sandbox-runtime

license

Apache-2.0(OSI)

source

public(GitHub)

distribution

npm package

core features withheld

no

Sandbox Runtime is Apache-2.0, fully open and self-contained, installing entirely with a single `npm install -g @anthropic-ai/sandbox-runtime` and no hosted plan, license key or withheld capability. It is labeled a beta research preview, a maturity statement rather than a gate.

• https://api.github.com/repos/anthropic-experimental/sandbox-runtime recorded 2026-08-13

  Repository metadata - public, not archived, license spdx_id Apache-2.0, pushed to the same day.

• https://github.com/anthropic-experimental/sandbox-runtime recorded 2026-06-04

  Apache-2.0 license; OS-level (bubblewrap/seatbelt) sandbox library, no container required

• https://raw.githubusercontent.com/anthropic-experimental/sandbox-runtime/main/LICENSE recorded 2026-08-13

  The verbatim Apache License 2.0 body, with no added terms or field-of-use restrictions.

• https://raw.githubusercontent.com/anthropic-experimental/sandbox-runtime/main/README.md recorded 2026-08-13

  Installs entirely from npm as a CLI and library; documents settings, filesystem/network/unix-socket restrictions and violation monitoring with no paid tier, license key or hosted component. Labeled a beta research preview built for Claude Code and released as an open source preview.

• https://raw.githubusercontent.com/anthropics/sandbox-runtime/main/LICENSE recorded 2026-09-29

  The LICENSE file is the Apache License text: "TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION" under "Version 2.0, January 2004", with no added field-of-use terms.

• https://raw.githubusercontent.com/anthropics/sandbox-runtime/main/package.json recorded 2026-09-29

  The package manifest declares "license": "Apache-2.0" and a public repository at "git+https://github.com/anthropics/sandbox-runtime.git".

• https://raw.githubusercontent.com/anthropics/sandbox-runtime/main/README.md recorded 2026-09-29

  The README gives one install command, "npm install -g @anthropic-ai/sandbox-runtime", and describes the tool as "an early open source preview"; searched the body for license key, commercial, pricing, paid and cloud-only: none.

Downloads of @anthropic-ai/sandbox-runtime measured over 2026-07-11 to 2026-08-09 exceed this reading's threshold by a razor-thin margin, thin enough that a later fetch could fall short of it. npm pulls also overstate real usage through CI and mirror traffic, which matters more for a young research preview than an established package.

• https://api.npmjs.org/downloads/point/last-month/@anthropic-ai/sandbox-runtime recorded 2026-06-04

  ~558,800 downloads May 4-Jun 2 2026

• https://api.npmjs.org/downloads/point/last-month/@anthropic-ai%2Fsandbox-runtime recorded 2026-08-14

  1,000,104 downloads of package @anthropic-ai/sandbox-runtime over the window 2026-07-11 to 2026-08-09. The scoped name is URL-encoded because the npm point endpoint requires it.

• https://github.com/anthropic-experimental/sandbox-runtime recorded 2026-06-04

  403 dependents, 4.3k stars

• https://registry.npmjs.org/@anthropic-ai%2Fsandbox-runtime recorded 2026-08-14

  Registry metadata for the package - repository git+https://github.com/anthropic-experimental/sandbox-runtime.git, described as "Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes", latest 0.0.73. Confirms the package is the product itself, which ships only from npm.

Sandbox Runtime gives low-overhead, no-container process isolation with fine-grained filesystem and network allow/deny rules and pre-built seccomp filters. A process-level sandbox is a weaker security boundary than the microVM/gVisor frontier, and seccomp coverage is limited to x64/arm64, with unix sockets unrestricted elsewhere and no managed or multi-host mode.

• https://github.com/anthropic-experimental/sandbox-runtime recorded 2026-06-04

  bubblewrap+seccomp / sandbox-exec isolation, filesystem+network restriction model, no container

• https://raw.githubusercontent.com/anthropic-experimental/sandbox-runtime/main/README.md recorded 2026-08-13

  Native OS primitives (sandbox-exec on macOS, bubblewrap on Linux) plus a filtering proxy; filesystem, network and unix-socket restrictions; seccomp filters limited to x64/arm64 with a warning when unavailable; single-host CLI and library, no fleet or managed tier.

• https://raw.githubusercontent.com/anthropics/sandbox-runtime/main/README.md recorded 2026-09-29

  The README describes "native OS sandboxing primitives (`sandbox-exec` on macOS, `bubblewrap` on Linux)" with "proxy-based network filtering" and "without requiring a container", and marks Windows support as alpha.

• https://raw.githubusercontent.com/anthropics/sandbox-runtime/main/README.md recorded 2026-09-29

  The README says "Blocking uses seccomp filters (x64/arm64 only)" on Linux and that without seccomp "sockets are unrestricted and a warning is shown", and lists Windows as "Alpha" with a bundled srt-win.exe helper.