Repolode
Submit
anthropics

anthropics/sandbox-runtime

A lightweight CLI and library that restricts filesystem and network access for arbitrary processes at the OS level, without containers.

View on GitHub
Stars
6,425
Forks
562
Open issues
300
Last commit
5 hours ago

What is it?

srt wraps any command, such as an AI agent, a local MCP server, a bash command or another process, and limits what it can read, write and connect to. On macOS it uses sandbox-exec with generated Seatbelt profiles, and on Linux it uses bubblewrap with a network namespace. Windows runs the process under a dedicated local account with a Windows Filtering Platform egress fence.

Network access is denied by default. Allowed traffic goes through HTTP and SOCKS5 proxies on the host, which enforce domain allowlists and denylists. Filesystem rules use a deny-then-allow model for reads and an allow-only model for writes. Unix socket access is blocked by default on both platforms.

The package can be used from the command line as `srt` or imported as a TypeScript library with SandboxManager. It also supports a settings file, violation reporting on macOS, and a runtime config channel.

Key features

  • 01Restricts filesystem reads and writes for any process tree
  • 02Enforces domain allowlists and denylists through host-side proxies
  • 03Uses sandbox-exec on macOS and bubblewrap on Linux
  • 04Blocks Unix socket access by default
  • 05Provides both a CLI and a TypeScript library API

Use cases

  • Sandboxing AI coding agents so they cannot read SSH keys or reach arbitrary hosts
  • Restricting local MCP servers to specific directories and network destinations
  • Running untrusted bash commands or build scripts with limited access

Quick start

  1. 1

    Install the package globally with npm

    npm install -g @anthropic-ai/sandbox-runtime
  2. 2

    Run a command inside the sandbox

    srt "curl example.com"

Things to know

  • Beta research preview whose APIs and configuration formats may change.
  • Relies on OS primitives such as sandbox-exec on macOS and bubblewrap on Linux, and needs bubblewrap installed on Linux.
  • Windows support carries documented known limitations around process tokens and system services.

In collections

MCP serversSecurity scanners, audits & threat intel tools

Topics

#sandbox#security#agent-safety#network-isolation#filesystem#bubblewrap#seatbelt#mcp

FAQ

What is sandbox-runtime?
A lightweight CLI and library that restricts filesystem and network access for arbitrary processes at the OS level, without containers. srt wraps any command, such as an AI agent, a local MCP server, a bash command or another process, and limits what it can read, write and connect to. On macOS it uses sandbox-exec with generated Seatbelt profiles, and on Linux it uses bubblewrap with a network namespace. Windows runs the process under a dedicated local account with a Windows Filtering Platform egress fence.
Is sandbox-runtime free to use? What license does it have?
sandbox-runtime is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is sandbox-runtime still maintained?
Actively maintained. The last commit to sandbox-runtime was on Oct 24, 2026.
What can I use sandbox-runtime for?
Sandboxing AI coding agents so they cannot read SSH keys or reach arbitrary hosts Restricting local MCP servers to specific directories and network destinations Running untrusted bash commands or build scripts with limited access
How do I install sandbox-runtime?
Install the package globally with npm: npm install -g @anthropic-ai/sandbox-runtime Run a command inside the sandbox: srt "curl example.com"
Where can I get sandbox-runtime?
The source code and installation instructions are on GitHub: https://github.com/anthropics/sandbox-runtime

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects