Anthropic Sandbox Runtime (srt)
Lightweight OS-level sandbox enforcing filesystem and network restrictions on agents, MCP servers and arbitrary processes, without a container.
Tags
Description
Uses native OS primitives (sandbox-exec on macOS, bubblewrap with the network namespace removed on Linux, and on Windows a dedicated srt-sandbox user account with a Windows Filtering Platform egress fence) plus host-side HTTP and SOCKS5 proxies that enforce domain allow and deny lists. Defaults: network and writes are denied until allowed (allowedDomains, allowWrite), but reads are allowed everywhere unless you add denyRead paths. A beta research preview developed for Claude Code; install with npm install -g @anthropic-ai/sandbox-runtime and run srt "<command>", or wrap local MCP servers in .mcp.json.
Related
- Claude Code: Anthropic's agentic coding tool that reads your codebase, edits files, runs commands and integrates with dev tools; available in terminal, IDE, desktop and browser.
- microsandbox: Easy, fast, programmable, local-first microVM runtime for untrusted workloads.
Guides & comparisons
- Self-hosted sandboxes for agents compared (Comparison): Six ways to isolate agent-run code on hardware you control (OpenSandbox, AIO Sandbox, microsandbox, Kubernetes Agent Sandbox, Anthropic's sandbox-runtime and Docker Sandboxes' local mode) compared on isolation, where they run, agent interface, network and secret controls, maturity and license.
Sources
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)