/Cargo.toml
+++ b/apps/system/components/kata-os-common/src/camkes/Cargo.toml
@@ -2,6 +2,13 @@
 name = "camkes"
 version = "0.1.0"
 edition = "2021"
+build = "build.rs"
+
+[build-dependencies]
+sel4-config = { path = "../sel4-config" }
+
+[features]
+CONFIG_PRINTING = []
 
 [dependencies]
 log = "0.4"
diff --git a/apps/system/components/kata-os-common/src/camkes/build.rs b/apps/system/components/kata-os-common/src/camkes/build.rs
new file mode 100644
index 0000000..95474c6
--- /dev/null
+++ b/apps/system/components/kata-os-common/src/camkes/build.rs
@@ -0,0 +1,21 @@
+extern crate sel4_config;
+use std::env;
+
+fn main() {
+    // If SEL4_OUT_DIR is not set we expect the kernel build at a fixed
+    // location relative to the ROOTDIR env variable.
+    println!("SEL4_OUT_DIR {:?}", env::var("SEL4_OUT_DIR"));
+    let sel4_out_dir = env::var("SEL4_OUT_DIR").unwrap_or_else(
+        |_| format!("{}/out/kata/kernel", env::var("ROOTDIR").unwrap())
+    );
+    println!("sel4_out_dir {}", sel4_out_dir);
+
+    // Dredge seL4 kernel config for settings we need as features to generate
+    // correct code: e.g. CONFIG_KERNEL_MCS enables MCS support which changes
+    // the system call numbering.
+    let features = sel4_config::get_sel4_features(&sel4_out_dir);
+    println!("features={:?}", features);
+    for feature in features {
+        println!("cargo:rustc-cfg=feature=\"{}\"", feature);
+    }
+}
diff --git a/apps/system/components/kata-os-common/src/camkes/src/lib.rs b/apps/system/components/kata-os-common/src/camkes/src/lib.rs
index 6ef447d..5137d8f 100644
--- a/apps/system/components/kata-os-common/src/camkes/src/lib.rs
+++ b/apps/system/components/kata-os-common/src/camkes/src/lib.rs
@@ -12,6 +12,7 @@ use sel4_sys;
 use sel4_sys::seL4_CNode_Delete;
 use sel4_sys::seL4_CPtr;
 use sel4_sys::seL4_GetCapReceivePath;
+use sel4_sys::seL4_Result;
 use sel4_sys::seL4_SetCap;
 use sel4_sys::seL4_SetCapReceivePath;
 use sel4_sys::seL4_Word;
@@ -173,4 +174,13 @@ impl Camkes {
             "{}: expected cnode in slot {:?} but found cap type {:?}",
             tag, path, sel4_sys::cap_identify(path.1));
     }
+
+    // Dumps the contents of the toplevel CNode to the serial console.
+    pub fn capscan() -> seL4_Result {
+        // TODO(sleffler): requires CONFIG_PRINTING in the kernel
+        #[cfg(feature = "CONFIG_PRINTING")]
+        unsafe { sel4_sys::seL4_DebugDumpCNode(SELF_CNODE); }
+        // XXX until seL4_Error is correctly returned
+        Ok(())
+    }
 }
diff --git a/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch32.rs b/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch32.rs
index ffc336e..bc91f25 100644
--- a/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch32.rs
+++ b/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch32.rs
@@ -990,6 +990,16 @@ pub unsafe fn seL4_DebugCapIdentify(mut cap: seL4_CPtr) -> u32 {
     cap as _
 }
 
+#[cfg(feature = "CONFIG_PRINTING")]
+#[inline(always)]
+pub unsafe fn seL4_DebugDumpCNode(mut cap: seL4_CPtr) {
+    asm!("swi 0",
+        in("r7") swinum!(SyscallId::DebugDumpCNode),
+        inout("r0") cap,
+        options(nomem, nostack),
+    );
+}
+
 // Note: name MUST be NUL-terminated.
 #[cfg(feature = "CONFIG_DEBUG_BUILD")]
 #[inline(always)]
diff --git a/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch64.rs b/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch64.rs
index dc9bda7..552fc38 100644
--- a/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch64.rs
+++ b/apps/system/components/kata-os-common/src/sel4-sys/arch/aarch64.rs
@@ -986,6 +986,16 @@ pub unsafe fn seL4_DebugCapIdentify(mut cap: seL4_CPtr) -> u32 {
     cap as _
 }
 
