Anthropic Sandbox Runtime

Anthropic's README describes it as "A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container." According to Anthropic, "This package provides a standalone sandbox implementation that can be used as both a CLI tool and a library," and "It can be used to sandbox the behaviour of agents, local MCP servers, bash commands and arbitrary processes." Anthropic calls it "a research preview developed for Claude Code to enable safer AI agents." Per the README, it uses sandbox-exec with dynamically generated Seatbelt profiles on macOS, bubblewrap with network namespace isolation on Linux, and on Windows runs the process under a dedicated local user account with a Windows Filtering Platform egress fence.

Who it's for:Anthropic says it can sandbox AI agents, local MCP servers and command-line scripts, so it suits developers doing that work. Readers who don't write code won't get much from it.

Before you start: install it with npm install -g @anthropic-ai/sandbox-runtime. It's under the Apache-2.0 licence, and the README lists no account or fees. Anthropic notes that network filtering only restricts which domains a process can reach and doesn't inspect the traffic, so you are responsible for allowing only trusted domains, and that exfiltration may still be possible even with a domain allowlist. It also warns that with allowAppleEvents on, a sandboxed command can launch any application without a prompt, and those applications run entirely outside the sandbox.

Based on the project's public documentation. Not tested by AI Inspiration World.