在文章中，我们将讨论Anthropic的沙盒运行时间(srt), Anthropic 沙盒- 运行时间限制：文件进程可以触摸，主机可以达到。 它这样做时没有旋转一个容器。 它也没有与Claude Code挂钩。 你自己的agents，本地的MCP服务器和普通命令线程序可以运行在它内部。
TL；数据
- 大小：npm 包@anthropic-ai/sandbox-runtime v0.0.81，约11.4 MB 已无包装，Apache-2.0, Node.js 22.12+.
- 运行在：任何macOS或Linux dev机器或CI盒上。 macOS使用Seatbelt;Linux需要气泡包装，小猫和rigrep. Windows为α.
- 性能：在Anthropic的内部用法(自报)中，沙箱切除Claude Code许可提示84%.
- 最佳：许可提示减少84%，在整个进程树上执行文件和网络限制。
- 最糟糕的：仍然是β研究预览，Windows支持是α.
Anthropic沙盒运行时间是什么？.
Anthropic sandbox-runtime是一个开源工具，它将任何进程包裹在文件系统和网络限制中。 您用 npm 安装 -g @ anthropic- ai/ sandbox- runtime 安装它，然后用 srt 预缀命令。 它作为CLI和TypeScript库工作。
macOS,Linux和Windows的沙盒运行时间如何工作？.
Srt使用每个操作系统自己的隔离原始。 它的限制涵盖了整个进程树，包括脚本和子进程。
- macOS：带动态生成的Seatbelt剖面图的沙盒执行器。 只需要拉链。
- Linux：带网络命名空间的泡泡包装。 它也需要小猫和小狗
- Windows(alpha)：一个专用的srt-sandbox账户，Windows过滤平台的入侵栅栏和明确的文件ACL.
交通仅通过HTTP和SOCKS5代理在主机上运行。 在Linux，这些代理坐在Unix插座后面绑在沙盒里在macOS上，Seatbelt配置文件只允许一个本地主机端口。 代理人然后应用您的域名允许列表和否定列表。
为什么它既需要文件系统又需要网络隔离？
Anthropic团队认为，没有另一个边界的1个边界失效。 没有网络隔离，即时注射的agent可以释放SSH密钥。 没有文件系统隔离，它就可以逃脱沙盒并获得网络访问。
Srt的缺省符合这个逻辑。 除非被拒绝，任何地方都允许阅读。 除非允许，否则任何地方的写作都会被拒绝。 网络访问被拒绝，除非一个域被允许上市。
如何是沙盒 MCP服务器或你自己的agent?
对于MCP服务器，将.mcp.json中的命令从npx改为srt. 传递原命令为参数。 规则然后在~/.strt-s设置中存在.json:
{
"网络":{"allowedDomains":["api.github.com","*.npmjs.org"],"拒绝域":[]]]
"文件系统":{"deyRead":["~/.ssh],"allowWrite":[".],"deyWrite":[.env]]]
}
对于你自己的agent，图书馆曝光SandboxManager. 呼叫初始化( 配置) 启动代理。 然后 WithSandbox () 返回您可以产卵的包裹命令串。
84%的数字是什么意思？
Anthropic报告，在内部Claude Code使用中，沙箱的许可提示减少84%. 这是一个自报的号码，不是外部的基准测试。 目标是批准疲劳症。 整天点击“ 认可” 的开发者停止读取他们批准的内容。 一个固定的边界让agent在它内部自由工作，只在边缘询问。
真正的权衡：严格的允许列表对工作 agents
编码agents比编辑文件做得更多。 他们安装依赖，拉 Docs 并呼叫 API. 使允许列表过于严格，npm 安装失败。 松得太松沙盒保护得很少 srt ship 数个把手为中间地带：
- 通卡和端口：条目如*.npmjs.org或api.example.com:443.
- 问回调：确定主机没有规则封面，可以返回模型读取的原因。
- 命令允许列表：只打开1个引用的注册。
- 实时更新：-- Control-fd 在命令运行时互换网络列表。
- 解析地址检查：块允许有解析回路或云化元数据IP的名称。
- 拒绝理由：向agent报告受制裁的替代品，如HTTPS git遥控器。
与其他 agent 沙盒相比，它是如何比较的？
关键外卖
- Srt sandbox 操作系统一级的任何进程，不需要容器。
- macOS的座椅，Linux的泡布，Windows的α.
- 网络是默认的；每个连接都会通过主机侧授权列表代理。
- Anthropic报告Claude Code许可提示减少84%(内部).
