Meet Anthropic's sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers

In this article, we take a closer look at Anthropic's newly trending open-source project, sandbox-runtime (srt) — the OS-level sandbox that powers Claude Code's sandboxed bash tool. The runtime restricts which files a process can touch and which hosts it can reach, without spinning up a container. It is also not tied to Claude Code: your own agents, local MCP servers, and plain command-line programs can all run inside it.

TL;DR

• Size: The npm package @anthropic-ai/sandbox-runtime is at v0.0.81, about 11.4 MB unpacked, licensed under Apache-2.0, and requires Node.js 22.12+.
• Runs on: Any macOS or Linux dev machine or CI box. macOS uses Seatbelt; Linux requires bubblewrap, socat, and ripgrep. Windows support is in alpha.
• Performance: Sandboxing cut Claude Code permission prompts by 84% in Anthropic's internal usage (self-reported).
• Best for: An 84% reduction in permission prompts, with file and network limits enforced across the entire process tree.
• Worst for: Production use — it remains a beta research preview, and Windows support is still in alpha.

What Is Anthropic sandbox-runtime?

Anthropic sandbox-runtime is an open-source tool that wraps any process in filesystem and network restrictions. You install it with npm install -g @anthropic-ai/sandbox-runtime, then prefix a command with srt to run it inside the sandbox.

via MarkTechPost