TL;DR #
- Anthropic released sandbox-runtime (srt), the OS-level sandbox used in Claude Code, as the @anthropic-ai/sandbox-runtime npm package under Apache-2.0.
- The runtime uses sandbox-exec with Seatbelt profiles on macOS, bubblewrap on Linux, and an alpha Windows build backed by Windows Filtering Platform filters and NTFS ACLs.
- Documented features include allow-only network policies, Unix-socket allowlisting, experimental TLS termination, credential masking, AWS SigV4 signing, and drop-in sandboxing of MCP servers.
Anthropic has released the sandbox that runs behind Claude Code as an open-source npm package, @anthropic-ai/sandbox-runtime, under the Apache-2.0 license. The project README describes srt as "a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container."
The runtime wraps each platform's native primitives. On macOS it uses sandbox-exec with dynamically generated Seatbelt profiles. On Linux it uses bubblewrap with network namespace isolation. The Windows build combines a Windows Filtering Platform egress fence with a write-restricted token and explicit NTFS ACLs, and ships a bundled srt-win.exe helper for x64 and arm64. A one-time elevated windows-install step provisions a dedicated srt-sandbox local user account and the machine-wide WFP filter set.
Features called out in the README include an allow-only network policy with wildcard domain support, Unix-socket allowlisting, experimental TLS termination for MITM inspection of HTTPS, credential masking for environment variables and files, and AWS SigV4 request signing with masked keys. The docs show drop-in MCP server sandboxing by swapping the command field in an .mcp.json entry from npx to srt.
The repo frames the release as "a research preview developed for Claude Code to enable safer AI agents" and cautions that "APIs and configuration formats may evolve." The Windows backend documents specific holes. Tools built on the system TLS stack (Schannel), including System32\curl.exe, PowerShell's Invoke-WebRequest, .NET HttpClient, and winget, cannot be used, and traffic routed through system services such as Windows Update escapes the WFP fence.
Originally reported by
**github.com**
Read the original article → Original headline: Anthropic Open-Sources Claude Code's sandbox-runtime Under Apache 2.0 With Linux, macOS, Windows Support