anthropics/sandbox-runtime

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

What it solves

Anthropic Sandbox Runtime (srt) provides a way to run arbitrary processes—such as AI agents, bash commands, or Model Context Protocol (MCP) servers—within a secure, restricted environment. It prevents these processes from accessing sensitive files or making unauthorized network requests without requiring a full container setup.

How it works

The tool uses native OS-level sandboxing primitives to enforce restrictions across the entire process tree:

  • macOS: Uses sandbox-exec with dynamically generated Seatbelt profiles.
  • Linux: Uses bubblewrap for containerization and network namespace isolation.
  • Windows: Runs processes under a dedicated srt-sandbox local user account with a Windows Filtering Platform (WFP) egress fence.

It employs a dual isolation model:

  • Filesystem Isolation: Uses a "deny-then-allow" pattern for reads (allowed by default, specific paths denied) and an "allow-only" pattern for writes (denied by default, specific paths must be explicitly allowed).
  • Network Isolation: All network access is denied by default. Allowed domains are routed through host-side proxy servers (HTTP/HTTPS and SOCKS5) that enforce allowlists and denylists.

Who it’s for

Developers building agentic systems or using MCP servers who need to ensure that AI-driven code execution is secure-by-default and restricted to specific directories and domains.

Highlights

  • Secure-by-default: Processes start with minimal access and require explicit configuration to gain permissions.
  • Cross-platform: Native support for macOS, Linux, and Windows.
  • Flexible Configuration: Supports glob patterns for filesystem paths on macOS and detailed domain-level network filtering.
  • Violation Monitoring: Real-time alerts for sandbox violations on macOS.
  • Library and CLI: Available as both a standalone command-line tool and a TypeScript library.

Related

  • Project
    looplj/axonhub

    AxonHub is an open‑source Go‑based gateway that lets you keep using the same AI SDK (e.g., OpenAI) while swapping between dozens of LLM providers. It adds request tracing, RBAC, load‑balancing and real‑time cost tracking, and supports text, image, embedding and rerank APIs.

  • Project
    InternLM/xtuner

    A next-generation LLM training engine optimized for ultra-large-scale MoE models up to 1T parameters, supporting multimodal training and advanced reinforcement learning.

  • Project
    awslabs/gluonts

    A Python package for probabilistic time series modeling that uses deep learning and PyTorch to generate forecasts with uncertainty intervals.

  • Project
    microsoft/SynapseML

    An open-source library built on Apache Spark that provides scalable, distributed APIs for machine learning tasks like text analytics, vision, and anomaly detection.