Skip to content
SPECIFICTION
Get listed

Anthropic Sandbox Runtime

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 9.0 #5 of 26 in Sandbox Software

What it is

Anthropic Sandbox Runtime (srt) is a free, open-source research preview that applies filesystem and network restrictions to processes at the operating-system level, without requiring a container. It can be used as a CLI tool or library to sandbox agents, local MCP servers, bash commands and other processes. Filesystem writes and network access are denied by default, with configuration options to allow paths and domains. The project documents macOS, Linux and Windows support, using sandbox-exec, bubblewrap or a dedicated local sandbox account with Windows Filtering Platform and filesystem ACLs, respectively. Windows is marked alpha. Install it from npm with `npm install -g @anthropic-ai/sandbox-runtime`. Linux requires bubblewrap, socat and ripgrep; macOS requires ripgrep, and Windows needs a one-time elevated setup step. On macOS, srt can provide real-time alerts from the system sandbox violation log. Linux bubblewrap has no built-in violation reporting, and Linux network filtering relies on proxy environment variables, which some programs may ignore. The preview is developed for Claude Code; its APIs and configuration formats may evolve.

Spec sheet

Purpose
Anthropic Sandbox Runtime (srt) enforces filesystem and network restrictions on arbitrary processes at the OS level without requiring a container.Read 5 Oct 2026 · github.com
Intended users
Anthropic describes the release as an early open source preview for the broader ecosystem to build more secure agentic systems; APIs and configuration formats may evolve.Read 5 Oct 2026 · github.com
Platforms
The project supports macOS and Linux, and lists Windows support as alpha.Read 5 Oct 2026 · github.com
Integrations
The README shows using srt to sandbox Model Context Protocol servers and documents a Java agent for JVM tools on macOS and Linux.Read 5 Oct 2026 · github.com
Maker
Anthropic describes itself as an AI safety and research company that builds reliable, interpretable, and steerable AI systems.Read 5 Oct 2026 · anthropic.com
Availability
The project is an open source research preview licensed under Apache-2.0.Read 5 Oct 2026 · github.com
Filesystem controls
Filesystem configuration supports read and write restrictions, with writes denied by default unless paths are explicitly allowed.Read 5 Oct 2026 · github.com
How to install
The README gives `npm install -g @anthropic-ai/sandbox-runtime` as the installation command.Read 5 Oct 2026 · github.com
Interfaces
It is available as both a command-line tool and a library, installed from npm as @anthropic-ai/sandbox-runtime.Read 5 Oct 2026 · github.com
Linux dependency
Linux requires bubblewrap, socat, and ripgrep; macOS requires ripgrep.Read 5 Oct 2026 · github.com
Linux limitation
Linux network filtering relies on proxy environment variables, so programs that ignore them may be unable to connect to the internet.Read 5 Oct 2026 · github.com
Linux requirements
Linux requires bubblewrap, socat, and ripgrep, and some configurations also require additional system setup.Read 5 Oct 2026 · github.com
Monitoring
The runtime tracks sandbox violations, and on macOS it can tap into the system sandbox violation log store for real-time alerts.Read 5 Oct 2026 · github.com
Network controls
Network access is denied by default and can be restricted with allowed and denied domain lists; HTTP, HTTPS, and other TCP traffic are mediated by proxies.Read 5 Oct 2026 · github.com
Operating systems
The project documents macOS, Linux, and Windows support; Windows is marked alpha.Read 5 Oct 2026 · github.com
Platform implementation
It uses sandbox-exec on macOS, bubblewrap on Linux, and a dedicated local user account with Windows Filtering Platform and filesystem ACLs on Windows.Read 5 Oct 2026 · github.com
Platform mechanisms
The README says macOS uses sandbox-exec, Linux uses bubblewrap, and Windows uses a dedicated local sandbox account with Windows Filtering Platform egress filtering.Read 5 Oct 2026 · github.com
Preview status
The README describes the runtime as an early research preview developed for Claude Code and warns that APIs and configuration formats may evolve.Read 5 Oct 2026 · github.com
Security caveat
The project warns that enabling weaker nested sandboxing on Linux considerably weakens security and should be used only with additional isolation.Read 5 Oct 2026 · github.com
Security limitation
The README says network filtering restricts reachable domains but does not otherwise inspect traffic through the proxy, so users are responsible for allowing only trusted domains.Read 5 Oct 2026 · github.com
Use cases
The README says srt can sandbox agents, local MCP servers, bash commands, and arbitrary processes, and can be used as a CLI tool or library.Read 5 Oct 2026 · github.com
Violation monitoring
On macOS, srt can tap the system sandbox violation log store for real-time alerts; Linux bubblewrap does not provide built-in violation reporting.Read 5 Oct 2026 · github.com
Windows limitation
On Windows, tools using schannel with certificate revocation checking enabled by default can fail because revocation requests are blocked by the egress fence.Read 5 Oct 2026 · github.com
Windows limitations
On Windows, per-user tool installations may not be accessible to the sandbox account, and some schannel clients can fail when certificate revocation checks are enabled.Read 5 Oct 2026 · github.com
Windows setup
Windows requires a one-time elevated `windows-install` step, while the helper executable is bundled with the npm package.Read 5 Oct 2026 · github.com

Plans and prices

Anthropic Sandbox Runtime Free Open source research preview · no paid plans or usage limits stated Read 5 Oct 2026 · github.com

Every Anthropic Sandbox Runtime plan and price →

Strong points and limits

Strong points

  • Filesystem writes denied by default
  • Network access denied by default
  • Available as CLI tool and library
  • Documents macOS, Linux and Windows support
  • Apache-2.0 open-source research preview

Limits

  • Windows support is marked alpha
  • Linux requires bubblewrap, socat and ripgrep
  • Linux bubblewrap lacks built-in violation reporting
  • APIs and configuration formats may evolve

Who it suits

It suits developers who want to apply operating-system-level restrictions to agents, MCP servers, commands or other processes. Users should be prepared to configure platform-specific dependencies and account for the preview status.

Verdict

Srt offers configurable process restrictions without requiring a container, but its setup and limitations vary by operating system. It is a research preview whose interfaces may change.

Where Specifiction places it

Alternatives to Anthropic Sandbox RuntimeAll alternatives →

E2B From $150/mo · Free plan 9.1 Visit