diff --git a/virtualization/capabilities_service/default/Android.bp b/virtualization/capabilities_service/default/Android.bp
new file mode 100644
index 0000000..08f9136
--- /dev/null
+++ b/virtualization/capabilities_service/default/Android.bp
@@ -0,0 +1,35 @@
+package {
+    default_team: "trendy_team_virtualization",
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+rust_binary {
+    name: "android.hardware.virtualization.capabilities.capabilities_service-default",
+    relative_install_path: "hw",
+    vendor: true,
+    installable: true,
+    prefer_rlib: true,
+    rustlibs: [
+        "android.hardware.virtualization.capabilities.capabilities_service-V1-rust",
+        "libanyhow",
+        "libandroid_logger",
+        "libbinder_rs",
+        "liblog_rust",
+        "liblibc",
+    ],
+    srcs: [
+        "src/main.rs",
+    ],
+    init_rc: [
+        "android.hardware.virtualization.capabilities.vm_capabilities_service.rc",
+    ],
+    vintf_fragment_modules: [
+        "android.hardware.virtualization.capabilities.vm_capabilities_service.xml",
+    ],
+}
+
+vintf_fragment {
+    name: "android.hardware.virtualization.capabilities.vm_capabilities_service.xml",
+    src: "android.hardware.virtualization.capabilities.vm_capabilities_service.xml",
+    vendor: true,
+}
diff --git a/virtualization/capabilities_service/default/android.hardware.virtualization.capabilities.vm_capabilities_service.rc b/virtualization/capabilities_service/default/android.hardware.virtualization.capabilities.vm_capabilities_service.rc
new file mode 100644
index 0000000..854e34f
--- /dev/null
+++ b/virtualization/capabilities_service/default/android.hardware.virtualization.capabilities.vm_capabilities_service.rc
@@ -0,0 +1,6 @@
+service vendor.vm_capabilities_service /vendor/bin/hw/android.hardware.virtualization.capabilities.capabilities_service-default
+  interface aidl android.hardware.virtualization.capabilities.IVmCapabilitiesService/default
+  class hal
+  # This HAL needs to talk to a kernel driver, hence it runs as root
+  user root
+  group root
diff --git a/virtualization/capabilities_service/default/android.hardware.virtualization.capabilities.vm_capabilities_service.xml b/virtualization/capabilities_service/default/android.hardware.virtualization.capabilities.vm_capabilities_service.xml
new file mode 100644
index 0000000..f02469c
--- /dev/null
+++ b/virtualization/capabilities_service/default/android.hardware.virtualization.capabilities.vm_capabilities_service.xml
@@ -0,0 +1,10 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.virtualization.capabilities</name>
+        <version>1</version>
+        <interface>
+            <name>IVmCapabilitiesService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/virtualization/capabilities_service/default/src/aidl.rs b/virtualization/capabilities_service/default/src/aidl.rs
new file mode 100644
index 0000000..d70b57b
--- /dev/null
+++ b/virtualization/capabilities_service/default/src/aidl.rs
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! Default implementation of the IVmCapabilitiesService AIDL interface.
+
+use android_hardware_virtualization_capabilities_capabilities_service::aidl::android::hardware::virtualization::capabilities::IVmCapabilitiesService::IVmCapabilitiesService;
+use binder::{Interface, ParcelFileDescriptor};
+use log::info;
+
+/// Default implementation of IVmCapabilitiesService
+pub struct VmCapabilitiesService {}
+
+impl VmCapabilitiesService {
+    pub fn init() -> VmCapabilitiesService {
+        let service = VmCapabilitiesService {};
+        service
+    }
+}
+
+impl Interface for VmCapabilitiesService {}
+
+impl IVmCapabilitiesService for VmCapabilitiesService {
+
+    fn grantAccessToVendorTeeServices(&self, vm_fd: &ParcelFileDescriptor, tee_services: &[String]) -> binder::Result<()> {
+        info!("received {vm_fd:?} {tee_services:?}");
+        // TODO(b/360102915): implement
+        Ok(())
+    }
+}
diff --git a/virtualization/capabilities_service/default/src/main.rs b/virtualization/capabilities_service/default/src/main.rs
new file mode 100644
index 0000000..bede4e3
--- /dev/null
+++ b/virtualization/capabilities_service/default/src/main.rs
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! Default implementation of the IVmCapabilitiesService.
+
+mod aidl;
+
+use crate::aidl::VmCapabilitiesService;
+use anyhow::{bail, Context, Result};
+use log::{error, info, LevelFilter};
+use binder::{register_lazy_service, BinderFeatures, ProcessState};
+use android_hardware_virtualization_capabilities_capabilities_service::aidl::android::hardware::virtualization::capabilities::IVmCapabilitiesService::BnVmCapabilitiesService;
+
+const SERVICE_NAME: &str = "android.hardware.virtualization.capabilities.IVmCapabilitiesService/default";
+
+fn try_main() -> Result<()> {
+    // Initialize Android logging.
+    android_logger::init_once(
+        android_logger::Config::default()
+            .with_tag("IVmCapabilitiesService")
+            .with_max_level(LevelFilter::Info)
+            .with_log_buffer(android_logger::LogId::System),
+    );
+
+    ProcessState::start_thread_pool();
+    let service_impl = VmCapabilitiesService::init();
+    let service = BnVmCapabilitiesService::new_binder(service_impl, BinderFeatures::default());
+    register_lazy_service(SERVICE_NAME, service.as_binder())
+        .with_context(|| format!("failed to register {SERVICE_NAME}"))?;
+    info!("Registered Binder service, joining threadpool.");
+    ProcessState::join_thread_pool();
+    bail!("thread pool unexpectedly ended");
+}
+
+fn main() {
+    if let Err(e) = try_main() {
+        error!("failed with {e:?}");
+        std::process::exit(1);
+    }
+}