Anthropic Sandbox Runtime

Windows · Mac · Linux · Self-hosted

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

Anthropic Sandbox Runtime is ranked #5 of 22 in sandbox software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

Anthropic Sandbox Runtime plans and pricing

All plans

Anthropic Sandbox Runtime Free Open source research preview · no paid plans or usage limits stated github.com · 5 Oct 2026

Compared on sandbox software

Isolation method: container
Network controls: Yes
API or CLI access: Yes
Deployment: self_hosted

Best Anthropic Sandbox Runtime alternatives

See all 20

Two bars ANY.RUN Free tier No. 1Free6.7 Two bars Daytona Free tier No. 2Free6.6 Two bars Docker Desktop Free tier No. 3$9/mo6.6 Two bars Northflank Free tier No. 4Free6.6 Two bars microsandbox Free tier No. 6$49/mo6.5 One bar CAPE Sandbox Free tier No. 7Free6.4

The record

Purpose: Anthropic Sandbox Runtime (srt) enforces filesystem and network restrictions on arbitrary processes at the OS level without requiring a container.
Availability: The project is an open source research preview licensed under Apache-2.0.
How to install: The README gives `npm install -g @anthropic-ai/sandbox-runtime` as the installation command.
Use cases: The README says srt can sandbox agents, local MCP servers, bash commands, and arbitrary processes, and can be used as a CLI tool or library.
Filesystem controls: Filesystem configuration supports read and write restrictions, with writes denied by default unless paths are explicitly allowed.
Platforms: The project supports macOS and Linux, and lists Windows support as alpha.
Platform mechanisms: The README says macOS uses sandbox-exec, Linux uses bubblewrap, and Windows uses a dedicated local sandbox account with Windows Filtering Platform egress filtering.
Linux dependency: Linux requires bubblewrap, socat, and ripgrep; macOS requires ripgrep.
Windows setup: Windows requires a one-time elevated `windows-install` step, while the helper executable is bundled with the npm package.
Violation monitoring: On macOS, srt can tap the system sandbox violation log store for real-time alerts; Linux bubblewrap does not provide built-in violation reporting.
Security limitation: The README says network filtering restricts reachable domains but does not otherwise inspect traffic through the proxy, so users are responsible for allowing only trusted domains.
Linux limitation: Linux network filtering relies on proxy environment variables, so programs that ignore them may be unable to connect to the internet.
Windows limitation: On Windows, tools using schannel with certificate revocation checking enabled by default can fail because revocation requests are blocked by the egress fence.
Preview status: The README describes the runtime as an early research preview developed for Claude Code and warns that APIs and configuration formats may evolve.
Price from: Free

Where it ranks on Freedom251

Best Sandbox Software in 2026#5 of 22

Is Anthropic Sandbox Runtime yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Anthropic Sandbox Runtime

Sources

github.com/anthropics/sandbox-runtime· checked 5 Oct 2026
anthropic.com/company· checked 5 Oct 2026