Sandbox Runtime

Sandbox Runtime is Anthropic’s open-source research preview of the sandbox used to harden Claude Code. It ships as a CLI and a library (`@anthropic-ai/sandbox-runtime`). Processes get minimal filesystem and network rights unless you allow them. Network filtering is proxy-based; filesystem and Unix socket rules sit on native OS primitives. On macOS you can also watch sandbox violation logs. The same binary wraps bash, agent runners, and MCP server commands — including wrapping `npx` MCP servers in `.mcp.json` by putting `srt` as the command.

Agents and local MCP tools still get broad shell access by default. Sandbox Runtime (srt) wraps any process in macOS sandbox-exec or Linux bubblewrap plus a network proxy, so you start locked down and only open the paths and hosts you mean. That is how you run coding agents and MCP servers on a real machine without treating every tool call as root.

Install with npm (`npm i -g @anthropic-ai/sandbox-runtime`), then run any command under `srt "…"`. Configure allowlists in `~/.srt-settings.json` for paths, domains, and sockets. For MCP, set the server command to `srt` and pass the real launcher as args so the tool process inherits the sandbox. Use it as a library when you want the same policy inside your own agent harness instead of only from the shell.

Not a policy skill that asks the model to be careful, and not a full VM or Docker requirement for every tool. srt is the thin OS sandbox layer under agents — complementary to scanners like Deepsec and prompt guards like destructive-command-guard — so the machine itself refuses the bad path or host.

• API / SDK surface

• Deepsec ↗
• destructive-command-guard ↗
• OpenShell ↗