Overview
sandbox-runtime is Anthropic open source process sandbox, kept at anthropics/sandbox-runtime, published as @anthropic-ai/sandbox-runtime on npm with a command line tool called srt. What it does is plain: no container, just the isolation primitives the operating system already has, applied to put file and network access for any process inside an allowlist. The sandbox that runs bash commands inside Claude Code sits on top of it.
The design is secure by default. Reads are open unless a path is denied; writes are limited to the current working directory with everything else added explicitly. Network access is off completely, and all traffic must pass through proxies on the host, HTTP and HTTPS through an HTTP proxy and other TCP through SOCKS5, where domain allow and deny lists are enforced. Linux uses bubblewrap with a network namespace, macOS uses sandbox-exec with a generated Seatbelt profile, and Windows, still in alpha, runs the process under a dedicated local account behind a Windows Filtering Platform egress fence.
On October 24, 2026, MarkTechPost reported the npm package at v0.0.81 under Apache-2.0, which turns it from an internal Claude Code component into a tool anyone can use on its own. Beyond wrapping bash commands, its most practical use is wrapping local MCP servers: prefix the launch command in .mcp.json with srt and that server can only touch the directories and domains you set. Anthropic labels it a Beta Research Preview, so APIs and configuration formats may still change.
Key Features
- OS level isolation without containers: It uses native sandbox primitives rather than Docker or a virtual machine, so startup cost is near zero and restrictions apply to the entire process tree, child processes included.
- Read and write allowlists: Reads are allowed by default, and a broad region can be denied with specific paths re-allowed inside it, such as denying the home directory while permitting the current project. Writes start at the working directory, with other paths added explicitly and single files denied inside allowed paths.
- All network off, proxies gate access: Networking is cut entirely, and on Linux the network namespace is removed so traffic has to use host proxies. HTTP and HTTPS go through an HTTP proxy, other TCP through SOCKS5, and allow and deny lists are resolved at that layer.
- Wrap an MCP server: Prefixing the launch command in .mcp.json with srt limits which directories a local MCP server can touch and which domains it can reach, giving a backstop even when third-party server code has not been audited.
- Unix sockets and violation monitoring: Access to local IPC sockets can be restricted, closing routes like docker.sock that would otherwise escape the boundary. On macOS it can tap the system sandbox violation log for real-time alerts.
- CLI and library: The srt command wraps any executable and reads ~/.srt-settings.json by default or a path you pass. For integration, import SandboxManager, initialize with a config, wrap the command and spawn it, then reset on exit to clean up proxies.
Use Cases
- Let a coding agent run commands freely in a repository while keeping keys and credentials in the home directory out of read scope.
- Add a boundary around third-party local MCP servers, limiting the directories they reach and the domains they call.
- Run untrusted scripts or dependency installs in CI with a network allowlist narrowed to package mirrors and internal services.
- Use it as a light substitute for containers on development machines that cannot run Docker.
- Reproduce a suspicious command during security review with writes confined to a temp directory and one domain reachable.
- Tap violation logs on macOS to observe which paths a given agent behaviour actually tries to touch.
Pros
- No container dependency, fast startup, and it runs on both developer machines and CI.
- File and network isolation apply together from a single JSON configuration.
- Network defaults to fully closed with allowlist-only egress, the most useful property for agent work.
- It works as a CLI wrapper and as a library inside your own agent runtime.
- One prefix in .mcp.json puts a local MCP server behind the boundary.
- Apache-2.0 licensing means the boundary logic can be read, changed and verified.
Pricing
sandbox-runtime is open source under Apache-2.0 and free to use, installed with npm install -g @anthropic-ai/sandbox-runtime. Running it costs only local resources; paired with Claude Code or the Anthropic API, model calls are billed under those subscriptions and usage terms separately. The project is marked Beta Research Preview, so APIs and configuration formats may change, and pinning a version before production rollout is worth the effort.
Summary
sandbox-runtime extracts the most practical layer of agent safety: rather than asking a model not to misbehave, it fixes which directories can be read and which domains reached at the operating system level. No container, one command to wrap anything, and local MCP servers can be locked down in the same move. For teams running coding agents, it is a route from permission prompts to structural limits. It remains a research preview with a shifting config format, so pinning versions and writing minimal allowlists matter more than the feature list.
Version History
- Anthropic open sources sandbox-runtime, npm package v0.0.81 under Apache-2.0 (2026-10-24): Anthropic sandbox-runtime (srt) is available under Apache-2.0 with the npm package @anthropic-ai/sandbox-runtime at v0.0.81. It is the OS level sandbox behind the Claude Code sandboxed bash tool, using native primitives such as macOS Seatbelt and Linux bubblewrap to restrict file and network access for arbitrary processes without a container. Network access is closed by default and traffic must pass host HTTP and SOCKS5 proxies that enforce domain allowlists, while Windows alpha support runs under a dedicated local account with a filtering platform fence. The project remains a Beta Research Preview.