[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuf5dc4ysrek3":3},{"code":4,"message":5,"data":6,"timestamp":32},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":16,"summary_md":17,"topic":18,"github_topics":21,"license":22,"homepage":23,"updated_at":24,"history":25},"anthropics\u002Fsandbox-runtime",11,"A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.","TypeScript",6467,567,650,369,[],"OS-level filesystem and network sandboxing for arbitrary processes and AI agents, without containers.","## The problem\n\nRunning an agent, a third-party MCP server, or an unfamiliar npm script means giving it your full user privileges: it can read `~\u002F.ssh`, exfiltrate environment secrets, and hit any host on the network. Container-based isolation solves this but adds an image build, daemon, and mount-planning tax for what is often a one-shot command. `srt` wraps any process in restrictions enforced by native OS mechanisms so that you poke holes explicitly rather than trusting the thing you run.\n\n## What's different\n\nMost developers reach for Docker or a full VM when they want to sandbox a subprocess. `srt` instead composes primitives already in the OS — Seatbelt profiles on macOS, bubblewrap plus a network namespace on Linux, and a dedicated local user with Windows Filtering Platform egress rules on Windows — and routes network traffic through host-side HTTP and SOCKS5 proxies that enforce domain allow\u002Fdeny lists. That gives you per-command granularity with no image to maintain, and the network policy is an allowlist by default rather than a blocklist. It also ships as a library, so tooling can embed the same policy model, and it exposes the whole process tree, not just the first binary.\n\n## Who it's for\n\nDevelopers building agentic systems — particularly those wiring up MCP servers they did not write — and anyone who wants to run untrusted scripts on a laptop or CI box without spinning up containers. Because it is a beta research preview with evolving config formats, teams that need stable, auditable sandbox APIs, or who are already standardized on container isolation with a mature policy engine, should stay on their current stack.\n\n## Cost of adoption\n\nNode.js and a global npm install (`npm install -g @anthropic-ai\u002Fsandbox-runtime`) are required, plus bubblewrap on Linux and the relevant OS permissions. The three platforms do not behave identically — the README itself flags Windows limitations around token manipulation and service-carried traffic — so cross-platform policy parity is not guaranteed. It is explicitly marked beta with potentially changing APIs, and its defaults are secure-by-default in a way that will surprise people: no network access, no writes outside default paths, and unrestricted reads unless you tighten them. A malformed settings file is a hard error rather than a silent fallback, which is the right call but means your config must be correct before anything runs.\n\n## Verdict\n\nThis is a focused, well-thought-out piece of infrastructure from Anthropic, and the dual-isolation reasoning in the README is more rigorous than most sandbox tooling. It is, however, roughly a year old and still labeled a beta research preview, and the traffic we can see is one day on the daily trending board with about 6,400 stars, so this reads as genuine organic interest rather than a hype spike. The approach is sound; the main risk is churn in configuration and platform behavior during the preview period. Worth adopting now for experimentation and agent hardening, not yet for production guarantees you would have to defend.",{"slug":19,"name":20},"security","Security & Privacy",[],"Apache-2.0",null,"2026-10-24T19:35:10Z",[26,30],{"date":27,"stars":28,"stars_gained":29},"2026-10-24",6460,592,{"date":31,"stars":11,"stars_gained":13},"2026-10-25",1792886994]