Basics
What Is Anthropic Sandbox Runtime? The srt Tool for Safer AI Agents, Explained
Anthropic Sandbox Runtime (srt) is a free tool that fences an AI agent off from your files and the internet, with no container. How it works, setup and limits.
Anthropic Sandbox Runtime is the safety fence Anthropic built for its coding agent, Claude Code, and then gave away for anyone to use. It is back in the news this week after MarkTechPost featured it on October 24, 2026, and people are searching for what it actually does.
Here is the plain answer: what the tool is, how it keeps an AI agent away from your private files, whether it is free, how to try it, and how it compares to Docker and NVIDIA OpenShell.
srt, is a free, open-source tool (Apache 2.0) that limits which files and websites a program can reach. It uses tools already built into your computer, Seatbelt on macOS and bubblewrap on Linux, so it needs no container. Anthropic made it for Claude Code, where it says sandboxing cut permission prompts by 84% in its own use. It is a research preview, and Windows support is still alpha.What is Anthropic Sandbox Runtime?
An AI agent that can run commands on your computer is useful and a little scary. It can install packages, run tests and edit code. But if a web page or file tricks it with a hidden instruction, the same agent could read your SSH keys or send your files somewhere.
Sandbox Runtime puts a fence around that agent. Anthropic’s GitHub page calls it a lightweight tool for "enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container." In normal words: you pick which folders the program may change and which websites it may talk to, and the operating system blocks everything else.
It is not only for Claude. The README says it can wrap AI agents, local MCP servers, shell commands or any other program. You use it as a command-line tool called srt or as a JavaScript library inside your own agent.
How does Anthropic Sandbox Runtime work?
It does two jobs, and Anthropic stresses that you need both. Its engineering post explains why: with network limits but no file limits, an agent can still steal files; with file limits but no network limits, it can still escape and leak data.
| Part | Default rule | What you can change |
|---|---|---|
| Reading files | Allowed | Block folders such as ~/.ssh with denyRead |
| Writing files | Blocked | Allow folders such as your project with allowWrite |
| Internet | Blocked | Allow sites such as github.com with allowedDomains |
| macOS engine | sandbox-exec with Seatbelt profiles made on the fly | |
| Linux engine | bubblewrap with the network cut off, so all traffic goes through a proxy | |
| Windows engine (alpha) | A separate srt-sandbox user, a firewall fence and locked-down file permissions | |
The rules live in a small settings file, ~/.srt-settings.json. Web traffic from inside the fence goes through HTTP and SOCKS5 proxies running on your machine, and those proxies check every site against your list.
Sandbox Runtime and Claude Code
Anthropic introduced sandboxing in Claude Code on October 20, 2025, in an engineering post called "Beyond permission prompts." Before that, Claude Code asked you to approve command after command, which people found tiring and then started clicking through without reading.
With the sandbox on, Claude can work freely inside the fence and only stops to ask when it wants to step outside. Anthropic says this "safely reduces permission prompts by 84%" in its internal usage. That is Anthropic’s own figure, not an outside test. The company released the runtime as an open-source research preview the same day and asked other agent builders to adopt it.
Is Anthropic Sandbox Runtime free?
Yes. It is free and open source under the Apache 2.0 license, and the GitHub repository has more than 6,000 stars. There is no paid tier. You only pay for whatever AI model your agent uses.
How to install Anthropic Sandbox Runtime
- Install it with npm:
npm install -g @anthropic-ai/sandbox-runtime - On macOS, install ripgrep. On Linux, install bubblewrap, socat and ripgrep.
- Put a command after
srt, for examplesrt "npm test". It runs with no internet and can only write to the default paths. - Add a
~/.srt-settings.jsonfile to open the sites and folders the job really needs. - On Windows, run the one-time setup
npx @anthropic-ai/sandbox-runtime windows-installas administrator. Expect rough edges.
Anthropic Sandbox Runtime vs Docker vs NVIDIA OpenShell
| Sandbox Runtime (srt) | Docker container | NVIDIA OpenShell | |
|---|---|---|---|
| Made by | Anthropic | Docker | NVIDIA |
| Needs a container | No | Yes | Yes (Docker, Podman or a VM) |
| Built for | One developer’s laptop | Any app | Companies running many agents |
| Website allow list | Built in | Extra setup | Built in, plus key handling |
| Price | Free, Apache 2.0 | Free and paid plans | Free, Apache 2.0 |
The big difference is weight. A container copies a whole mini system. Sandbox Runtime just tells your real system "this program may not touch these things," so it starts instantly. For a bigger setup aimed at teams, see our guide to NVIDIA OpenShell.
Limits to know
- It is a preview. The README warns that APIs and settings "may evolve."
- Windows is alpha. Programs that use Windows’ own secure web stack, like PowerShell web requests and winget, cannot reach HTTPS sites inside the sandbox.
- Some switches weaken it. Options such as
allowAppleEventson macOS mean, in the README’s words, "the sandbox no longer provides code-execution isolation." - Nested sandboxes break. Chromium, Electron apps and rootless Podman fail inside it unless you loosen a setting.
What this means for you
Sandbox Runtime shows where AI agents are heading: they get more freedom, but inside clear walls. That same thinking is behind MCP Tasks, which let agents run long jobs on their own, and Google’s Agent Compute Engine.
If you are not a developer, you do not need to install any of this. Agentic AI gives you a team of expert AI agents on iPhone and iPad with no account and no login. You describe the task, up to four agents work on it, and you get the finished result back. The first 3 tasks are free.
Quick answers
What is Anthropic Sandbox Runtime? A free, open-source tool from Anthropic, run as srt, that limits which files and websites a program or AI agent can reach, using the operating system’s own sandboxing instead of a container.
What is anthropic-ai/sandbox-runtime? It is the npm package name. Install it with npm install -g @anthropic-ai/sandbox-runtime.
Does Anthropic Sandbox Runtime work on Windows? Yes, in alpha. It needs a one-time administrator setup and has known gaps, such as HTTPS failing for PowerShell and winget inside the sandbox.
Can I use Anthropic Sandbox Runtime with OpenCode or other agents? Yes. The README says it can sandbox any process, including other agents and local MCP servers. Run the agent’s command after srt.
Is Anthropic Sandbox Runtime the same as Claude Code sandboxing? It is the engine under it. Claude Code’s sandbox mode was built on this runtime, which Anthropic open-sourced on October 20, 2025.
Is there a Python version? The official package is for Node.js, but srt can wrap any command, including Python scripts.
New to these words? Our agentic AI glossary covers sandboxes, MCP and tool use in plain English.
Sources: GitHub: anthropics/sandbox-runtime · Anthropic Engineering: Beyond permission prompts · MarkTechPost · AI Weekly
