在文章中，我们将讨论Anthropic的沙盒运行时间(srt), Anthropic sandbox- runtime 限制文件一个进程可以被触摸，并且它能够达到的主机。 它这样做的时候没有旋转一个容器。 它也没有与Claude Code绑起。 您自己的 agents，本地的 MCP 服务器和普通命令行程序可以运行在它内部。
TL; DR 数据
- 大小：npm 包@anthropic-ai/sandbox-runtime v0.0.81，约11.4 MB已打包，Apache-2.0,Node.js 22.12+.
- 运行在：任何macOS或Linux Dev机器或CI盒上。 macOS使用"Seatbelt";Linux需要"泡泡包装","小猫"和"rigrep". Windows为α.
- 性能：在Anthropic的内部用法(自报)中，用沙箱将Claude Code的许可提示切出84%.
- 最佳：许可提示减少84%，在整个进程树上执行文件和网络限制。
- 最糟糕的：仍然是β研究预览，Windows支持是α.
Anthropic沙盒运行时间是什么？.
Anthropic sandbox-runtime是一款开源工具，将任何进程包入文件系统和网络限制。 您用 npm 安装 -g @ anthropic- ai/ sandbox- runtime 安装它，然后用 srt 设置一个命令。 它作为CLI和TypeScript库工作。
macOS,Linux和Windows的沙盒-运行时间如何工作？.
Srt使用每个操作系统自己的隔离原始。 它的限制涵盖了整个进程树，包括脚本和子进程。
- macOS：带有动态生成的Seatbelt剖面图的沙盒-执行。 仅需要取出取出( riggrep)。
- Linux：取消网络命名空间的泡沫包装。 还需要小猫和小狗
- Windows (alpha)：一个专用的srt-sandbox账户，Windows滤镜平台外墙和明确文件ACL.
交通仅通过HTTP和SOCKS5代理运行于主机上。 在Linux上，这些代理坐落在Unix套接字后被绑入了沙盒。 在macOS上，"Seatbelt"简介只允许一个本地主机端口。 代理人然后应用您的域名允许列表和否定列表。
为什么它既需要文件系统又需要网络隔离？
Anthropic团队认为，一个边界没有另一个边界就失效了。 没有网络隔离，被迅速注入的agent可以释放出SSH密钥。 没有文件系统隔离，它可以从沙盒中逃脱并获得网络访问。
Srt的默认遵循了这一逻辑。 除非被拒绝，任何地方都允许阅读。 除非允许，否则所有地方都不准写作。 网络访问被拒绝，除非一个域被允许上市。
MCP服务器或自己的agent是怎样的？
对于MCP服务器，将.mcp.json中的命令从npx改为srt. 通过原命令作为参数。 然后规则在~.strt-s设置.json:
{
"网络": {"allowedDomains": ["api.github.com","*.npmjs.org","拒绝域": []}
"文件系统":{"去""去""去""去""去""去""去""去""去""去""去""去""去""去""去""去""去""去""去""去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去"去""去"去"去"去"去"""去""去"""""""""""
}
对于你自己的agent，图书馆曝光了SandboxManager. 调用初始化( 配置) 启动代理。 然后将 WithSandbox () 包装返回您可以产卵的包裹命令串。
84%的数字是什么意思？
Anthropic报道说，在内部的Claude Code使用中，沙箱将许可提示减少84%. 这是一个自报的号码，不是外部的基准测试。 目标是批准疲劳症。 整天点击“ 认可” 的开发者停止读取他们批准的内容。 一个固定的边界让agent在它内部自由工作，并且只在边缘询问。
真正的取舍：严格的许可列表对工作 agents
编码agents比编辑文件做得更多。 他们安装依赖，拉出文件并呼叫API. 让允许列表过于严格，npm 安装失败。 松得太松沙盒保护得很少 srt为中间地带准备了几个把手：
- 通卡和端口：条目如 *.npmjs.org 或 api.example.com:443.
- 问回调：确定主机没有规则封面，并且可以返回模型读取的原因。
- 命令允许列表：只打开1个引用的注册。
- 实时更新：-- control-fd在命令运行时互换网络列表。
- 解析地址检查：块允许有解析回放或云化元数据IP的名称。
- 拒绝理由：告诉agent 受制裁的替代品，如HTTPS git遥控器。
与其他 agent 沙盒相比如何？.
关键外卖
- 操作系统一级的任何过程，不需要容器。
- macOS上的安全带，Linux上放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放放
- 网络是逐一拒绝；每个连接都会通过主机侧授权列表代理。
- Anthropic报告Claude Code许可提示减少84%(内部).
