# Anthropic Sandbox Runtime (srt)

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

Source: https://wheredoirunthis.com/products/sandbox-runtime · JSON: https://wheredoirunthis.com/api/products/sandbox-runtime · Read on 2026-10-26

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Container
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: No
- Regions: Not disclosed
- Coverage: 7 of 61 assessed capabilities supported
- Agent readiness: read 4 of 5 signals, drive 3 of 6 signals

## Links

- Homepage: https://github.com/anthropics/sandbox-runtime
- Docs: https://github.com/anthropics/sandbox-runtime#readme
- Repository: https://github.com/anthropics/sandbox-runtime

## Website design

Desktop public website · assessed 2026-10-26

Complete assessment.

GitHub-only desktop public surface: compact repository table/sidebar and text-led README with neutral colors and restrained borders, not a standalone branded product site.

- Landing page: captured
- Docs: captured
- Pricing: not applicable

## Runtime

- **GPU & accelerators**: No GPU instance provisioning; host hardware is operator-owned. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **BYOC (Bring your own cloud)**: na [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Secrets management**: credentials.envVars/files deny or mask; sentinel substituted on permitted egress, optional SigV4 signing. Masking requires TLS termination; platform differences apply. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Storage options**: Host paths with configured read/write rules; no object storage or managed volumes. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Supported workloads**: arbitrary shell commands, agent-generated code, local MCP servers [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Persistence**: Allowed writes go to the operator filesystem; no managed disk lifecycle. Linux read-denied directory tmpfs output is lost at exit. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Data jurisdiction**: na [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Resource limits & quotas**: Host-dependent, no hosted quotas. Beta research preview; APIs/configuration may change. Windows alpha limitations and Linux namespace/seccomp caveats documented. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **SDK languages**: TypeScript, JavaScript [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Network & egress controls**: Default-deny domain allowlist/denylist via HTTP and SOCKS5 proxies, resolved-address checks, optional request filtering and TLS termination. Platform-specific weaker modes and Windows gaps apply. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Snapshots & forks**: No runtime snapshot, fork or memory restore documented. [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Deployment methods**: cli, sdk [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)
- **Isolation**: Container — "Linux uses bubblewrap namespaces and seccomp; this facet describes Linux only, not a VM. macOS uses Seatbelt sandbox-exec; Windows alpha uses restricted token, ACLs and SID-keyed WFP. No own-kernel boundary." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Not supported | "No agent-skills capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| AI app builder | Not supported | "No app-builder capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Autonomous QA agent | Not supported | "No autonomous-qa-agent capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Built-in coding agent | Not supported | "No built-in-agent capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| BYOK for LLMs | Not supported | "No byok-llm capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Credential-injection proxy | Supported | "credentials envVars/files mask values with sentinel and proxy substitutes real values on permitted egress with TLS termination." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| LLM gateway | Not supported | "General HTTP/SOCKS egress proxy, not model-provider routing gateway." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| MCP client | Not supported | "No mcp-client capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| MCP-server hosting | Supported | "README demonstrates wrapping the filesystem Model Context Protocol server with srt npx; local stdio workload, not hosted cloud service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| MCP server | Not supported | "No mcp-server capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Model inference API (first-party) | Not supported | "No model-inference-api capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Preinstalled coding agent | Not supported | "No preinstalled-coding-agent capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "Not applicable: local process sandbox provisions no automatic-https infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Custom domains | Not applicable | "Not applicable: local process sandbox provisions no custom-domains infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Direct public IPv6 | Not applicable | "Not applicable: local process sandbox provisions no direct-ipv6 infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Edge KV store | Not applicable | "Not applicable: local process sandbox provisions no edge-kv infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Egress controls | Supported | "Default-deny domains, HTTP/SOCKS5 filtering and resolved-address checks; Windows alpha impersonation/service-mediated bypass gaps explicitly disclosed." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Email send / receive | Not supported | "No email-send-receive capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Public preview URLs | Not applicable | "Not applicable: local process sandbox provisions no preview-urls infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Private networking | Not applicable | "Not applicable: local process sandbox provisions no private-networking infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Built-in reverse proxy | Not applicable | "Not applicable: local process sandbox provisions no reverse-proxy infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "No built-in-auth capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| BYOC | Not applicable | "Not applicable: local process sandbox provisions no byoc infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Deploy into customers' VPCs | Not applicable | "Not applicable: local process sandbox provisions no customer-vpc-deploy infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Secrets management | Partially supported | "Credential deny/mask rules and egress injection; no managed secret store or vault." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Self-host / OSS core | Supported | "Apache-2.0 standalone CLI and library; npm install -g @anthropic-ai/sandbox-runtime." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Sharing | Not supported | "No sharing capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| SSO / SAML | Not supported | "No sso-saml capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Teams | Not supported | "No teams capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Workload identity | Not supported | "No workload-identity capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "srt COMMAND wraps arbitrary commands; --settings and --debug documented." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| E2B-compatible API | Not supported | "No e2b-compatible-api capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Filesystem API | Not supported | "No filesystem-api capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Git deploy | Not supported | "No git-deploy capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| HTTP data API | Not applicable | "Not applicable: local process sandbox provisions no http-query-api infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| OpenAPI spec | Not supported | "No openapi-spec capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Private container registry | Not applicable | "Not applicable: local process sandbox provisions no private-registry infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Public API | Supported | "Documented local library API (SandboxManager), not a hosted REST endpoint." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| SDK | Supported | "TypeScript library exports SandboxManager.initialize and wrapWithSandbox; JavaScript usable from same npm package." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| SSH access | Not supported | "No ssh-access capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not applicable | "Not applicable: local process sandbox provisions no cloud-init-config infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Desktop / computer-use sandbox | Not supported | "No desktop-sandbox capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| GPU compute | Not applicable | "Not applicable: local process sandbox provisions no gpu infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Live-state (memory) snapshots | Not supported | "No memory-snapshot capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Multi-region | Not applicable | "Not applicable: local process sandbox provisions no multi-region infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Object storage | Not applicable | "Not applicable: local process sandbox provisions no object-storage infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Persistent disk | Partially supported | "Allowed host filesystem writes persist, but srt provisions no volume or disk lifecycle; read-denied Linux tmpfs output is ephemeral." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Sandbox templates / custom images | Not supported | "No sandbox-templates capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Scale to zero | Not supported | "No scale-to-zero capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Selectable isolation runtime | Not supported | "OS selects native implementation; no per-workload interchangeable isolation-driver selector." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Snapshots / forking | Not supported | "No snapshots-forks capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Not applicable: local process sandbox provisions no database-branching infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Ephemeral instant DB (no-signup) | Not applicable | "Not applicable: local process sandbox provisions no ephemeral-instant-db infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| First-party database | Not applicable | "Not applicable: local process sandbox provisions no first-party-db infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Vector search | Not applicable | "Not applicable: local process sandbox provisions no vector-search infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "Not applicable: local process sandbox provisions no managed-ci-runners infrastructure/service." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Built-in observability | Partially supported | "macOS sandbox violation log monitoring and command-attributed violations; Linux requires external strace for filesystem violations, not a full metrics/APM system." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Preview environments | Not supported | "No preview-environments capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Scheduled tasks | Not supported | "No scheduled-tasks capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Project template marketplace | Not supported | "No template-marketplace capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |
| Durable workflows | Not supported | "No workflows-durable capability documented in current README, package metadata or standalone proxy docs." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md) |

