Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
The tool addresses the need to safely run untrusted or potentially compromised processes by restricting their access to the filesystem and network. It uses native OS sandboxing primitives—sandbox-exec on macOS, bubblewrap on Linux, and Windows Filtering Platform on Windows—combined with proxy-based network filtering. This approach applies restrictions to entire process trees rather than individual processes, ensuring that child processes inherit the same constraints. The tool follows a secure-by-default philosophy where processes start with minimal access and developers explicitly grant only the permissions needed.
The project is designed for developers building secure agentic systems, particularly those running Model Context Protocol servers or other untrusted local processes. It works as both a CLI tool and a library, making it suitable for integration into existing workflows. The tool is particularly valuable for scenarios where containerization is impractical or unwanted, offering a lighter-weight alternative that still provides dual isolation through both filesystem and network restrictions. A key use case highlighted in the README is sandboxing MCP servers to prevent them from accessing sensitive files or making unauthorized network connections.
The project is maintained as a research preview developed for Claude Code, with APIs and configuration formats acknowledged as subject to evolution. Development activity shows ongoing refinement of the sandboxing implementation across multiple platforms, with attention to both the core isolation mechanisms and the configuration interfaces that allow developers to specify restrictions. The tool includes violation monitoring capabilities on macOS that tap into the system's sandbox violation log store for real-time alerts.
