Anthropic has published sandbox-runtime, a command-line tool called srt that runs any program with limits on what it can reach. It is open source under the Apache-2.0 license. Anthropic describes it as a research preview developed for Claude Code.
A sandbox is a fenced-off space where a program can only touch what you allow. srt builds that fence from the operating system’s own tools, so it needs no container (a packaged mini-computer, such as Docker, that many developers use for isolation). On macOS it uses the built-in sandbox-exec. On Linux it uses bubblewrap, a small isolation tool you install separately along with socat and ripgrep.
What the sandbox blocks by default
Everything starts closed. Network access is denied, and so are file writes. Reading files is allowed unless you deny specific paths. You open up only what a task needs in a settings file, for example by letting a program write to the current folder or reach a short list of websites.
Install it with npm install -g @anthropic-ai/sandbox-runtime, then put srt in front of a command: srt curl https://example.com. With no domains allowed, that request fails.
Fencing an MCP server
An MCP server is a helper program that gives your coding agent extra abilities, such as reading your files or calling an outside service. Installing one usually means running someone else’s code on your machine with your permissions.
The README shows a small change to an MCP server’s entry in .mcp.json: set command to srt and move the original npx command into the args list. The server then runs inside the fence, with writes limited to the folders you allow in ~/.srt-settings.json.
That helps if you install community MCP servers. A server that only needs to read one project folder no longer has to be trusted to write anywhere on your machine.
Reads are open, and Windows has gaps
Because reads are allowed by default, a sandboxed program can still see your files, including folders such as ~/.ssh, unless you list them under denyRead.
The Windows version is alpha. Setup runs once per machine and asks for administrator approval. The README says tools that use Windows’ built-in TLS (encryption) layer cannot run inside the sandbox, including curl.exe from System32, PowerShell’s Invoke-WebRequest, and winget. It also says traffic that a system service carries on a sandboxed process’s behalf is not covered by the network filters.
An experimental option, credential masking, swaps a secret such as an API key for a placeholder inside the sandbox and restores the real value only for the hosts you list. It requires the experimental TLS termination feature.
srt needs a settings file and a few installed tools, so it suits builders already comfortable in a terminal. Anthropic says the settings format may change.
End of article