Anthropic Sandbox Runtime (srt)

Use it when

• An AI agent or local MCP server executes arbitrary shell commands and you need to block reads of SSH keys and confine writes to the workspace without building a container
• You want a bash command or subprocess to reach only an allowlist of domains, with all other network egress denied at the OS level

What it solves

Not the fit when

• Beta research preview; APIs and config formats may change
• Windows support is alpha and runs commands under a separate srt-sandbox user, so per-user tool installs are unreachable
• Not a VM boundary; allowAppleEvents on macOS removes code-execution isolation
• Linux paths are literal only (no glob patterns) and mandatory deny paths only cover existing files
• System DNS resolution is not fenced (only the subsequent connect is blocked)
• container image build and orchestration
• vm-level isolation of untrusted code
• prompt injection detection
• secrets scanning in repositories
• runtime malware analysis

Install

npm install -g @anthropic-ai/sandbox-runtime (Linux also needs bubblewrap, socat, ripgrep; macOS needs ripgrep; Windows alpha needs one-time npx @anthropic-ai/sandbox-runtime windows-install)

Invoke

Wrap any command: srt "curl anthropic.com". Sandbox an MCP server by prefixing its command with srt in .mcp.json. Configure allow/deny rules in ~/.srt-settings.json (network.allowedDomains, filesystem.allowWrite, filesystem.denyRead). As a library: await SandboxManager.initialize(config) then SandboxManager.wrapWithSandbox(cmd).

Alternatives

No reviewed alternatives recorded yet.