Sandbox Runtime

What is Sandbox Runtime?

Sandbox Runtime, run with the srt command, is an open-source tool from Anthropic that wraps a process in filesystem and network limits enforced by the operating system rather than a container. On macOS it generates Seatbelt profiles for sandbox-exec, on Linux it uses bubblewrap with network namespace isolation, and on Windows it runs the process under a dedicated local account with a Windows Filtering Platform egress fence. Network traffic goes through local HTTP and SOCKS5 proxies that apply your allowed and denied domains. Defaults are restrictive: writes and network access are denied until you allow specific paths and hosts. You can use srt as a command-line wrapper or as a library, for example to sandbox agents, local MCP servers and bash commands, and the library reports violations back to the caller. Install it with npm install -g @anthropic-ai/sandbox-runtime. Anthropic labels it a beta research preview built for Claude Code, so APIs and configuration formats may change. It is free to use.

Use cases

• Sandbox local MCP servers
• Restrict an AI agent's file access
• Block unapproved network hosts for a command
• Run bash commands with minimal permissions
• Monitor sandbox violations in real time
• Embed OS-level sandboxing in your own tool

Who it's for

• Agent developers
• Security engineers
• Claude Code users
• Platform engineers

Why use Sandbox Runtime

• OS-level sandboxing means no Docker or virtual machine is needed to constrain a process.
• Secure-by-default settings start with minimal access, and you open only what a command needs.
• Network and filesystem isolation work together, so a compromised process cannot easily send out files such as SSH keys.
• The same sandbox works from the command line or inside your own code through the library.
• It is free and open source, with the code available to inspect.

Sandbox Runtime features

• Filesystem read and write restrictions
• Domain allowlists and denylists for network access
• Unix socket restrictions
• Seatbelt profiles on macOS, bubblewrap on Linux, a restricted account on Windows
• Proxy-based HTTP, HTTPS and SOCKS5 filtering
• CLI wrapper and library API
• Violation monitoring and stderr annotation
• Live config updates through --control-fd
• Ask callback for hosts no rule covers
• Per-command network allow lists

Sandbox Runtime integrations

• Claude Code
• MCP servers
• npm

How to get started with Sandbox Runtime

1. Install the package globally with npm install -g @anthropic-ai/sandbox-runtime.
2. Write a ~/.srt-settings.json file that lists the filesystem paths and network domains to allow or deny.
3. Run any command through srt, for example srt npm install, or point an MCP server config at srt.
4. srt applies the platform sandbox and routes network traffic through its filtering proxies.
5. Review blocked actions and violations, then adjust the settings or use the library callbacks.

Sandbox Runtime limitations

• Beta research preview: APIs and configuration formats may change
• Windows protection is based on an account and egress filter with documented known limitations
• With no settings file, reads are unrestricted and only network and writes are locked down
• An invalid or unreadable settings file stops srt instead of falling back to defaults

Sandbox Runtime pricing

Sandbox Runtime is open source, so you can use and self-host it for free.

Prices can change and may vary by country or exclude tax. Check the official pricing page.

Sandbox Runtime alternatives

The main Sandbox Runtime alternatives listed on Debuly are E2B, Claude Agent SDK, MCP Python SDK, Metorial, numbat and smolagents. The table compares pricing and platforms; order is A–Z.

1. 

   Claude Agent SDK

   Anthropic's Python SDK for building agents on the Claude Code runtime, with built-in tools, custom tools, hooks and MCP servers.

   Developer platformsAutomation and agentsCoding
   Visit Claude Agent SDK (official site)
2. 

   E2B

   Cloud sandboxes where AI agents run code safely, with Python and JavaScript SDKs and per-second usage billing.

   Developer platformsAutomation and agentsCoding
   FreemiumVisit E2B (official site)
3. 

   MCP Python SDK

   The official open-source Python library for writing Model Context Protocol servers and clients that give LLM apps access to tools and data.

   Developer platformsAutomation and agentsCoding
   Open sourceVisit MCP Python SDK (official site)
4. 

   Metorial

   Control plane for AI agents with 1,000+ managed MCP integrations, per-user permissions, SSO and audit logs behind one connection URL.

   Developer platformsAutomation and agents
   FreemiumVisit Metorial (official site)
5. 

   numbat

   Open-source endpoint tool that watches AI agent activity, flags risky behavior locally and can optionally block actions.

   Developer platformsAutomation and agentsCoding
   Open sourceVisit numbat (official site)
6. 

   smolagents

   Hugging Face's minimal open-source Python library for building agents that write their actions as code.

   Developer platformsAutomation and agentsCoding
   Open sourceVisit smolagents (official site)

Sandbox Runtime FAQ

Sources & verification

Facts on this page come from the official sources below, each with the date we read it. Written by Debuly; the vendor did not review this page.

Image credits

• Logo: from avatars.githubusercontent.com · fetched 24 Oct 2026 · Vendor trademark, used only to identify the product; removed on request
• Cover: none collected yet, so a generated tile is shown.

Spot an error? Report an issue with this listing. We also remove a logo or image on the owner's request.