Anthropic open-sources Claude Code sandbox as @anthropic-ai/sandbox-runtime

The release moves a component that was internal to Claude Code into public view. According to the README, srt is a lightweight tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container, and it wraps each platform's native primitives rather than building its own isolation layer.

The feature list goes beyond simple file blocking: allow-only network policies with wildcard domain support, Unix-socket allowlisting, experimental TLS termination for MITM inspection of HTTPS, credential masking for environment variables and files, and AWS SigV4 request signing with masked keys. The docs show MCP servers being sandboxed by changing a single command field, from npx to srt.

Anthropic frames the release as a research preview developed for Claude Code to enable safer AI agents, and cautions that APIs and configuration formats may evolve. The Windows backend has documented holes: tools built on the system TLS stack, including System32\curl.exe, PowerShell's Invoke-WebRequest, .NET HttpClient and winget, cannot be used, and traffic routed through system services such as Windows Update escapes the WFP fence.