#1414th of 18 in Sandboxes
sandbox-runtime
OS-level filesystem and network sandbox for agents and arbitrary processes, no container
- Stars
- 7.1k
- License
- Apache-2.0
- Last commit
- Nov 2026
- Last release
- Nov 2026
- Language
- TypeScript
3,832 on 21 Apr 20267,098 on 10 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Anthropic is hiring: 670 open roles
Overview
srt wraps any command in filesystem and network restrictions using sandbox-exec on macOS, bubblewrap on Linux, and a dedicated local user account with Windows Filtering Platform rules on Windows. Network traffic goes through host-side HTTP and SOCKS5 proxies that enforce domain allow and deny lists. It works as a CLI or a TypeScript library, and is aimed at sandboxing agents, local MCP servers and bash commands. It is labelled a beta research preview from Claude Code.
Who it is for: Developers sandboxing agents, MCP servers or shell commands without containers
Strengths
- No container needed; uses native OS primitives on macOS, Linux and Windows
- Deny-by-default network and write access, configured in ~/.srt-settings.json
- Usable as CLI or library, with per-command allow lists and an ask callback
- Config can be updated at runtime for network rules via --control-fd
Weaknesses
- Beta research preview; APIs and config formats may change
- Reads are allowed everywhere by default unless denyRead is configured
- Windows filters miss threads with swapped tokens and traffic carried by system services
- Filesystem rules cannot change after the command starts
What it needs
- no GPU
- Needs bubblewrap (Linux), sandbox-exec (macOS), Node.js/npm
What changed
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in Sandboxes
See all 18| Rank | Project | Score |
|---|---|---|
| 1 | LightpandaHeadless browser written in Zig for agents and scraping, with CDP and MCP | 94 out of 100 |
| 2 | OpenShellPolicy-enforced sandbox runtime for autonomous AI agents | 89 out of 100 |
| 3 | ObscuraRust headless browser with V8 and CDP for scraping and agents | 87 out of 100 |
| #4 | opensandboxSandbox API for running AI agent code, commands and browsers in isolation | 87 out of 100 |
| #5 | NemoClawReference stack for running OpenClaw, Hermes and Deep Agents in OpenShell sandboxes | 86 out of 100 |