- 允许列表宽度是真正的安全拨号；宽域可以泄露数据。
请检查access-date=中的日期值 (帮助) GitHub repo, Anthropic工程站和 Claude Code沙箱docs. 所有功劳都归功于这个项目的研究人员。 并加入我们的通讯。 等等你在电报里吗现在你也可以加入我们的电报。
需要和我们合作推广您的 GitHub Repo OR Hugging Face Page OR Product Release OR Webinar 等吗？联系我们
Asif Razzaq是Marktechpost AI Media Inc.的首席执行官。 作为一个有远见的企业家和工程师，阿西夫致力于利用人工智能的潜力促进社会福祉。 他最近的努力是人工智能媒体平台的发布，该平台以深入报道机器学习和深层学习新闻而著称，这些新闻在技术上既可靠又为广大观众所容易理解。 该平台每月有超过200万次观看，表明其受观众欢迎。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
In this article, we will discuss newly trending open sourced Anthropic’s sandbox-runtime (srt), the OS-level sandbox behind Claude Code’s sandboxed bash tool. The Anthropic sandbox-runtime limits which files a process can touch and which hosts it can reach. It does this without spinning up a container. It is also not tied to Claude Code. Your own agents, local MCP servers and plain command-line programs can run inside it.
TL;DR
- Size: npm package @anthropic-ai/sandbox-runtime v0.0.81, about 11.4 MB unpacked, Apache-2.0, Node.js 22.12+.
- Runs on: any macOS or Linux dev machine or CI box. macOS uses Seatbelt; Linux needs bubblewrap, socat and ripgrep. Windows is alpha.
- Performance: sandboxing cut Claude Code permission prompts by 84% in Anthropic’s internal usage (self-reported).
- Best: 84% fewer permission prompts, with file and network limits enforced on the whole process tree.
- Worst: still a beta research preview, Windows support is alpha.
What is Anthropic sandbox-runtime?
Anthropic sandbox-runtime is an open-source tool that wraps any process in filesystem and network restrictions. You install it with npm install -g @anthropic-ai/sandbox-runtime, then prefix a command with srt. It works as a CLI and as a TypeScript library.
How does sandbox-runtime work on macOS, Linux and Windows?
srt uses each operating system’s own isolation primitives. Its restrictions cover the entire process tree, including scripts and subprocesses.
- macOS: sandbox-exec with dynamically generated Seatbelt profiles. Only ripgrep is required.
- Linux: bubblewrap with the network namespace removed. It also needs socat and ripgrep.
- Windows (alpha): a dedicated srt-sandbox account, a Windows Filtering Platform egress fence and explicit file ACLs.
Traffic leaves only through HTTP and SOCKS5 proxies running on the host. On Linux, those proxies sit behind Unix sockets bind-mounted into the sandbox. On macOS, the Seatbelt profile allows only one localhost port. The proxies then apply your domain allowlist and denylist.
Why does it need both filesystem and network isolation?
Anthropic team argues that 1 boundary without the other fails. Without network isolation, a prompt-injected agent could exfiltrate SSH keys. Without filesystem isolation, it could escape the sandbox and gain network access.
srt’s defaults follow that logic. Reads are allowed everywhere unless denied. Writes are denied everywhere unless allowed. Network access is denied unless a domain is allowlisted.
How do you sandbox an MCP server or your own agent?
For an MCP server, change the command in .mcp.json from npx to srt. Pass the original command as arguments. Rules then live in ~/.srt-settings.json:
{
"network": { "allowedDomains": ["api.github.com", "*.npmjs.org"], "deniedDomains": [] },
"filesystem": { "denyRead": ["~/.ssh"], "allowWrite": ["."], "denyWrite": [".env"] }
}
For your own agent, the library exposes SandboxManager. Call initialize(config) to start the proxies. Then wrapWithSandbox() returns a wrapped command string you can spawn.
What does the 84% figure mean?
Anthropic reports that sandboxing reduced permission prompts by 84% in internal Claude Code usage. That is a self-reported number, not an external benchmark. The target is approval fatigue. Developers who click “approve” all day stop reading what they approve. A fixed boundary lets the agent work freely inside it and ask only at the edge.
The real trade-off: strict allowlists vs working agents
Coding agents do more than edit files. They install dependencies, pull docs and call APIs. Make the allowlist too strict and npm install fails. Make it too loose and the sandbox protects little. srt ships several knobs for that middle ground:
- Wildcards and ports: entries like *.npmjs.org or api.example.com:443.
- Ask callback: decides hosts no rule covers, and can return a reason the model reads.
- Per-command allow lists: open a registry for 1 invocation only.
- Live updates: --control-fd swaps network lists while a command runs.
- Resolved-address check: blocks allowed names that resolve to loopback or cloud metadata IPs.
- Denied-domain reasons: tell the agent the sanctioned alternative, such as an HTTPS git remote..
How does it compare with other agent sandboxes?
Key Takeaways
- srt sandboxes any process at the OS level, no container needed.
- Seatbelt on macOS, bubblewrap on Linux, Windows in alpha.
- Network is deny-by-default; every connection passes a host-side allowlist proxy.
- Anthropic reports 84% fewer Claude Code permission prompts (internal).
- Allowlist breadth is the real security dial; broad domains can leak data.
Check out the GitHub repo, the Anthropic engineering post and the Claude Code sandboxing docs. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Asif Razzaq is the CEO of Marktechpost AI Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.