+#[cfg(feature = "CONFIG_PRINTING")]
+#[inline(always)]
+pub unsafe fn seL4_DebugDumpCNode(mut cap: seL4_CPtr) {
+    asm!("svc 0",
+        in("x7") swinum!(SyscallId::DebugDumpCNode),
+        inout("x0") cap,
+        options(nomem, nostack),
+    );
+}
+
 // Note: name MUST be NUL-terminated.
 #[cfg(feature = "CONFIG_DEBUG_BUILD")]
 #[inline(always)]
diff --git a/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv32.rs b/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv32.rs
index b77e494..4f15148 100644
--- a/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv32.rs
+++ b/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv32.rs
@@ -945,6 +945,16 @@ pub unsafe fn seL4_DebugCapIdentify(mut cap: seL4_CPtr) -> u32 {
     cap as _
 }
 
+#[cfg(feature = "CONFIG_PRINTING")]
+#[inline(always)]
+pub unsafe fn seL4_DebugDumpCNode(mut cap: seL4_CPtr) {
+    asm!("ecall",
+        in("a7") swinum!(SyscallId::DebugDumpCNode),
+        inout("a0") cap,
+        options(nomem, nostack),
+    );
+}
+
 // Note: name MUST be NUL-terminated.
 #[cfg(feature = "CONFIG_DEBUG_BUILD")]
 #[inline(always)]
diff --git a/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv64.rs b/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv64.rs
index 46b4807..609eebb 100644
--- a/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv64.rs
+++ b/apps/system/components/kata-os-common/src/sel4-sys/arch/riscv64.rs
@@ -952,6 +952,16 @@ pub unsafe fn seL4_DebugCapIdentify(mut cap: seL4_CPtr) -> u32 {
     cap as _
 }
 
+#[cfg(feature = "CONFIG_PRINTING")]
+#[inline(always)]
+pub unsafe fn seL4_DebugDumpCNode(mut cap: seL4_CPtr) {
+    asm!("ecall",
+        in("a7") swinum!(SyscallId::DebugDumpCNode),
+        inout("a0") cap,
+        options(nomem, nostack),
+    );
+}
+
 // Note: name MUST be NUL-terminated.
 #[cfg(feature = "CONFIG_DEBUG_BUILD")]
 #[inline(always)]
diff --git a/apps/system/components/kata-os-common/src/sel4-sys/arch/x86.rs b/apps/system/components/kata-os-common/src/sel4-sys/arch/x86.rs
index 087199a..5a3c6bd 100644
--- a/apps/system/components/kata-os-common/src/sel4-sys/arch/x86.rs
+++ b/apps/system/components/kata-os-common/src/sel4-sys/arch/x86.rs
@@ -579,11 +579,21 @@ pub unsafe fn seL4_DebugCapIdentify(mut cap: seL4_CPtr) -> u32 {
     let mut unused0 = 0;
     let mut unused1 = 0;
     let mut unused2 = 0;
-    x86_sys_send_recv(SyscallId::DebugCapIdentify as seL4_Word, 
+    x86_sys_send_recv(SyscallId::DebugCapIdentify as seL4_Word,
                       cap, &mut cap, 0, &mut unused0, &mut unused1, &mut unused2);
     cap as _
 }
 
+#[cfg(feature = "CONFIG_PRINTING")]
+#[inline(always)]
+pub unsafe fn seL4_DebugDumpCNode(mut cap: seL4_CPtr) {
+    let mut unused0 = 0;
+    let mut unused1 = 0;
+    let mut unused2 = 0;
+    x86_sys_send_recv(SyscallId::DebugDumpCNode as seL4_Word,
+                      cap, &mut cap, 0, &mut unused0, &mut unused1, &mut unused2);
+}
+
 /// Note: name MUST be NUL-terminated.
 #[inline(always)]
 pub unsafe fn seL4_DebugNameThread(tcb: seL4_CPtr, name: &[u8]) {
@@ -631,7 +641,7 @@ pub unsafe fn seL4_BenchmarkSetLogBuffer(mut frame_cptr: seL4_Word) -> seL4_Word
     let mut unused0 = 0;
     let mut unused1 = 0;
     let mut unused2 = 0;
-    x86_sys_send_recv(SyscallId::BenchmarkSetLogBuffer as seL4_Word, 
+    x86_sys_send_recv(SyscallId::BenchmarkSetLogBuffer as seL4_Word,
                       frame_cptr, &mut cap, 0, &mut unused0 as *mut _ as usize as seL4_Word, &mut unused1 as *mut _ as usize as seL4_Word, &mut unused2 as *mut _ as usize as seL4_Word);
     frame_cptr
 }
diff --git a/apps/system/components/kata-os-common/src/sel4-sys/arch/x86_64.rs b/apps/system/components/kata-os-common/src/sel4-sys/arch/x86_64.rs
index 0aba694..501053f 100644
--- a/apps/system/components/kata-os-common/src/sel4-sys/arch/x86_64.rs
+++ b/apps/system/components/kata-os-common/src/sel4-sys/arch/x86_64.rs
@@ -1123,6 +1123,21 @@ pub unsafe fn seL4_DebugCapIdentify(mut cap: seL4_CPtr) -> u32 {
     cap as _
 }
 
