AI Potluck
Infrastructure / Deployment

sandbox-runtime

Anthropic

The Anthropic Sandbox Runtime enforces filesystem, network and unix-socket restrictions on arbitrary local processes without a container, wrapping them in native OS primitives - bubblewrap on Linux, sandbox-exec on macOS - behind a filtering proxy. A CLI named srt and a matching library apply it to agents, local MCP servers and individual shell commands. Anthropic develops it for Claude Code and ships it as a research preview.

The README notes that seccomp filtering is x64/arm64 only and that unix sockets go unrestricted where it is unavailable, so the boundary is weaker on some hosts than the general description implies. Verified 2026-08-13 via the anthropic-experimental/sandbox-runtime README and the GitHub repository metadata.

Openness

5 high confidence
5.0
license
Apache-2.0(OSI)
source
public(GitHub)
distribution
npm package
core-gated
ungated

Apache-2.0 OS-level sandboxing library, fully open and self-contained; no feature-gated core or paid tier. The README installs the whole tool with a single `npm install -g @anthropic-ai/sandbox-runtime` and documents no hosted plan, license key or withheld capability. It is labeled a beta research preview, which is a maturity statement rather than a gate.

Adoption

4 low confidence
4.0

The npm downloads API reports 1,000,104 downloads of @anthropic-ai/sandbox-runtime over the window 2026-07-11 to 2026-08-09, which clears the 1M floor, so the band is 1M-10M / level 4; there are also 403 GitHub dependents and 4.3k stars. The band is read on the figure, not on a judgment about how many of those pulls are people. Two caveats travel with it. First, the margin is 104 downloads, 0.01% over the floor - the thinnest boundary crossing in the corpus, another day’s fetch could as easily read level 3, and confidence is low to say so. Second, the npm figure can be fetched again by hand but no automated feed reads it, so it is a measured number rather than a computed one. Package-manager pulls overstate distinct users through CI and mirror inflation, and this is a young research preview shipped alongside Claude Code. The package is the product’s own - registry metadata points at github.com/anthropic-experimental/sandbox-runtime, the repository the openness axis reads.

Capability

3 medium confidence
3.0

Best-in-class for low-overhead, no-container process isolation with fine-grained fs+network allow/deny and pre-built seccomp filters; but a process-level sandbox is a weaker security boundary than the microVM/gVisor frontier and offers no managed scale, so 3. Seccomp filters are x64/arm64 only, with unix sockets going unrestricted where seccomp is unavailable, and the tool ships no managed or multi-host mode.

Verified 2026-08-13