In this article, we will discuss newly trending open sourced Anthropic’s sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash tool. The Anthropic sandbox-runtime limits which files a process can touch and which hosts it can reach. It does this without spinning up a container. It is also not tied to Claude Code. Your own agents, local MCP servers and plain command-line programs can run inside it.
TL;DR
- Size: npm package
@anthropic-ai/sandbox-runtimev0.0.81, about 11.4 MB unpacked, Apache-2.0, Node.js 22.12+. - Runs on: any macOS or Linux dev machine or CI box. macOS uses Seatbelt; Linux needs bubblewrap, socat and ripgrep. Windows is alpha.
- Performance: sandboxing cut Claude Code permission prompts by 84% in Anthropic’s internal usage (self-reported).
- Best: 84% fewer permission prompts, with file and network limits enforced on the whole process tree.
- Worst: still a beta research preview, Windows support is alpha.
What is Anthropic sandbox-runtime?
Anthropic sandbox-runtime is an open-source tool that wraps any process in filesystem and network restrictions. You install it with npm install -g @anthropic-ai/sandbox-runtime, then prefix a command with srt. It works as a CLI and as a TypeScript library.
How does sandbox-runtime work on macOS, Linux and Windows?
srt uses each operating system’s own isolation primitives. Its restrictions cover the entire process tree, including scripts and subprocesses.
- macOS:
sandbox-execwith dynamically generated Seatbelt profiles. Only ripgrep is required. - Linux: bubblewrap with the network namespace removed. It also needs socat and ripgrep.
- Windows (alpha): a dedicated
srt-sandboxaccount, a Windows Filtering Platform egress fence and explicit file ACLs.
Traffic leaves only through HTTP and SOCKS5 proxies running on the host. On Linux, those proxies sit behind Unix sockets bind-mounted into the sandbox. On macOS, the Seatbelt profile allows only one localhost port. The proxies then apply your domain allowlist and denylist.
Why does it need both filesystem and network isolation?
Anthropic team argues that 1 boundary without the other fails. Without network isolation, a prompt-injected agent could exfiltrate SSH keys. Without filesystem isolation, it could escape the sandbox and gain network access.
srt’s defaults follow that logic. Reads are allowed everywhere unless denied. Writes are denied everywhere unless allowed. Network access is denied unless a domain is allowlisted.
How do you sandbox an MCP server or your own agent?
For an MCP server, change the command in .mcp.json from npx to srt. Pass the original command as arguments. Rules then live in ~/.srt-settings.json:
{
"network": { "allowedDomains": ["api.github.com", "*.npmjs.org"], "deniedDomains": [] },
"filesystem": { "denyRead": ["~/.ssh"], "allowWrite": ["."], "denyWrite": [".env"] }
}For your own agent, the library exposes SandboxManager. Call initialize(config) to start the proxies. Then wrapWithSandbox() returns a wrapped command string you can spawn.
What does the 84% figure mean?
Anthropic reports that sandboxing reduced permission prompts by 84% in internal Claude Code usage. That is a self-reported number, not an external benchmark. The target is approval fatigue. Developers who click “approve” all day stop reading what they approve. A fixed boundary lets the agent work freely inside it and ask only at the edge.
The real trade-off: strict allowlists vs working agents
Coding agents do more than edit files. They install dependencies, pull docs and call APIs. Make the allowlist too strict and npm install fails. Make it too loose and the sandbox protects little. srt ships several knobs for that middle ground:
- Wildcards and ports: entries like
*.npmjs.orgorapi.example.com:443. - Ask callback: decides hosts no rule covers, and can return a reason the model reads.
- Per-command allow lists: open a registry for 1 invocation only.
- Live updates:
--control-fdswaps network lists while a command runs. - Resolved-address check: blocks allowed names that resolve to loopback or cloud metadata IPs.
- Denied-domain reasons: tell the agent the sanctioned alternative, such as an HTTPS git remote..
How does it compare with other agent sandboxes?
| Feature | Anthropic sandbox-runtime | OpenAI Codex CLI sandbox | Docker Sandboxes | E2B |
|---|---|---|---|---|
| Isolation | OS primitives: Seatbelt, bubblewrap, Windows account + WFP | OS primitives: Seatbelt, bubblewrap, native Windows sandbox | microVM per sandbox | Firecracker microVM per session |
| Where it runs | Local machine | Local machine | Local machine | Cloud or BYOC (AWS, GCP) |
| Container or VM needed | No | No | Yes (microVM) | Yes (managed microVM) |
| Use outside its own agent | Yes, CLI + library for any process | Built into Codex | Yes, sbx CLI for coding agents | Yes, JS and Python SDKs |
| Network default | Deny all; proxy allowlist | Off in workspace-write; config toggle | Policy picked at first start (e.g. deny-all, balanced) | On by default; can be disabled |
| Domain allowlist | Yes, wildcards + ports | Not disclosed (on/off toggle documented) | Yes, wildcards + ports | Yes, allowOut with wildcards (SNI/Host based) |
| License | Apache-2.0 | Apache-2.0 | Not disclosed | Apache-2.0 (SDK) |
| Status | Beta research preview; Windows alpha | Ships in Codex CLI | Shipping product | Shipping product |
Key Takeaways
- srt sandboxes any process at the OS level, no container needed.
- Seatbelt on macOS, bubblewrap on Linux, Windows in alpha.
- Network is deny-by-default; every connection passes a host-side allowlist proxy.
- Anthropic reports 84% fewer Claude Code permission prompts (internal).
- Allowlist breadth is the real security dial; broad domains can leak data.
Check out the GitHub repo, the Anthropic engineering post and the Claude Code sandboxing docs. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
The post Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers appeared first on MarkTechPost.