+#[cfg(feature = "CONFIG_PRINTING")]
+#[inline(always)]
+pub unsafe fn seL4_DebugDumpCNode(mut cap: seL4_CPtr) {
+    asm!("mov r14, rsp
+          syscall
+          mov rsp, r14",
+        in("rdx") swinum!(SyscallId::DebugDumpCNode),
+        inout("rdi") cap,
+        lateout("rcx") _,
+        lateout("r11") _,
+        lateout("r14") _,
+        options(nomem, nostack),
+    );
+}
+
 // Note: name MUST be NUL-terminated.
 #[cfg(feature = "CONFIG_DEBUG_BUILD")]
 #[inline(always)]
diff --git a/apps/system/interfaces/MemoryInterface.camkes b/apps/system/interfaces/MemoryInterface.camkes
index 4d72b8f..029d3ca 100644
--- a/apps/system/interfaces/MemoryInterface.camkes
+++ b/apps/system/interfaces/MemoryInterface.camkes
@@ -5,5 +5,6 @@ procedure MemoryInterface {
   MemoryManagerError free(in char request[]);
   MemoryManagerError stats(out RawMemoryStatsData data);
 
+  void capscan();
   void debug();
 };
diff --git a/apps/system/interfaces/MlCoordinatorInterface.camkes b/apps/system/interfaces/MlCoordinatorInterface.camkes
index d636b89..23d4c40 100644
--- a/apps/system/interfaces/MlCoordinatorInterface.camkes
+++ b/apps/system/interfaces/MlCoordinatorInterface.camkes
@@ -6,4 +6,5 @@ procedure MlCoordinatorInterface {
   MlCoordError cancel(in string bundle_id, in string model_id);
 
   void debug_state();
+  void capscan();
 };
diff --git a/apps/system/interfaces/ProcessControlInterface.camkes b/apps/system/interfaces/ProcessControlInterface.camkes
index 8985e96..526f554 100644
--- a/apps/system/interfaces/ProcessControlInterface.camkes
+++ b/apps/system/interfaces/ProcessControlInterface.camkes
@@ -4,4 +4,7 @@ procedure ProcessControlInterface {
   ProcessManagerError start(in string bundleId);
   ProcessManagerError stop(in string bundleId);
   ProcessManagerError get_running_bundles(out RawBundleIdData raw_data);
+
+  void capscan();
+  ProcessManagerError capscan_bundle(in string bundleId);
 };
diff --git a/apps/system/interfaces/StorageInterface.camkes b/apps/system/interfaces/StorageInterface.camkes
index fd5c470..a378081 100644
--- a/apps/system/interfaces/StorageInterface.camkes
+++ b/apps/system/interfaces/StorageInterface.camkes
@@ -4,4 +4,6 @@ procedure StorageInterface {
   StorageManagerError read(in string key, out KeyValueData value);
   StorageManagerError write(in string key, in char value[]);
   StorageManagerError delete(in string key);
+
+  void capscan();
 };
diff --git a/apps/system/interfaces/TimerServiceInterface.camkes b/apps/system/interfaces/TimerServiceInterface.camkes
index 09cd9a0..a235ffc 100644
--- a/apps/system/interfaces/TimerServiceInterface.camkes
+++ b/apps/system/interfaces/TimerServiceInterface.camkes
@@ -8,4 +8,6 @@ procedure Timer {
     TimerServiceError oneshot(uint32_t timer_id, uint32_t duration_in_ms);
     TimerServiceError periodic(uint32_t timer_id, uint32_t duration_in_ms);
     TimerServiceError cancel(uint32_t timer_id);
+
+    void capscan();
 };