Anthropic open-sources sandbox-runtime for AI agents with OS-level file and network limits

The npm package @anthropic-ai/sandbox-runtime is version 0.0.81, about 11.4 MB unpacked, under Apache-2.0, and requires Node.js 22.12 or later, according to MarkTechPost. It runs on macOS and Linux development machines or CI systems; Windows support is alpha. macOS uses Seatbelt, while Linux requires bubblewrap, socat and ripgrep. The report says users install it globally and prefix commands with srt, and it works as a CLI and TypeScript library.

srt uses each operating system's isolation primitives and applies restrictions to the whole process tree, including scripts and subprocesses, MarkTechPost reported. On macOS it uses sandbox-exec with dynamically generated Seatbelt profiles and requires only ripgrep. On Linux it uses bubblewrap with the network namespace removed, plus socat and ripgrep. Windows alpha support uses a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and explicit file ACLs.

Network traffic leaves only through HTTP and SOCKS5 proxies running on the host, according to the report. On Linux those proxies sit behind Unix sockets bind-mounted into the sandbox; on macOS the Seatbelt profile allows only one localhost port. The proxies then apply domain allowlists and denylists.

The default policy allows reads everywhere unless denied, denies writes everywhere unless allowed, and denies network access unless a domain is allowlisted, MarkTechPost reported. Anthropic argues that filesystem or network isolation alone fails: without network isolation a prompt-injected agent could exfiltrate SSH keys, and without filesystem isolation it could escape the sandbox and gain network access.

For an MCP server, users change the command in .mcp.json from npx to srt and pass the original command as arguments, the report said. Rules live in ~/.srt-settings.json, with fields for allowedDomains, deniedDomains, denyRead, allowWrite and denyWrite. For their own agents, developers can use the SandboxManager library, call initialize(config) to start the proxies, and use wrapWithSandbox() to return a wrapped command string to spawn.

Anthropic reports that sandboxing cut permission prompts by 84% in internal Claude Code usage, according to MarkTechPost. The figure is self-reported and not an external benchmark. Anthropic's stated target is approval fatigue: developers who click approve all day stop reading what they approve, while a fixed boundary lets an agent work freely inside it and ask only at the edge. MarkTechPost described the tool as a beta research preview, with Windows support at alpha.