Anthropic open-sources the sandbox runtime used for Claude Code

Open-sourcing the sandbox

Anthropic has officially released the sandbox-runtime (srt) as an open-source npm package. This is the same OS-level sandboxing technology that powers Claude Code, the company's tool for AI-assisted programming. By releasing it under the Apache-2.0 license, the company is making the underlying security infrastructure available to the broader developer community.

The project is described as a lightweight tool designed to enforce specific restrictions on processes. Unlike many other security solutions, it does not require the use of a container to isolate tasks. Instead, it works at the operating system level to limit what a program can see or do on a user's machine.

According to the project README, this release serves as a research preview. Anthropic developed the tool specifically to enable safer AI agents that can perform complex tasks. However, the company notes that the APIs and configuration formats are still subject to change as the project evolves.

How the technology works

The sandbox-runtime functions by wrapping the native security primitives of different operating systems. On macOS, it utilizes sandbox-exec combined with dynamically generated Seatbelt profiles to manage permissions. For Linux users, the system relies on bubblewrap to provide network namespace isolation for various tasks.

The Windows implementation is more complex because it requires specific system-level configurations. It combines a Windows Filtering Platform egress fence with a write-restricted token and explicit NTFS Access Control Lists (ACLs). To set this up, users must perform a one-time elevated installation that creates a dedicated local user account and provisions the machine-wide filter set.

The runtime includes several advanced features for managing how processes interact with the outside world. These include allow-only network policies that support wildcard domains and Unix-socket allowlisting. It also provides experimental TLS termination, which allows for the inspection of HTTPS traffic, and credential masking to hide sensitive environment variables or files.

Integration and use cases

One of the primary ways developers can use this tool is for sandboxing Model Context Protocol (MCP) servers. The documentation shows that users can achieve drop-in sandboxing by simply swapping a command field in an .mcp.json entry. By changing the command from npx to srt, the server runs within the restricted environment.

The tool also handles specific cloud infrastructure requirements, such as AWS SigV4 request signing. This allows applications to interact with cloud services while keeping the actual keys masked from the process. These features are designed to help developers build agents that can perform actions like file editing or web requests without risking the integrity of the host system.

By providing these specific hooks, Anthropic is attempting to solve a common problem in AI development. Developers often want to give an AI agent the ability to run code, but they need to ensure that the code cannot delete system files or access private data. This runtime provides a middle ground between no security and the high overhead of virtual machines.

Known limitations and gaps

While the sandbox provides significant protections, the Windows backend has documented security holes that users should be aware of. Specifically, tools that are built on the system TLS stack, such as curl.exe in System32, cannot be used within the sandbox. This includes several common utilities like PowerShell's Invoke-WebRequest and the .NET HttpClient.

Traffic that is routed through certain system services may also escape the Windows Filtering Platform fence. For example, traffic handled by Windows Update is not restricted by the sandbox's network rules. These limitations are important for developers to understand when designing the permissions for their AI agents.

The project is still in a preview phase, which means the security boundaries may shift as the code is updated. Anthropic encourages users to monitor the repository for changes to the configuration formats. Developers should test their specific use cases thoroughly to ensure the sandbox behaves as expected before deploying it in production environments.