如何在 Claude Code 中用一行設定為任何 MCP 伺服器加上沙箱限制

An MCP server is a program you hand to your agent and let run on your machine, with your user's permissions. Most are fine. If one is buggy or compromised, it can read your SSH keys or call out to any host. Anthropic's Sandbox Runtime (srt) wraps any process in OS-level file and network limits, no container needed. Here is the setup with the real commands. The short version lives on the Deduped use-case page.

What srt does

srt uses sandbox-exec on macOS and bubblewrap on Linux, plus proxy-based network filtering. It was built for Claude Code and is a beta research preview, so config formats may change. Defaults are strict: no network access, no writes outside the working paths, and reads allowed everywhere unless you deny them.

Install

npm install -g @anthropic-ai/sandbox-runtime

Try it before wiring anything

srt "curl anthropic.com"
srt "curl example.com"
srt "cat ~/.ssh/id_rsa"

With an allowlist containing anthropic.com, the first call succeeds. The second prints "Connection blocked by network allowlist". The third fails with "Operation not permitted". That is the whole idea: the process only gets the holes you poke.

Wrap an MCP server

Your unsandboxed .mcp.json entry probably looks like this:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem"]
    }
  }
}

Change the command to srt and move the old command into args:

{
  "mcpServers": {
    "filesystem": {
      "command": "srt",
      "args": ["npx", "-y", "@modelcontextprotocol/server-filesystem"]
    }
  }
}

Set the limits

Create ~/.srt-settings.json:

{
  "filesystem": {
    "denyRead": [],
    "allowWrite": ["."],
    "denyWrite": ["~/sensitive-folder"]
  },
  "network": {
    "allowedDomains": [],
    "deniedDomains": []
  }
}

Writes are allow-only, so allowWrite lists the places the server may write. Reads are deny-then-allow. Network is allow-only: an empty allowedDomains means no network at all, so add the hosts your server really needs.

One gotcha from the README: if the settings file exists but is empty or invalid, srt exits with an error instead of falling back to defaults. That is on purpose, because a silent fallback would drop your deny rules.

Test that it bites

Ask your agent to write a file into the denied folder. You should see an EPERM "operation not permitted" error. If the write succeeds, your config is not being read, so check the path and run srt --debug on a sample command.

srt --debug curl https://example.com
srt --settings /path/to/srt-settings.json npm install

Where it stops

Sandboxing limits what the server can touch, not what it is told to do with data you give it. Keep secrets out of the folders you allow, and keep the allowlist short. Windows support is newer and has documented known limitations, so read that section of the README first.

For another way to cut risk in Claude Code, see the GitHub MCP server walkthrough.

Want the setup commands for 50 AI repos people actually ship with? Get the free AI Repos That Actually Ship pack: https://dedupedai.com/ship-pack/?utm_source=devto&utm_medium=article&utm_campaign=shippack