# AI use cases for Sandbox Runtime (anthropics/sandbox-runtime)

Repo: [anthropics/sandbox-runtime](https://github.com/anthropics/sandbox-runtime) | Use cases: 3 | Page: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/

Anthropic Sandbox Runtime (srt) is a lightweight tool that enforces filesystem and network restrictions on any process at the OS level, without a container. It uses sandbox-exec on macOS, bubblewrap on Linux and a dedicated local account on Windows, plus proxy-based network filtering, and was built for Claude Code to sandbox agents, local MCP servers and bash commands.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Sandbox an MCP server with one line in .mcp.json: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/sandbox-an-mcp-server/
- Keep agent shell commands away from your SSH keys: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/block-agent-commands-from-ssh-keys-and-internet/
- Change network rules while a sandboxed command runs: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/change-sandbox-rules-while-a-command-runs/

## How to sandbox an MCP server with one line in .mcp.json with Sandbox Runtime

Repo: [anthropics/sandbox-runtime](https://github.com/anthropics/sandbox-runtime) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README

Wrap a local MCP server in srt so it can only write and connect where you allow.

**Who it is for:** A developer adding a community MCP server to Claude Code who does not fully trust what it might write or call.

**The problem:** A local MCP server runs with your full user permissions, so a bad one can read secrets or write anywhere.

**The outcome:** The same MCP server running under OS-level limits, with writes outside allowed paths failing with operation not permitted.

### Steps

1. Run `npm install -g @anthropic-ai/sandbox-runtime`
2. In .mcp.json, change the server's command to srt and move the original command into args, for example `"command": "srt"` with `"args": ["npx", "-y", "@modelcontextprotocol/server-filesystem"]`
3. Create ~/.srt-settings.json with filesystem rules (denyRead, allowWrite, denyWrite) and network rules (allowedDomains, deniedDomains)
4. Restart your agent and ask the MCP server to write to a denied path to confirm it gets EPERM

### Prompt to paste into your agent

```text
Install anthropics/sandbox-runtime and wrap my <MCP server> in srt in .mcp.json. Write ~/.srt-settings.json so it can write only to <allowed path> and reach only <allowed domains>, then prove it by asking it to write to <denied path> and showing me the error.
```

### Caveat

It is a beta research preview, so the README warns that APIs and configuration formats may change.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/sandbox-an-mcp-server/

## How to keep agent shell commands away from your SSH keys with Sandbox Runtime

Repo: [anthropics/sandbox-runtime](https://github.com/anthropics/sandbox-runtime) | Difficulty: Beginner | Time: 20 minutes | Basis: From the README

Run bash commands through srt so they get no network by default and cannot read the files you deny.

**Who it is for:** Someone letting an agent run shell commands who wants a hard stop on reading ~/.ssh or sending data out.

**The problem:** Without file and network isolation, one bad command can read SSH keys and send them anywhere.

**The outcome:** Commands that work in the project folder but fail on denied files and on any domain you did not allow.

### Steps

1. Install with `npm install -g @anthropic-ai/sandbox-runtime`
2. Try it: `srt "curl example.com"` is blocked by the network allowlist, while reads in the current directory work
3. Add the hosts a task really needs to network.allowedDomains in ~/.srt-settings.json, since network access is denied by default
4. Deny sensitive files with denyRead, for example a pattern for .env files, and allow writes only where needed
5. Run a real task with a specific config: `srt --settings /path/to/srt-settings.json npm install`

### Prompt to paste into your agent

```text
Using anthropics/sandbox-runtime, write an srt settings file for <project> that allows network only to <domains>, denies reads of ~/.ssh and **/.env, and allows writes only to the project folder. Run <command> under it with `srt --settings` and report anything that was blocked.
```

### Caveat

Reads are allowed everywhere by default and writes are denied, so you must add denyRead rules yourself; the Windows filters also have known limitations listed in the README.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/block-agent-commands-from-ssh-keys-and-internet/

## How to change network rules while a sandboxed command runs with Sandbox Runtime

Repo: [anthropics/sandbox-runtime](https://github.com/anthropics/sandbox-runtime) | Difficulty: Advanced | Time: 1 hour | Basis: From the README

Feed srt new configs through a control channel so an orchestrator can open or close domains mid-run.

**Who it is for:** An engineer building an agent harness that needs to grant or revoke network access during a long task.

**The problem:** Restarting a sandboxed process every time an agent needs one more domain throws away its progress.

**The outcome:** A running command whose network allowlist updates on the next connection, with no restart.

### Steps

1. Start the command with a control descriptor: `srt --control-fd 3 -- npm test`, where fd 3 is the read end of a pipe your harness writes to
2. Write one full JSON config per line in the same shape as the settings file; network and filesystem are both required
3. Changes to allowedDomains, deniedDomains and related network lists apply on the next connection on every platform
4. Keep filesystem rules in the settings file: they are fixed when the command starts and later lines do not change them
5. Watch stderr: an invalid line is reported and dropped, and the previous config stays in force

### Prompt to paste into your agent

```text
Wrap <long running command> with anthropics/sandbox-runtime using --control-fd from my harness. Start with no network access, then send a config line that allows <domain> when the task needs it and remove it afterwards. Log every config line srt accepted or rejected.
```

### Caveat

Each line replaces the whole config rather than patching it, so a key you leave out goes back to its default.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/anthropics-sandbox-runtime/change-sandbox-rules-while-a-command-runs/