Anthropic released sandbox-runtime srt the OS-level sandbox used in Claude Code as the @anthropic-ai/sandbox-runtime npm package under Apache-2.0. The runtime uses sandbox-exec with Seatbelt profiles on macOS bubblewrap on Linux and an alpha Windows build backed by Windows Filtering Platform filters and NTFS ACLs. Documented features include allow-only network policies Unix-socket allowlisting experimental TLS termination credential masking AWS SigV4 signing and drop-in sandboxing of MCP servers.
Open-source sandbox runtime
Anthropic has released the sandbox that runs behind Claude Code as an open-source npm package @anthropic-ai/sandbox-runtime under the Apache-2.0 license. The project README describes srt as "a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level without requiring a container." The runtime wraps each platforms native primitives. On macOS it uses sandbox-exec with dynamically generated Seatbelt profiles. On Linux it uses bubblewrap with network namespace isolation. The Windows build combines a Windows Filtering Platform egress fence with a write-restricted token and explicit NTFS ACLs and ships a bundled srt-win.exe helper for x64 and arm64. A one-time elevated windows-install step provisions a dedicated srt-sandbox local user account and the machine-wide WFP filter set.
Features called out in the README include an allow-only network policy with wildcard domain support Unix-socket allowlisting experimental TLS termination for MITM inspection of HTTPS credential masking for environment variables and files and AWS SigV4 request signing with masked keys. The docs show drop-in MCP server sandboxing by swapping the command field in an .mcp.json entry from npx to srt. The repo frames the release as "a research preview developed for Claude Code to enable safer AI agents" and cautions that "APIs and configuration formats may evolve." The Windows backend documents specific holes. Tools built on the system TLS stack (Schannel) including System32\curl.exe PowerShell's Invoke-WebRequest .NET HttpClient and winget cannot be used and traffic routed through system services such as Windows Update escapes the WFP fence.
Platform specifics
macOS: sandbox-exec with dynamically generated Seatbelt profiles Linux: bubblewrap with network namespace isolation Windows: Windows Filtering Platform egress fence + write-restricted token + explicit NTFS ACLs + srt-win.exe helper (x64/arm64)A one-time elevated windows-install step provisions a dedicated srt-sandbox local user account and the machine-wide WFP filter set.