Anthropic open-sources sandbox-runtime: agent sandboxing without containers

What it's about

Anthropic has open-sourced sandbox-runtime (short name srt), the sandbox behind Claude Code's sandboxed Bash tool. It limits which files a process can touch and which hosts it can reach over the network. It doesn't need a container. It's also not tied to Claude Code: you can run your own agents, local MCP servers (interfaces that AI agents use to talk to external tools) and ordinary command-line programs inside it.

Install it with npm install -g @anthropic-ai/sandbox-runtime. Then just put srt in front of a command. According to the source, the package is about 11.4 MB, is licensed under Apache-2.0 and requires Node.js 22.12 or newer. The current version is 0.0.81, and the status is beta research preview.

How the sandbox works

srt uses the isolation features of each operating system. The restrictions apply to the entire process tree, including scripts and child processes.

• macOS: sandbox-exec with dynamically generated Seatbelt profiles (system rule sets that allow or deny access). Only ripgrep is required.
• Linux: bubblewrap, with the network namespace removed, so the process has no direct route to the network. socat and ripgrep are also required. According to the source, Ubuntu 24.04+ needs an AppArmor change for user namespaces.
• Windows (alpha): a dedicated account called srt-sandbox, an egress filter built on the Windows Filtering Platform, and explicit file ACLs. Setup needs elevated privileges once.

Network traffic leaves the sandbox only through HTTP and SOCKS5 proxies running on the host. On Linux, these are bridged into the sandbox via Unix sockets. On macOS, the profile allows only a single localhost port. The proxies then apply your domain allowlist and denylist.

Why filesystem and network isolation go together

The Anthropic team argues that one boundary fails without the other. Without network isolation, an agent hijacked by prompt injection (instructions smuggled into text the agent reads) could send SSH keys out. Without filesystem isolation, it could break out of the sandbox and gain network access.

The defaults follow this logic:

Configuration for MCP servers and custom agents

For an MCP server, replace the npx command in .mcp.json with srt and pass the original command as arguments. The rules live in ~/.srt-settings.json, for example:

{
  "network": {
    "allowedDomains": ["api.github.com", "*.npmjs.org"],
    "deniedDomains": []
  },
  "filesystem": {
    "denyRead": ["~/.ssh"],
    "allowWrite": ["."],
    "denyWrite": [".env"]
  }
}

For custom agents, there's a library with SandboxManager. initialize(config) starts the proxies, and wrapWithSandbox() returns a wrapped command string that you then run.

The trade-off: strict lists versus agents that can actually work

Coding agents install dependencies, fetch documentation and call APIs. If the list is too strict, even npm install fails. If it's too loose, the sandbox protects little. There are several levers for this:

• Wildcards and ports, such as *.npmjs.org or api.example.com:443.
• An ask callback that decides on hosts no rule covers and can return a reason to the model.
• Per-command allowlists that open a registry for a single call only.
• Live updates to the network lists via --control-fd while a command is running.
• A resolved-address check that blocks allowed names if they point to loopback or cloud metadata IPs.
• Explanations for blocked domains that point the agent to an allowed alternative, such as an HTTPS Git remote.

The 84 percent figure

Anthropic says the sandbox reduced permission prompts in internal Claude Code use by 84 percent. That's a self-reported number, not an external benchmark. The problem it targets is approval fatigue: if you click "Allow" all day, you eventually stop reading what you're approving. With a fixed boundary, the agent can work freely inside it and only asks at the edge.

Comparison with other agent sandboxes

Our take

srt is interesting if you run agents or MCP servers locally and want neither Docker nor a VM. The idea of "blocked by default, open up selectively" is sound from a security standpoint. One caveat remains: according to the source, the breadth of your allowlist is the real security dial, and overly broad domains can let data slip through. The project is still in beta, Windows is only alpha, and the 84 percent figure comes from Anthropic itself. The comparison with competitors comes from the source article and hasn't been independently verified.