Anthropic has released the core sandboxing infrastructure powering Claude Code as an open-source npm package, @anthropic-ai/sandbox-runtime (srt). Licensed under Apache-2.0, this tool provides OS-level filesystem and network restrictions for arbitrary processes without the overhead of containers. The release transforms a proprietary internal component into a public utility for securing AI agents.

Native OS Primitives Over Containerization

Rather than relying on heavy virtualization, srt wraps native OS security primitives for performance and integration. On macOS, it utilizes sandbox-exec with dynamically generated Seatbelt profiles. Linux implementations leverage bubblewrap to enforce network namespace isolation. The Windows build is more complex, combining Windows Filtering Platform (WFP) egress fences with write-restricted tokens and explicit NTFS ACLs. A bundled srt-win.exe helper supports both x64 and arm64 architectures, requiring a one-time elevated windows-install step to provision a dedicated srt-sandbox local user account.

Advanced Network and Credential Controls

The documentation highlights sophisticated security features beyond basic isolation. srt implements an allow-only network policy with wildcard domain support and Unix-socket allowlisting. It includes experimental TLS termination for MITM inspection of HTTPS traffic, credential masking for environment variables and files, and AWS SigV4 request signing with masked keys. Notably, the tool offers drop-in sandboxing for MCP servers by simply swapping the command field in .mcp.json from npx to srt.

Known Limitations and Research Preview Status

Anthropic explicitly frames this release as a "research preview developed for Claude Code to enable safer AI agents," cautioning that APIs and configuration formats may evolve. The Windows implementation currently has significant gaps: tools built on the system TLS stack (Schannel), such as System32\curl.exe, PowerShell's Invoke-WebRequest, .NET HttpClient, and winget, are incompatible. Additionally, traffic routed through system services like Windows Update escapes the WFP fence entirely.

Key Takeaways

  • Anthropic open-sourced @anthropic-ai/sandbox-runtime under Apache-2.0, exposing the security layer behind Claude Code.
  • The tool uses native OS primitives (Seatbelt, bubblewrap, WFP) instead of containers for lightweight process isolation.
  • Windows support is alpha-stage, with specific incompatibilities for Schannel-based tools and system service traffic.
  • Features include allow-only networking, credential masking, TLS termination, and seamless MCP server sandboxing.

The Bottom Line

This release is a significant win for the AI agent ecosystem, providing a standardized, lightweight security layer that avoids container bloat. However, the Windows limitations are substantial enough that it remains primarily a macOS and Linux solution for now.