Anthropic has released sandbox-runtime as open source, the OS-level sandbox behind the sandboxed bash tool in Claude Code. Its purpose is to limit which files a process can touch and which hosts it can reach, without starting a container. It is not tied to Claude Code: your own agents, local MCP servers and plain command-line programs can run inside it.
The npm package @anthropic-ai/sandbox-runtime, at version v0.0.81, weighs about 11.4 MB, is released under Apache-2.0 and requires Node.js 22.12 or later. It installs with npm install -g @anthropic-ai/sandbox-runtime and is used by prefixing a command with srt. It works as a command-line tool and as a TypeScript library. On macOS it uses Seatbelt, the system's native sandboxing mechanism, with dynamically generated profiles; on Linux it requires bubblewrap, socat and ripgrep, and removes the network namespace. Windows support is still alpha and relies on a dedicated account, a Windows Filtering Platform egress fence and explicit file ACLs.
Image: news.hada.io — https://news.hada.io/topic?id=25751
Traffic leaves only through HTTP and SOCKS5 proxies running on the host. On Linux these proxies sit behind Unix sockets bind-mounted into the sandbox; on macOS the Seatbelt profile allows a single localhost port. The proxies then apply the domain allowlist and denylist.
Anthropic argues that the two isolation layers must work together. Without network isolation, a prompt-injected agent could exfiltrate SSH keys; without filesystem isolation, it could escape the sandbox and gain network access. This is why the defaults are restrictive: reads are allowed everywhere unless denied, writes are denied unless allowed, and network access is denied unless a domain is allowlisted.
To sandbox an MCP server, the command in .mcp.json changes from npx to srt, with the original command passed as arguments. Rules live in ~/.srt-settings.json, where you set allowed domains, denied read paths, writable folders and protected files. For your own agent, the library exposes SandboxManager: call initialize(config) to start the proxies, then wrapWithSandbox() returns a command string to spawn.
The most cited figure is an 84% drop in permission prompts in Claude Code, from Anthropic's internal usage. It is self-reported, not an external benchmark, and the stated goal is to fight approval fatigue: developers who click "approve" all day stop reading what they approve. A fixed boundary lets the agent work freely inside it and ask only at the edge.
Image: jsdelivr.com — https://www.jsdelivr.com/package/npm/@anthropic-ai/sandbox-runtime
The real trade-off lies in how broad the lists are. Coding agents install dependencies, fetch docs and call APIs: too strict a list and npm install fails, too loose and the sandbox protects little. The tool offers several knobs for that balance, including domain wildcards, an ask callback for hosts no rule covers and per-command temporary permissions. Compared with other approaches, Docker Sandboxes and Perplexity's SPACE use microVMs such as Firecracker, while sandbox-runtime stays on the local machine without virtualization.
The project is still a beta research preview, and Windows support is alpha.
No comments yet. Be the first!