GitHub - anthropics/sandbox-runtime: A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

What happened

Anthropic published a beta tool called srt on GitHub. It runs any program inside a restricted space. The program can only touch the files and network addresses that you allow. It is installed with npm and can be used from the command line or as a code library.

How it works

srt uses the security features that each operating system already has. On macOS it uses sandbox-exec. On Linux it uses bubblewrap. It also filters network traffic through a proxy. The default setting is strict: a program starts with almost no access, and you open only the doors you need. On Windows, the program runs under a special local user account with its own network block.

Key facts

• Install with one command: npm install -g @anthropic-ai/sandbox-runtime
• Network: a site on the allowlist works, while a blocked site such as example.com is refused.
• Files: the current folder can be read, but a private file such as ~/.ssh/id_rsa is blocked.
• On macOS, it can read the system's sandbox violation log to alert you in real time.
• Settings live in a file called ~/.srt-settings.json.

Why it matters

AI agents and helper programs, called MCP servers, can run commands and change files on your computer. A tool like srt lets you limit the damage they can do. For example, you can stop an MCP server from writing to a folder you have marked as sensitive. The project is still early, so its settings and format may change.

What to watch

• Changes to the API and settings format, since the project calls itself an early research preview.
• Feedback and contributions from the open source community on GitHub.
• How well the Windows version works compared with macOS and Linux.