- Home
- Sandbox Software
- Anthropic Sandbox Runtime
Anthropic Sandbox Runtime
What it is
Anthropic Sandbox Runtime (srt) is an open-source research preview for applying filesystem and network restrictions to processes at the operating-system level, without requiring a container. It can be used as a command-line tool or library to sandbox agents, local MCP servers, bash commands, and other processes. Filesystem writes are blocked by default unless paths are explicitly allowed. Network access is also denied by default, with options to permit or deny domains; HTTP, HTTPS, and other TCP traffic are mediated by proxies. The project documents macOS, Linux, and Windows support, using sandbox-exec, bubblewrap, and a dedicated local sandbox account with Windows Filtering Platform and filesystem ACLs, respectively. Installation uses `npm install -g @anthropic-ai/sandbox-runtime`. Linux requires bubblewrap, socat, and ripgrep; macOS requires ripgrep; and Windows needs a one-time elevated setup step and is marked alpha. The project cautions that its APIs and configuration formats may change as this early preview develops.
For and against
For
- Free open-source release under Apache-2.0.
- Available as a CLI tool and library.
- Filesystem writes and network access are denied by default.
- Documents support for macOS, Linux, and Windows.
- Can sandbox agents and local MCP servers.
Against
- APIs and configuration formats may evolve.
- Linux requires bubblewrap, socat, and ripgrep.
- Windows is marked alpha and needs elevated setup.
- Linux network filtering relies on proxy environment variables.
The verdict
Srt offers configurable filesystem and network restrictions for processes across three documented operating systems. Its research-preview status and platform-specific dependencies and limitations are important considerations.
Who it suits
Srt may suit developers and teams seeking OS-level restrictions for agents, MCP servers, commands, or other processes. It is an early preview, so users should be comfortable with evolving APIs and setup requirements that differ by operating system.
Plans and prices
Anthropic Sandbox Runtime
Open source research preview · no paid plans or usage limits stated
Read 5 Oct 2026 · github.com
On the record
- Availability
- The project is an open source research preview licensed under Apache-2.0.github.com · read 5 Oct 2026
- Filesystem controls
- Filesystem configuration supports read and write restrictions, with writes denied by default unless paths are explicitly allowed.github.com · read 5 Oct 2026
- How to install
- The README gives `npm install -g @anthropic-ai/sandbox-runtime` as the installation command.github.com · read 5 Oct 2026
- Integrations
- The README shows using srt to sandbox Model Context Protocol servers and documents a Java agent for JVM tools on macOS and Linux.github.com · read 5 Oct 2026
- Intended users
- Anthropic describes the release as an early open source preview for the broader ecosystem to build more secure agentic systems; APIs and configuration formats may evolve.github.com · read 5 Oct 2026
- Interfaces
- It is available as both a command-line tool and a library, installed from npm as @anthropic-ai/sandbox-runtime.github.com · read 5 Oct 2026
- Linux dependency
- Linux requires bubblewrap, socat, and ripgrep; macOS requires ripgrep.github.com · read 5 Oct 2026
- Linux limitation
- Linux network filtering relies on proxy environment variables, so programs that ignore them may be unable to connect to the internet.github.com · read 5 Oct 2026
- Linux requirements
- Linux requires bubblewrap, socat, and ripgrep, and some configurations also require additional system setup.github.com · read 5 Oct 2026
- Maker
- Anthropic describes itself as an AI safety and research company that builds reliable, interpretable, and steerable AI systems.anthropic.com · read 5 Oct 2026
- Monitoring
- The runtime tracks sandbox violations, and on macOS it can tap into the system sandbox violation log store for real-time alerts.github.com · read 5 Oct 2026
- Network controls
- Network access is denied by default and can be restricted with allowed and denied domain lists; HTTP, HTTPS, and other TCP traffic are mediated by proxies.github.com · read 5 Oct 2026
- Operating systems
- The project documents macOS, Linux, and Windows support; Windows is marked alpha.github.com · read 5 Oct 2026
- Platform implementation
- It uses sandbox-exec on macOS, bubblewrap on Linux, and a dedicated local user account with Windows Filtering Platform and filesystem ACLs on Windows.github.com · read 5 Oct 2026
- Platform mechanisms
- The README says macOS uses sandbox-exec, Linux uses bubblewrap, and Windows uses a dedicated local sandbox account with Windows Filtering Platform egress filtering.github.com · read 5 Oct 2026
- Preview status
- The README describes the runtime as an early research preview developed for Claude Code and warns that APIs and configuration formats may evolve.github.com · read 5 Oct 2026
- Purpose
- Anthropic Sandbox Runtime (srt) enforces filesystem and network restrictions on arbitrary processes at the OS level without requiring a container.github.com · read 5 Oct 2026
- Security caveat
- The project warns that enabling weaker nested sandboxing on Linux considerably weakens security and should be used only with additional isolation.github.com · read 5 Oct 2026
