Repository Analysis

anthropic-experimental/sandbox-runtime

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

3.9 Likely human-written View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of anthropic-experimental/sandbox-runtime, a TypeScript project with 5,089 GitHub stars. SynthScan v2.0 examined 55,504 lines of code across 116 source files, recording 138 pattern matches distributed across 8 syntactic categories. The overall adjusted score of 3.9 places this repository in the Likely human-written band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

3.9
Adjusted Score
3.9
Raw Score
100%
Time Factor
2026-08-28
Last Push
5.1K
Stars
TypeScript
Language
55.5K
Lines of Code
116
Files
138
Pattern Hits
2026-08-29
Scan Date
0.01
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 1MEDIUM 36LOW 101

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 138 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators35 hits · 108 pts
SeverityFileLineSnippetContext
MEDIUMtest/sandbox/winsrt.test.ts625// ════════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts627// ════════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1343 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1345 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1365 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1367 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1416 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1418 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1451 // ── loopback port-range fence ────────────────────────────────────COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1484 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1486 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1550 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1552 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1644 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1646 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts2040// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMtest/sandbox/winsrt.test.ts2042// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMtest/sandbox/winsrt.test.ts2468// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMtest/sandbox/winsrt.test.ts2475// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/integration-tests.yml66 # ─── Windows: srt-win helper binary ─────────────────────────────COMMENT
MEDIUMsrc/cli.ts49 // ── Windows install/uninstall ─────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts2147// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts2149// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts58// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts60// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts153// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts155// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts479// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts481// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts606// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts608// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts781// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts783// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts1998// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts2000// ────────────────────────────────────────────────────────────────────COMMENT
Hyper-Verbose Identifiers46 hits · 44 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/http-proxy-verdict-liveness.test.ts273 async function clientSupportsHalfOpenReceive(): Promise<boolean> {CODE
LOWtest/sandbox/mandatory-deny-paths.test.ts378 async function runSandboxedWriteWithGitConfig(CODE
LOWtest/sandbox/mandatory-deny-paths.test.ts482 async function runSandboxedWriteWithDenyPaths(CODE
LOWtest/sandbox/mandatory-deny-paths.test.ts1017 async function runSandboxedCommandWithDenyPaths(CODE
LOWtest/sandbox/integration.test.ts43function assertPrecompiledBpfInUse(): void {CODE
LOWsrc/sandbox/sandbox-utils.ts51export function normalizeCaseForComparison(pathStr: string): string {CODE
LOWsrc/sandbox/sandbox-utils.ts79function containsGlobCharsForPlatform(p: string): boolean {CODE
LOWsrc/sandbox/sandbox-utils.ts824export function encodedCommandFromProxyUser(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts254function findFirstNonExistentComponent(targetPath: string): string {CODE
LOWsrc/sandbox/linux-sandbox-utils.ts275async function linuxGetMandatoryDenyPaths(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts413function registerExitCleanupHandler(): void {CODE
