What it is
Sandbox Runtime, run as the srt command, wraps any process and everything it starts in operating-system restrictions. It uses sandbox-exec on macOS and bubblewrap on Linux; on Windows it runs the process under a dedicated local user account with a network filter. Network traffic goes through a proxy that only lets through the domains you allow, and writes are refused everywhere except the paths you allow.
It is the engine behind Claude Code's built-in /sandbox, and works as a CLI or a library. Anthropic labels it a beta research preview, so its configuration format may still change. v0.0.81 shipped on 20 October 2026.
Our review
Most advice about AI agent safety is about the agent behaving. A sandbox assumes it won't. If a prompt injection convinces your agent to read your SSH key, srt doesn't argue: the README's own demo shows cat ~/.ssh/id_rsa failing with "Operation not permitted" while cat README.md works.
You choose what is allowed in one settings file: which folders can be read or written, which domains can be reached. Everything else is closed. Because the rules apply to the whole process tree, you can also run a local MCP server under srt, or run Claude Code itself as srt claude, so hooks and MCP servers are confined too.
The catch: writes inside your project folder are allowed on purpose, because that is where the agent works. So srt will not stop a git reset --hard or a deleted source file. It is also a beta (v0.0.81 at the time of writing, with 6,300 GitHub stars), and an allowlist decides where data can go, not what goes there: if github.com is allowed, a gist is allowed.
Our take: this is the cheapest serious protection in agent security. If you use Claude Code, the built-in /sandbox is one command away and uses this same engine. Pair it with a command guard such as cc-safety-net for the damage it lets through by design.
Where it earns its place
A solo developer running Claude Code with auto-accept on
Stop the agent reading keys and secrets outside the project
Turn on /sandbox, or run srt claude with ~/.ssh and ~/.aws denied. Costs nothing; the agent keeps full access to the project folder.
A platform engineer approving third-party MCP servers
Run a community MCP server without giving it the whole laptop
Put srt in front of the server command in .mcp.json and allow only its working folder and the one API domain it needs.
Before you commit
- Setup
- npm install -g @anthropic-ai/sandbox-runtime; Linux also needs bubblewrap, socat and ripgrep from the package manager. In Claude Code, /sandbox turns on the built-in version.
- Data and privacy
- Runs locally and sends nothing anywhere. Apache 2.0.
- Cost at scale
- Free; there is no paid edition.
- Limits
- Project writes are allowed by design; domain allowlists cannot inspect what is sent to an allowed host; beta APIs may change.
What's good
- OS-level enforcement that a fooled agent cannot talk past
- No container or VM needed
- Confines MCP servers and hooks when you run the agent under srt
- First-party and free; already built into Claude Code
What's not
- Beta research preview; config may change
- Writes inside the project are allowed, so destructive git commands still run
- Windows support is the newest and least proven
Best for
Every developer running a coding agent on their own machine, as the first layer of protection.
Alternatives
Anthropic Sandbox Runtime (srt): common questions
- Is Anthropic Sandbox Runtime (srt) worth it?
- Your coding agent can be talked into anything; the operating system can't, and srt puts the operating system in charge. We rate it 4.4 out of 5.
- How much does Anthropic Sandbox Runtime (srt) cost?
- Free and open source under Apache 2.0.
- What are the downsides of Anthropic Sandbox Runtime (srt)?
- Beta research preview; config may change; writes inside the project are allowed, so destructive git commands still run; windows support is the newest and least proven.
- Who is Anthropic Sandbox Runtime (srt) best for?
- Every developer running a coding agent on their own machine, as the first layer of protection.
- How much does Anthropic Sandbox Runtime (srt) cost for a team or in production?
- Free; there is no paid edition.
- Is Anthropic Sandbox Runtime (srt) safe for company data?
- Runs locally and sends nothing anywhere. Apache 2.0.
- What are the best Anthropic Sandbox Runtime (srt) alternatives?
- The closest alternatives we have reviewed are NVIDIA OpenShell and CC Safety Net.
Answers checked Oct 24, 2026.
Make Anthropic Sandbox Runtime (srt)? Show this rating on your site
