Anthropic Open-Sources Claude Code Sandbox Under Apache 2.0

Anthropic has released the sandbox that runs behind Claude Code as an open-source npm package, `@anthropic-ai/sandbox-runtime`, under the Apache-2.0 license. The project README describes srt as "a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container."

The runtime wraps each platform's native primitives. On macOS it uses `sandbox-exec` with dynamically generated Seatbelt profiles. On Linux it uses `bubblewrap` with network namespace isolation. The Windows build combines a Windows Filtering Platform egress fence with a write-restricted token and explicit NTFS ACLs, and ships a bundled `srt-win.exe` helper for x64 and arm64. A one-time elevated `windows-install` step provisions a dedicated `srt-sandbox` local user account and the machine-wide WFP filter set.

Features called out in the README include an allow-only network policy with wildcard domain support, Unix-socket allowlisting, experimental TLS termination for MITM inspection of HTTPS, credential masking for environment variables and files, and AWS SigV4 request signing with masked keys. The docs show drop-in MCP server sandboxing by swapping the `command` field in an `.mcp.json` entry from `npx` to `srt`.

The repo frames the release as "a research preview developed for Claude Code to enable safer AI agents" and cautions that "APIs and configuration formats may evolve." The Windows backend documents specific holes. Tools built on the system TLS stack (Schannel), including `System32\curl.exe`, PowerShell's `Invoke-WebRequest`, .NET `HttpClient`, and `winget`, cannot be used, and traffic routed through system services such as Windows Update escapes the WFP fence.