anthropic-experimental/sandbox-runtime

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

What it solves

Anthropic Sandbox Runtime (srt) provides a lightweight way to restrict the filesystem and network access of arbitrary processes at the OS level. It is designed to prevent AI agents, local MCP servers, and other automated tools from accessing sensitive files (like SSH keys) or making unauthorized network requests, ensuring they operate within a secure-by-default boundary without requiring a full container.

How it works

The tool uses native OS sandboxing primitives to enforce restrictions across the entire process tree:

  • macOS: Uses sandbox-exec with dynamically generated Seatbelt profiles.
  • Linux: Uses bubblewrap for containerization and network namespace isolation.
  • Windows: Runs processes under a dedicated srt-sandbox local user account with a Windows Filtering Platform (WFP) egress fence.

It employs a dual isolation model:

  • Filesystem Isolation: Uses a "deny-then-allow" pattern for reads (allowed by default, specific paths denied) and an "allow-only" pattern for writes (denied by default, specific paths must be explicitly allowed).
  • Network Isolation: Denies all network access by default. Allowed domains are routed through host-side proxy servers (HTTP/HTTPS and SOCKS5) that enforce domain allowlists and denylists.

Who it’s for

Developers building AI agents or using the Model Context Protocol (MCP) who need to run untrusted or autonomous code with strict, configurable security boundaries on their local machines.

Highlights

  • Secure-by-default: Processes start with minimal access and require explicit permissions.
  • Cross-platform: Native support for macOS, Linux, and Windows.
  • MCP Integration: Specifically designed to sandbox Model Context Protocol servers.
  • Granular Control: Supports git-style glob patterns for filesystem paths on macOS and detailed domain filtering for network traffic.
  • Violation Monitoring: Real-time alerts for sandbox violations on macOS.

Related

  • Project
    webcoyote/sandvault

    A macOS utility that sandboxes AI agents and shell commands using limited user accounts and sandbox-exec to prevent them from accessing sensitive host files.

  • Project
    akitaonrails/ai-jail

    A security sandbox for AI coding agents that uses OS-level isolation on Linux and macOS to prevent unauthorized host system access.

  • Project
    multikernel/sandlock

    A lightweight, rootless Linux process sandbox that uses Landlock and seccomp to confine untrusted code with minimal overhead.

  • Project
    superradcompany/microsandbox

    A tool for running untrusted workloads in fast, local microVMs with hardware-level isolation, specifically designed for AI agents and automation.

  • Project
    opensandbox-group/OpenSandbox

    A general-purpose sandbox platform for AI applications that provides secure, isolated environments for code execution, agent evaluation, and RL training.