Claude Code's sandbox is an open npm package you can run and probe yourself

Anthropic ships the sandbox behind Claude Code as a standalone, open-source npm package, which means developers no longer have to take its security boundary on faith. A post on dev.to by Gabriel Anhaia walks through @anthropic-ai/sandbox-runtime, the package Claude Code's documentation credits as the foundation of its sandboxing, and shows how the bundled srt command can wrap any shell command to reveal exactly what the boundary permits and what it refuses.

How the runtime enforces its boundary

The package — listed at version 0.0.80 on npm, licensed Apache-2.0, and requiring Node.js 22.12.0 or newer — uses no containers and no virtual machines. According to the post, macOS enforcement runs through sandbox-exec with a generated Seatbelt profile, Linux relies on bubblewrap, and Windows support is marked alpha. The README labels the project a beta research preview whose APIs and configuration formats may still change. Network access is policed by two proxies, one HTTP and one SOCKS5, that run on the host outside the sandbox; the sandboxed process has no other exit, because Linux removes its network namespace entirely and the macOS Seatbelt profile permits communication only with a single localhost port.

What the default policy allows

The runtime is allow-list-minded by design. Reads are permitted everywhere unless a deny list names the path; writes are rejected everywhere unless an allow list names the path; network traffic is dropped unless the destination host is allow-listed, with denied domains checked first. Settings live in ~/.srt-settings.json, and the post reports the schema demands all five lists, empty ones included — a file that exists but is invalid makes srt refuse to start, which the author considers correct behavior for a security tool. With no settings file at all, srt still launches, but with no network and writes confined to runtime paths such as /tmp/claude. Notably, Anthropic's own documentation concedes that a sandboxed command can read most of the machine, including ~/.ssh and ~/.aws/credentials, until those paths are explicitly denied.

Practically, the README says to install srt globally rather than into a project: a copy inside a writable node_modules folder could be rewritten by a sandboxed command and then run unsandboxed on the next launch. macOS setups also need ripgrep on the PATH — it is how srt locates paths to deny — while Linux needs bubblewrap and socat, and Ubuntu 24.04 and later require an AppArmor adjustment before bubblewrap can create user namespaces.

Where the boundary leaks

Two enforcement layers leave documented gaps. The proxies judge connections by hostname and, by default, do not terminate or inspect TLS, so the post warns that generous entries such as github.com can become exfiltration channels, and the README concedes domain fronting may slip past the filter. Tools that ignore the HTTP_PROXY, HTTPS_PROXY and ALL_PROXY variables discover there is no route at all — which is why plain ssh and most database drivers cannot connect even to allowed hosts, and UDP, QUIC and ping cannot leave either.

Built-in write denials also guard paths like .git/hooks, .gitconfig, .vscode, .mcp.json and .claude/commands inside otherwise writable folders — the spots where a sandboxed process could plant code that something unsandboxed later executes. On Linux that deny list is built once at launch, so repositories created mid-session with git init or git clone go uncovered. Blocked operations are at least legible: denied reads fail with 'Operation not permitted', and a refused web request returns a 403 carrying an X-Proxy-Error header that names the sandbox runtime.

Inside Claude Code, the sandbox is narrower

Within Claude Code, the /sandbox mechanism wraps shell commands only. The Read, Edit, WebFetch and WebSearch tools, hooks, local MCP servers and LSP servers all operate outside it, so a denyRead entry does not stop the Read tool. Sandboxing is also off by default, and if a dependency is missing, Claude Code runs commands unsandboxed unless told otherwise. Anthropic introduced the approach in an October 20, 2025 post titled Beyond permission prompts, reporting an 84% cut in permission prompts from internal usage — a figure the dev.to post flags as Anthropic's own measurement rather than an independent one.

Why it matters

Guardrails for coding agents earn trust only when they can be examined. Publishing the sandbox as an Apache-2.0 package converts a vendor claim into a testable artifact: any team can wrap a probe script in srt, watch which operations fail and which succeed, and tune policy before letting an agent run with fewer interruptions. The same transparency exposes honest limits — credential files stay readable by default, TLS goes uninspected, and several tools never enter the sandbox at all — so the sensible posture is verification rather than assumption. For anyone running Claude Code, the standalone CLI is the cheapest audit available: a throwaway repo and a few probe commands show precisely what the sandbox will and will not stop.