## Agent readiness

### Read: 4 of 5 signals present

4/5 signals (3 full, 1 partial)

- Llms txt: na — "No dedicated product domain; GitHub host-wide discovery policy is not attributable to this repository."
- Llms full txt: na — "No dedicated product domain; GitHub host-wide discovery policy is not attributable to this repository."
- Robots AI policy: na — "No dedicated product domain; GitHub host-wide discovery policy is not attributable to this repository."
- Sitemap: na — "No dedicated product domain; GitHub host-wide discovery policy is not attributable to this repository."
- JSON LD: fail — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Retained GitHub head has no JSON-LD."
- Meta quality: pass — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Descriptive title, description and Open Graph metadata retained in github-head.html."
- Markdown negotiation: partial — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Raw README Markdown available; no product-specific content negotiation."
- Content efficiency: na — "GitHub shared repository shell; host-wide ratio not a product site signal."
- Docs discoverable: pass — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — README first-class repository tab; usage and installation inline."
- Pricing machine readable: na — "Free self-host-only Apache-2.0 tool; no commercial tiers."
- Anti bot: pass — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Anonymous repository and raw README fetched without challenge."

### Drive: 3 of 6 signals present

3/6 signals (2 full, 1 partial)

- Public API: pass — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Documented local SandboxManager API, no hosted endpoint."
- Openapi spec: na — "No HTTP management API."
- MCP server: fail — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Runs third-party MCP servers but exposes no first-party MCP control server."
- SDK packages: partial — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — One TypeScript/JavaScript npm library, not multiple independently documented language SDKs."
- Auth docs: na — "Local CLI/library; no hosted API auth."
- Agent self serve creds: na — "No account or API key needed for local execution."
- Webhooks: na — "No hosted control-plane events."
- CLI tool: pass — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — Official npm-installed srt CLI."
- Error model: fail — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — No standardized documented JSON API error model."
- Rate limit docs: na — "No hosted service request quotas."
- Agent config: fail — "https://github.com/anthropics/sandbox-runtime/blob/main/README.md — No dedicated agent instruction/skill surface documented."

## Coding harnesses

- Claude Code (Anthropic) — "The Sandbox Runtime is a research preview developed for Claude Code to enable safer AI agents." [source](https://github.com/anthropics/sandbox-runtime/blob/main/README.md)

## Open source

- Repository: https://github.com/anthropics/sandbox-runtime
- License: Apache-2.0
- Stars: 6645
- Forks: 587
- Self-host methods: package-manager, source-build
- Self-host dependencies: nodejs, bubblewrap, socat, ripgrep

## Company & presence

- GitHub: https://github.com/anthropics/sandbox-runtime
- npm: https://www.npmjs.com/package/@anthropic-ai/sandbox-runtime

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [AWS Lambda MicroVMs](/products/lambda-microvms.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.