# Anthropic Sandbox Runtime (srt)

> Lightweight OS-level sandbox enforcing filesystem and network restrictions on agents, MCP servers and arbitrary processes, without a container.

- id: `sandbox-runtime`
- category: Infrastructure (`infrastructure`)
- url: https://github.com/anthropics/sandbox-runtime
- repo: https://github.com/anthropics/sandbox-runtime
- status: beta
- pricing: open-source
- license: Apache-2.0
- tags: sandbox, security, network-filtering, cli, local
- related: Claude Code (https://indexagentica.com/entries/claude-code/); microsandbox (https://indexagentica.com/entries/microsandbox/)
- sources: https://github.com/anthropics/sandbox-runtime
- added: 2026-10-12
- updated: 2026-10-20
- last verified: 2026-10-20
- featured in: Self-hosted sandboxes for agents compared (https://indexagentica.com/compare/self-hosted-agent-sandboxes/)
- maintainer: Anthropic
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/sandbox-runtime/
- json: https://indexagentica.com/api/entries/sandbox-runtime.json

Uses native OS primitives (`sandbox-exec` on macOS, `bubblewrap` with the network namespace removed on Linux, and on Windows a dedicated `srt-sandbox` user account with a Windows Filtering Platform egress fence) plus host-side HTTP and SOCKS5 proxies that enforce domain allow and deny lists. Defaults: network and writes are denied until allowed (`allowedDomains`, `allowWrite`), but reads are allowed everywhere unless you add `denyRead` paths. A beta research preview developed for Claude Code; install with `npm install -g @anthropic-ai/sandbox-runtime` and run `srt "<command>"`, or wrap local MCP servers in `.mcp.json`.