- 允许列表宽度是真正的安全拨号；宽域可以泄露数据。
请检查access-date=中的日期值 (帮助) GitHub repo, Anthropic工程站和Claude Code沙箱道克。 所有功劳都归功于这个项目的研究人员。 并加入我们的通讯。 等等，你在电报里吗？现在你也可以加入我们的电报。
需要和我们合作推广您的 GitHub Repo OR Hugging Face Page OR Product Release OR Webinar等吗？联系我们
Asif Razzaq是Marktechpost AI Media Inc.的首席执行官。 作为一个有远见的企业家和工程师，阿西夫致力于利用人工智能的潜力为社会造福。 他最近的努力是人工智能媒体平台的发布，该平台以深入报道机器学习和深层学习新闻而出名，这些新闻在技术上既可靠又为广大观众所容易理解。 该平台每月有超过200万次观看，表明其受观众欢迎。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
In this article, we will discuss newly trending open sourced Anthropic’s sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash tool. The Anthropic sandbox-runtime limits which files a process can touch and which hosts it can reach. It does this without spinning up a container. It is also not tied to Claude Code. Your own agents, local MCP servers and plain command-line programs can run inside it.
TL;DR
- Size: npm package @anthropic-ai/sandbox-runtime v0.0.81, about 11.4 MB unpacked, Apache-2.0, Node.js 22.12+.
- Runs on: any macOS or Linux dev machine or CI box. macOS uses Seatbelt; Linux needs bubblewrap, socat and ripgrep. Windows is alpha.
- Performance: sandboxing cut Claude Code permission prompts by 84% in Anthropic’s internal usage (self-reported).
- Best: 84% fewer permission prompts, with file and network limits enforced on the whole process tree.
- Worst: still a beta research preview, Windows support is alpha.
What is Anthropic sandbox-runtime?
Anthropic sandbox-runtime is an open-source tool that wraps any process in filesystem and network restrictions. You install it with npm install -g @anthropic-ai/sandbox-runtime, then prefix a command with srt. It works as a CLI and as a TypeScript library.
How does sandbox-runtime work on macOS, Linux and Windows?
srt uses each operating system’s own isolation primitives. Its restrictions cover the entire process tree, including scripts and subprocesses.
- macOS: sandbox-exec with dynamically generated Seatbelt profiles. Only ripgrep is required.
- Linux: bubblewrap with the network namespace removed. It also needs socat and ripgrep.
- Windows (alpha): a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and explicit file ACLs.
Traffic leaves only through HTTP and SOCKS5 proxies running on the host. On Linux, those proxies sit behind Unix sockets bind-mounted into the sandbox. On macOS, the Seatbelt profile allows only one localhost port. The proxies then apply your domain allowlist and denylist.
Why does it need both filesystem and network isolation?
Anthropic team argues that 1 boundary without the other fails. Without network isolation, a prompt-injected agent could exfiltrate SSH keys. Without filesystem isolation, it could escape the sandbox and gain network access.
srt’s defaults follow that logic. Reads are allowed everywhere unless denied. Writes are denied everywhere unless allowed. Network access is denied unless a domain is allowlisted.
How do you sandbox an MCP server or your own agent?
For an MCP server, change the command in .mcp.json from npx to srt. Pass the original command as arguments. Rules then live in ~/.srt-settings.json:
{
"network": { "allowedDomains": ["api.github.com", "*.npmjs.org"], "deniedDomains": [] },
"filesystem": { "denyRead": ["~/.ssh"], "allowWrite": ["."], "denyWrite": [".env"] }
}
For your own agent, the library exposes SandboxManager. Call initialize(config) to start the proxies. Then wrapWithSandbox() returns a wrapped command string you can spawn.
What does the 84% figure mean?
Anthropic reports that sandboxing reduced permission prompts by 84% in internal Claude Code usage. That is a self-reported number, not an external benchmark. The target is approval fatigue. Developers who click “approve” all day stop reading what they approve. A fixed boundary lets the agent work freely inside it and ask only at the edge.
The real trade-off: strict allowlists vs working agents
Coding agents do more than edit files. They install dependencies, pull docs and call APIs. Make the allowlist too strict and npm install fails. Make it too loose and the sandbox protects little. srt ships several knobs for that middle ground:
- Wildcards and ports: entries like *.npmjs.org or api.example.com:443.
- Ask callback: decides hosts no rule covers, and can return a reason the model reads.
- Per-command allow lists: open a registry for 1 invocation only.
- Live updates: --control-fd swaps network lists while a command runs.
- Resolved-address check: blocks allowed names that resolve to loopback or cloud metadata IPs.
- Denied-domain reasons: tell the agent the sanctioned alternative, such as an HTTPS git remote..
How does it compare with other agent sandboxes?
Key Takeaways
- srt sandboxes any process at the OS level, no container needed.
- Seatbelt on macOS, bubblewrap on Linux, Windows in alpha.
- Network is deny-by-default; every connection passes a host-side allowlist proxy.
- Anthropic reports 84% fewer Claude Code permission prompts (internal).
- Allowlist breadth is the real security dial; broad domains can leak data.
Check out the GitHub repo, the Anthropic engineering post and the Claude Code sandboxing docs. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Asif Razzaq is the CEO of Marktechpost AI Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.