Sandbox filesystem and network access without requiring a container (github.com)

Anthropic released srt (Sandbox Runtime), a lightweight open-source research preview and CLI/library (npm @anthropic-ai/sandbox-runtime) that enforces filesystem, socket and network restrictions on arbitrary processes without full containers. srt wraps commands or MCP servers (e.g., Model Context Protocol filesystem server) and uses native OS primitives—macOS sandbox-exec with dynamically generated Seatbelt profiles and Linux bubblewrap—plus host-side HTTP/SOCKS5 proxy filtering to mediate and log all network traffic. The sandbox enforces policies at the OS level across the entire process tree, supports violation monitoring on macOS, and exposes a programmatic API (SandboxManager) for integration. This matters for AI/ML teams building agentic systems: srt provides secure-by-default, least-privilege confinement to reduce exfiltration and lateral access (e.g., blocking reads of ~/.ssh while allowing network access only to whitelisted domains). Key technical details: default semantics are read-allowed by default but writable only to the current working directory (explicit Edit/Read/WebFetch permission rules in Claude Code-style settings); macOS supports git-style globs while Linux requires literal paths; network isolation routes traffic through host proxies (Linux via bind-mounted Unix sockets + socat, macOS via localized Seatbelt-allowed ports); HTTP/HTTPS are validated by an HTTP proxy and other TCP traffic by SOCKS5. Windows is not yet supported; Linux requires bubblewrap, socat and ripgrep. As a beta research preview, the config/API may evolve and community feedback is invited.