Anthropic open-sources sandbox-runtime for agents, no containers needed

What was released?

Anthropic has open-sourced sandbox-runtime (srt), the OS-level sandbox behind Claude Code's sandboxed bash tool. The tool limits which files a process can touch and which hosts it can reach without spinning up a container. It is not tied to Claude Code: your own agents, local MCP servers and plain command-line programs can run inside it.

How it works

srt uses each operating system's own isolation primitives, and its restrictions cover the entire process tree, including subprocesses:

• macOS: sandbox-exec with dynamically generated Seatbelt profiles.
• Linux: bubblewrap with the network namespace removed; socat and ripgrep are also required.
• Windows: alpha stage, using a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and file ACLs.

Network traffic leaves only through HTTP and SOCKS5 proxies running on the host, which apply domain allowlists and denylists.

Defaults and usage

The defaults are: reads allowed everywhere unless denied, writes denied everywhere unless allowed, and network access denied unless a domain is allowlisted. Installation is via npm install -g @anthropic-ai/sandbox-runtime, and prefixing a command with srt is enough. Rules live in ~/.srt-settings.json. For an MCP server, change the command in .mcp.json from npx to srt. For your own agent, the TypeScript library exposes SandboxManager.

Limitations

Anthropic reports that sandboxing cut permission prompts in Claude Code by 84% in its internal usage; this is a self-reported figure, not an external benchmark. The package is still a beta research preview, and Windows support is alpha.