Anthropic Sandbox Runtime

Anthropic Sandbox Runtime (srt) is an open-source runtime that applies operating-system restrictions to arbitrary processes without requiring a container. It suits developers securing agents, local services, shell commands, and other tools on infrastructure they control. The zero-cost, self-hosted model is attractive for experimentation, but preview-era APIs and uneven platform behavior make it unsuitable when deployment consistency is the overriding requirement.

Overview

srt is delivered from npm as both a command-line tool and a library, with @anthropic-ai/sandbox-runtime installed globally using npm. Its documented use cases include agent processes, local Model Context Protocol servers, bash commands, arbitrary programs, and a Java agent for JVM tools on macOS and Linux. Apache-2.0 licensing permits open-source use, while Anthropic positions the project as an early research preview for Claude Code and the wider effort to build safer agentic systems.

The design relies on host operating-system controls rather than a container layer. That can reduce deployment overhead where the host is already managed, but it also means configuration, dependencies, and failure modes vary by platform. APIs and configuration formats may evolve, so teams should expect maintenance rather than treat srt as a finished security boundary.

Key features

• Filesystem policy: Read and write access can be configured separately. Writes are denied unless paths are explicitly allowed, giving agents and commands a restrictive starting point; useful work still requires carefully granting the directories a process needs.
• Default-deny networking: Network access starts blocked and can be narrowed with allowed and denied domain lists. HTTP, HTTPS, and other TCP traffic pass through proxies, but the proxy restricts reachable domains rather than inspecting traffic. Operators therefore need to approve only domains they trust.
• OS-native isolation: macOS uses sandbox-exec, Linux uses bubblewrap, and Windows combines a dedicated local sandbox account, filesystem ACLs, and Windows Filtering Platform egress filtering. This makes srt relevant to mixed fleets, while preventing identical behavior across them.
• Violation visibility: macOS can tap the system sandbox violation log store for real-time alerts. Linux bubblewrap has no built-in violation reporting, so Linux operators have less direct feedback when a process hits a restriction.
• Agent and MCP integration: The CLI and library forms support embedding controls into agent workflows and local MCP servers rather than limiting use to one application.

Pricing

The Anthropic Sandbox Runtime plan costs free. It is an open-source research preview with no paid plans or stated usage limits, and there is no free trial because the software is free. Self-hosting shifts responsibility for installation, dependencies, policy design, and operation to the user instead of providing a managed service or subscription support tier.

Platforms

srt documents Linux, macOS, and Windows support, with Windows marked alpha. Linux requires bubblewrap, socat, and ripgrep; some configurations need additional system setup. macOS requires ripgrep. Windows needs a one-time elevated windows-install step, although the helper executable is bundled with the npm package.

Linux networking depends on proxy environment variables, so programs that ignore those variables may be unable to reach the internet. On Windows, per-user tool installations may not be visible to the sandbox account, and schannel clients with certificate revocation checking enabled can fail because revocation requests are blocked. Enabling weaker nested sandboxing on Linux considerably reduces security and is advised only with additional isolation.

Who it's for

srt is a strong fit for developers and security-minded teams building agentic systems, local MCP services, or controlled command runners on self-managed Linux, macOS, or Windows hosts. It is especially practical when default-deny filesystem and network policies are more important than a uniform managed experience.

It is a poor fit for organizations that need stable APIs, consistent cross-platform enforcement, built-in Linux violation reporting, or proxy-level traffic inspection. The alpha Windows path and Linux dependency and networking caveats also raise operational costs for broad, standardized rollouts.

Pros and cons

Pros

• Free and open source: Apache-2.0 licensing and no stated usage limits suit experimentation and self-hosted deployments.
• Restrictive defaults: Writes and network access are denied until explicitly permitted, reducing the chance of unintentionally broad access.
• Multiple interfaces: A CLI and library accommodate standalone commands as well as embedded agent infrastructure.
• Broad process coverage: Agents, MCP servers, bash commands, JVM tools, and arbitrary processes are documented targets.

Cons

• Preview status: Evolving APIs and configuration formats make long-lived integrations harder to plan.
• Uneven platform maturity: Windows is alpha, while Linux and macOS rely on different enforcement mechanisms and dependencies.
• Limited network insight: Domain filtering does not inspect proxied traffic, leaving trust decisions to the operator.
• Operational edge cases: Linux proxy-variable dependence and Windows schannel and account-visibility issues can break otherwise valid tools.

Alternatives

Choose ANY.RUN instead when you want a freemium service with free trials and broad web, mobile, desktop, and API platform coverage; its Community plan is free forever.

Context Agent Sandboxes is the better choice when a hosted, paid agent-sandbox service with a free tier and concurrent-agent plans fits your workflow.

Pick Daytona for a freemium development environment with hosted and self-hosted platform options, including a pay-as-you-go plan with 5 GiB of storage free before storage charges.

Docker Desktop is preferable when you want an established container workflow, with a free Personal plan and a paid Pro tier.

Choose Northflank for managed infrastructure with a free Sandbox plan covering two services, one database, and two cron jobs.

microsandbox fits users seeking a freemium sandbox with explicit compute, memory, disk, and sandbox-count quotas.

CAPE Sandbox is an open-source, self-hosted malware-analysis option with a free online demonstration instance.

crun is a free Linux and self-hosted OCI container runtime when container execution, rather than OS policy mediation for arbitrary processes, is the goal.

Browse Sandbox Software for the wider category.

Verdict

Choose Anthropic Sandbox Runtime if you are building or operating agents and local tools on self-managed hosts and want no-cost, OS-level filesystem and network restrictions with a CLI or library. Look elsewhere if you need a mature, uniform product, managed operations, dependable Linux violation reporting, or inspection of traffic beyond domain reachability.