LOWsrc/sandbox/linux-sandbox-utils.ts605export async function initializeLinuxNetworkBridge(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts769function resolveApplySeccompPrefix(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts1686export async function wrapCommandWithSandboxLinux(CODE
LOWsrc/sandbox/body-substitution.ts107export function createBodySubstitutionTransform(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts79export function macGetMandatoryDenyPatterns(allowGitConfig = false): string[] {CODE
LOWsrc/sandbox/macos-sandbox-utils.ts331function generateReadDenyUnlinkRules(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts448function generateMoveBlockingRules(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts995export function wrapCommandWithSandboxMacOS(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts1204export function startMacOSSandboxLogMonitor(CODE
LOWsrc/sandbox/sandbox-manager.ts407function buildBodyCredentialInjector(): GetBodySubstitutions | undefined {CODE
LOWsrc/sandbox/sandbox-manager.ts476function shouldTerminateTLSForHost(host: string): boolean {CODE
LOWsrc/sandbox/sandbox-manager.ts1066function getCredentialRestrictions(CODE
LOWsrc/sandbox/sandbox-manager.ts1147function getCredentialDenyReadPaths(CODE
LOWsrc/sandbox/sandbox-manager.ts1273function computeWindowsFsAccessSet(c: SandboxRuntimeConfig): {CODE
LOWsrc/sandbox/sandbox-manager.ts1370function getNetworkRestrictionConfig(): NetworkRestrictionConfig {CODE
LOWsrc/sandbox/sandbox-manager.ts1410function getEnableWeakerNestedSandbox(): boolean | undefined {CODE
LOWsrc/sandbox/sandbox-manager.ts1414function getEnableWeakerNetworkIsolation(): boolean | undefined {CODE
LOWsrc/sandbox/sandbox-manager.ts1426function getMandatoryDenySearchDepth(): number {CODE
LOWsrc/sandbox/sandbox-manager.ts1477async function waitForNetworkInitialization(): Promise<boolean> {CODE
LOWsrc/sandbox/sandbox-manager.ts2222function annotateStderrWithSandboxFailures(CODE
LOWsrc/sandbox/sandbox-manager.ts2252function getLinuxGlobPatternWarnings(): string[] {CODE
LOWsrc/sandbox/generate-seccomp-filter.ts160export function getApplySeccompBinaryPath(CODE
LOWsrc/sandbox/domain-pattern.ts108export function matchesDomainPatternWithPort(CODE
LOWsrc/sandbox/domain-pattern.ts134export function isInjectHostCoveredByAllowedDomains(CODE
LOWsrc/sandbox/linux-violation-monitor.ts76export function startLinuxSandboxViolationMonitor(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts2154export function windowsInstallInstructions(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts861export function checkWindowsSandboxStatus(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts873export async function checkWindowsSandboxStatusAsync(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts1040export function getWindowsSandboxUserStatus(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts1049export async function getWindowsSandboxUserStatusAsync(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts1241export async function ensurePersistentWindowsCa(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts1601export async function installWindowsSandboxAsync(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts2020export function wrapCommandWithSandboxWindows(p: WindowsSandboxParams): {CODE
LOWsrc/sandbox/windows-sandbox-utils.ts2186function interpretDependencyProbes(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts2279export async function checkWindowsDependenciesAsync(CODE
Over-Commented Block46 hits · 43 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/credential-mask-sigv4.test.ts301 )COMMENT
LOWtest/sandbox/glob-expand.test.ts41COMMENT
LOWtest/sandbox/winsrt.test.ts621 },COMMENT
LOWtest/sandbox/winsrt.test.ts2041// Group G — tlsTerminate CA trust via env varsCOMMENT
LOWtest/sandbox/winsrt.test.ts2241 // Mirror the network + H-rows describes: leave no WFP filters,COMMENT
LOWtest/sandbox/winsrt.test.ts2401 async () => {COMMENT
LOWtest/sandbox/winsrt.test.ts2461 expectStatus('G9', r, [0])COMMENT
LOWtest/sandbox/integration.test.ts521 // The two network-allowlist tests below assert the proxy's 403 bodyCOMMENT
LOWsrc/sandbox/sandbox-utils.ts321 pathPattern = stripExtendedPathPrefix(expandWindowsEnvRefs(pathPattern))COMMENT
LOWsrc/sandbox/sandbox-utils.ts541 }COMMENT
LOWsrc/sandbox/sandbox-utils.ts561 // gRPC-based tools. gRPC C-core (every google-cloud-* Python client, andCOMMENT
LOWsrc/sandbox/sandbox-utils.ts601 }COMMENT
LOWsrc/sandbox/http-proxy.ts261COMMENT
