Anthropic’s open-source sandbox-runtime, the tool behind Claude Code’s sandboxed bash execution, lets developers restrict the files and network destinations available to a process without starting a container, according to an October 24 MarkTechPost report. The tool also supports other agents, local MCP servers and ordinary command-line programs.
Known as srt, the runtime is available as a command-line tool and a TypeScript library. The report describes it as a beta research preview, with Windows support in alpha. It identifies the npm package @anthropic-ai/sandbox-runtime as version v0.0.81, licensed under Apache-2.0 and requiring Node.js 22.12+.
Restrictions extend to subprocesses
The runtime uses operating-system isolation mechanisms to apply filesystem and network rules across a process tree, including scripts and subprocesses, the report says.
On macOS, it uses sandbox-exec with dynamically generated Seatbelt profiles and requires ripgrep. On Linux, it uses bubblewrap with the network namespace removed and requires socat and ripgrep. The alpha Windows implementation uses a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and explicit file ACLs.
The default filesystem policy permits reads unless a path is explicitly denied, while writes are blocked unless allowed. Network access is denied unless a domain is allowlisted. Those defaults make configuration consequential: a sensitive directory needs an explicit read restriction to be covered by that policy.
According to the report, network traffic passes through HTTP and SOCKS5 proxies on the host, which enforce domain allowlists and denylists. Linux connects to those proxies through Unix sockets bind-mounted into the sandbox; the macOS Seatbelt profile permits only one localhost port.
The report attributes the combined approach to Anthropic’s view that filesystem and network controls need to work together. Network access could otherwise let a prompt-injected agent transmit SSH keys, while insufficient filesystem restrictions could let it escape the sandbox and obtain network access.
Fewer approvals, with security dependent on configuration
Anthropic reports that sandboxing reduced permission prompts by 84% in its internal Claude Code usage. That is a company-reported result, not an independent benchmark or a measured reduction in security incidents. The intended benefit is to reduce repeated approval requests while letting an agent operate within predefined limits.
Developers can install the package with npm install -g @anthropic-ai/sandbox-runtime and prefix commands with srt. For MCP servers, the report describes replacing npx with srt in the .mcp.json command field and passing the original command as arguments. Rules are stored in ~/.srt-settings.json.
The reported network controls include wildcard domains and ports, per-command allowlists, a callback for destinations without a matching rule, and live list changes through --control-fd. A resolved-address check blocks allowlisted names that resolve to loopback or cloud metadata IP addresses.
The practical trade-off is how much access a workload needs. Agents may require registries, documentation sites and APIs to complete tasks. Narrow rules can interrupt that work, while broad domain permissions can leave routes for data leakage. The runtime provides controls for defining that boundary; its beta status and alpha Windows support remain material deployment limitations.
