Anthropic’s open Sandbox Runtime is a CLI and library that wraps commands and MCP servers with operating-system restrictions on files, networking, and local sockets. It uses Seatbelt on macOS and bubblewrap on Linux; the current repository also describes a separate-account and network-filter approach for Windows. Network access is blocked by default, but filesystem reads are allowed, so sensitive paths require explicit read restrictions. APIs and configuration may change during the research preview, and documented limitations include some delegated Windows traffic. The tool alone does not guarantee complete isolation.