LOWsrc/sandbox/http-proxy.ts281 // (checked again at write time via readableEnded). EOFCOMMENT
LOWsrc/sandbox/http-proxy.ts301 //COMMENT
LOWsrc/sandbox/http-proxy.ts441 if (clientGone || socket.destroyed) {COMMENT
LOWsrc/sandbox/http-proxy.ts461 // > external MITM unix socketCOMMENT
LOWsrc/sandbox/http-proxy.ts681 })COMMENT
LOWsrc/sandbox/request-filter.ts101): Promise<Readable | null> {COMMENT
LOWsrc/sandbox/mitm-leaf.ts61 // don't enforce this, but requests/urllib3/httpx/google-auth all rejectCOMMENT
LOWsrc/sandbox/tls-terminate-proxy.ts341 // Host-header note below).COMMENT
LOWsrc/sandbox/tls-terminate-proxy.ts401 // substitution below replaces) but on the POST-strip view: the plan'sCOMMENT
LOWsrc/sandbox/tls-terminate-proxy.ts521 // TODO(terminating-tls): honour parentProxy for the upstream leg.COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts921 // denyWrite binds are buffered and emitted after denyRead processing so thatCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts941COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1001 continueCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1021 // window — the fail-closed direction, since a link now pointing into aCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1141 const seenDenyWrite = new Set<string>()COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1181 // Keep every spelling this dest is reached through (the emissionCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1201 // through). Rationale: the only writable emissions that land after theCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1261 if (rawPath.startsWith('/dev/')) {COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1441 // Non-glob spellings arrive slash-free from normalizePathForSandbox — theCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1541 maskedFiles.set(dest, fakePath)COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1941 // If we don't have --unshare-pid, it is possible to escape the sandbox.COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1961 //COMMENT
LOWsrc/sandbox/macos-sandbox-utils.ts561 resolved.denies.map(d => d.path),COMMENT
LOWsrc/sandbox/macos-sandbox-utils.ts841 ' )',COMMENT
LOWsrc/sandbox/macos-sandbox-utils.ts861 //COMMENT
LOWsrc/sandbox/macos-sandbox-utils.ts1101 // env vars above, so the agent translates them into system propertiesCOMMENT
LOWsrc/sandbox/sandbox-manager.ts141// Windows: the resolved access set that was actually applied atCOMMENT
LOWsrc/sandbox/sandbox-manager.ts161// Resolved once at initialize() (`resolveSrtWin` stats the disk).COMMENT
LOWsrc/sandbox/sandbox-manager.ts781 }COMMENT
LOWsrc/sandbox/sandbox-manager.ts1801 // The dedup against `windowsFsStampedSet` is an OPTIMIZATION,COMMENT
LOWsrc/sandbox/sandbox-config.ts1181 ) => {COMMENT
LOWsrc/sandbox/windows-sandbox-utils.ts2021 argv: string[]COMMENT
LOWsrc/sandbox/windows-sandbox-utils.ts2041 p.caCertPath?.replace(/\\/g, '/'),COMMENT
Verbosity Indicators4 hits · 6 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/macos-seatbelt.test.ts393 // Step 1: Try to rename the denied directoryCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts81 // Step 1: Verify sandbox correctly blocks writes outside workspaceCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts107 // Step 2: Create symlink /tmp/claude -> /COMMENT
LOWtest/sandbox/symlink-boundary.test.ts131 // Step 3: Verify sandbox still blocks writes outside workspaceCOMMENT
Structural Annotation Overuse4 hits · 6 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/macos-seatbelt.test.ts393 // Step 1: Try to rename the denied directoryCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts81 // Step 1: Verify sandbox correctly blocks writes outside workspaceCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts107 // Step 2: Create symlink /tmp/claude -> /COMMENT
LOWtest/sandbox/symlink-boundary.test.ts131 // Step 3: Verify sandbox still blocks writes outside workspaceCOMMENT
Cross-Language Confusion (JS/TS)1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHtest/sandbox/macos-allow-local-binding.test.ts56print('IPC', cli.recv(2).decode())CODE
Modern AI Meta-Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMREADME.md9> The Sandbox Runtime is a research preview developed for [Claude Code](https://www.claude.com/product/claude-code) to eCODE
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/credential-mask-files.test.ts642 b64u('{"sub":"1234567890","name":"John Doe","iat":1516239022}') +CODE