anthropics/sandbox-runtime

The problem

Running an agent, a third-party MCP server, or an unfamiliar npm script means giving it your full user privileges: it can read ~/.ssh, exfiltrate environment secrets, and hit any host on the network. Container-based isolation solves this but adds an image build, daemon, and mount-planning tax for what is often a one-shot command. srt wraps any process in restrictions enforced by native OS mechanisms so that you poke holes explicitly rather than trusting the thing you run.

What's different

Most developers reach for Docker or a full VM when they want to sandbox a subprocess. srt instead composes primitives already in the OS — Seatbelt profiles on macOS, bubblewrap plus a network namespace on Linux, and a dedicated local user with Windows Filtering Platform egress rules on Windows — and routes network traffic through host-side HTTP and SOCKS5 proxies that enforce domain allow/deny lists. That gives you per-command granularity with no image to maintain, and the network policy is an allowlist by default rather than a blocklist. It also ships as a library, so tooling can embed the same policy model, and it exposes the whole process tree, not just the first binary.

Who it's for

Developers building agentic systems — particularly those wiring up MCP servers they did not write — and anyone who wants to run untrusted scripts on a laptop or CI box without spinning up containers. Because it is a beta research preview with evolving config formats, teams that need stable, auditable sandbox APIs, or who are already standardized on container isolation with a mature policy engine, should stay on their current stack.

Cost of adoption

Node.js and a global npm install (npm install -g @anthropic-ai/sandbox-runtime) are required, plus bubblewrap on Linux and the relevant OS permissions. The three platforms do not behave identically — the README itself flags Windows limitations around token manipulation and service-carried traffic — so cross-platform policy parity is not guaranteed. It is explicitly marked beta with potentially changing APIs, and its defaults are secure-by-default in a way that will surprise people: no network access, no writes outside default paths, and unrestricted reads unless you tighten them. A malformed settings file is a hard error rather than a silent fallback, which is the right call but means your config must be correct before anything runs.

Verdict

This is a focused, well-thought-out piece of infrastructure from Anthropic, and the dual-isolation reasoning in the README is more rigorous than most sandbox tooling. It is, however, roughly a year old and still labeled a beta research preview, and the traffic we can see is one day on the daily trending board with about 6,400 stars, so this reads as genuine organic interest rather than a hype spike. The approach is sound; the main risk is churn in configuration and platform behavior during the preview period. Worth adopting now for experimentation and agent hardening, not yet for production guarantees you would have to defend.