Repository Analysis

anthropic-experimental/sandbox-runtime

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

4.1 Likely human-written View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of anthropic-experimental/sandbox-runtime, a TypeScript project with 4,670 GitHub stars. SynthScan v2.0 examined 41,704 lines of code across 95 source files, recording 99 pattern matches distributed across 8 syntactic categories. The overall adjusted score of 4.1 places this repository in the Likely human-written band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

4.1
Adjusted Score
4.1
Raw Score
100%
Time Factor
2026-07-14
Last Push
4.7K
Stars
TypeScript
Language
41.7K
Lines of Code
95
Files
99
Pattern Hits
2026-07-14
Scan Date
0.01
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 1MEDIUM 30LOW 68

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 99 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators29 hits · 90 pts
SeverityFileLineSnippetContext
MEDIUMtest/sandbox/winsrt.test.ts721 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts723 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts743 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts745 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts794 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts796 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts829 // ── loopback port-range fence ────────────────────────────────────COMMENT
MEDIUMtest/sandbox/winsrt.test.ts862 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts864 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts928 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts930 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1022 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1024 // ════════════════════════════════════════════════════════════════COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1416// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMtest/sandbox/winsrt.test.ts1418// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/integration-tests.yml56 # ─── Windows: srt-win helper binary ─────────────────────────────COMMENT
MEDIUMsrc/cli.ts49 // ── Windows install/uninstall ─────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts50// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts52// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts359// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts361// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts462// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts464// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts541// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts543// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts1173// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts1175// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts1400// ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMsrc/sandbox/windows-sandbox-utils.ts1402// ────────────────────────────────────────────────────────────────────COMMENT
Hyper-Verbose Identifiers33 hits · 34 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/mandatory-deny-paths.test.ts378 async function runSandboxedWriteWithGitConfig(CODE
LOWtest/sandbox/mandatory-deny-paths.test.ts482 async function runSandboxedWriteWithDenyPaths(CODE
LOWtest/sandbox/mandatory-deny-paths.test.ts1017 async function runSandboxedCommandWithDenyPaths(CODE
LOWtest/sandbox/integration.test.ts43function assertPrecompiledBpfInUse(): void {CODE
LOWsrc/sandbox/sandbox-utils.ts51export function normalizeCaseForComparison(pathStr: string): string {CODE
LOWsrc/sandbox/sandbox-utils.ts79function containsGlobCharsForPlatform(p: string): boolean {CODE
LOWsrc/sandbox/linux-sandbox-utils.ts240function findFirstNonExistentComponent(targetPath: string): string {CODE
LOWsrc/sandbox/linux-sandbox-utils.ts261async function linuxGetMandatoryDenyPaths(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts399function registerExitCleanupHandler(): void {CODE
LOWsrc/sandbox/linux-sandbox-utils.ts591export async function initializeLinuxNetworkBridge(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts755function resolveApplySeccompPrefix(CODE
LOWsrc/sandbox/linux-sandbox-utils.ts1396export async function wrapCommandWithSandboxLinux(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts60export function macGetMandatoryDenyPatterns(allowGitConfig = false): string[] {CODE
LOWsrc/sandbox/macos-sandbox-utils.ts144function generateMoveBlockingRules(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts783export function wrapCommandWithSandboxMacOS(CODE
LOWsrc/sandbox/macos-sandbox-utils.ts952export function startMacOSSandboxLogMonitor(CODE
LOWsrc/sandbox/sandbox-manager.ts290function shouldTerminateTLSForHost(host: string): boolean {CODE
LOWsrc/sandbox/sandbox-manager.ts774function getCredentialRestrictions(CODE
LOWsrc/sandbox/sandbox-manager.ts837function getCredentialDenyReadPaths(CODE
LOWsrc/sandbox/sandbox-manager.ts963function computeWindowsFsAccessSet(c: SandboxRuntimeConfig): {CODE
LOWsrc/sandbox/sandbox-manager.ts1053function getNetworkRestrictionConfig(): NetworkRestrictionConfig {CODE
LOWsrc/sandbox/sandbox-manager.ts1093function getEnableWeakerNestedSandbox(): boolean | undefined {CODE
LOWsrc/sandbox/sandbox-manager.ts1097function getEnableWeakerNetworkIsolation(): boolean | undefined {CODE
LOWsrc/sandbox/sandbox-manager.ts1109function getMandatoryDenySearchDepth(): number {CODE
LOWsrc/sandbox/sandbox-manager.ts1145async function waitForNetworkInitialization(): Promise<boolean> {CODE
LOWsrc/sandbox/sandbox-manager.ts1838function annotateStderrWithSandboxFailures(CODE
LOWsrc/sandbox/sandbox-manager.ts1868function getLinuxGlobPatternWarnings(): string[] {CODE
LOWsrc/sandbox/generate-seccomp-filter.ts160export function getApplySeccompBinaryPath(CODE
LOWsrc/sandbox/domain-pattern.ts52export function isInjectHostCoveredByAllowedDomains(CODE
LOWsrc/sandbox/linux-violation-monitor.ts71export function startLinuxSandboxViolationMonitor(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts689export function getWindowsSandboxUserStatus(CODE
LOWsrc/sandbox/windows-sandbox-utils.ts1279export function wrapCommandWithSandboxWindows(p: WindowsSandboxParams): {CODE
LOWsrc/sandbox/windows-sandbox-utils.ts1407export function windowsInstallInstructions(CODE
Over-Commented Block26 hits · 26 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/glob-expand.test.ts41 const RAW_BASE_DIR = join(tmpdir(), 'glob-expand-test-' + Date.now())COMMENT
LOWtest/sandbox/winsrt.test.ts521 const sl = '6a1e0f80-2b3c-4d5e-9f8a-1b2c3d4e5f60'COMMENT
LOWtest/sandbox/winsrt.test.ts1421// tls-terminate-proxy.test.ts); these rows prove the sandboxedCOMMENT
LOWtest/sandbox/winsrt.test.ts1681 it.skipIf(NODE === undefined)(COMMENT
LOWtest/sandbox/integration.test.ts521 // The two network-allowlist tests below assert the proxy's 403 bodyCOMMENT
LOWsrc/sandbox/sandbox-utils.ts481 // one port, anything that actually speaks SOCKS to this URL stillCOMMENT
LOWsrc/sandbox/mitm-ca.ts321 // Issuer Name: RFC 5280 §5.1.2.3 requires this match the CA subjectCOMMENT
LOWsrc/sandbox/mitm-leaf.ts61 // don't enforce this, but requests/urllib3/httpx/google-auth all rejectCOMMENT
LOWsrc/sandbox/tls-terminate-proxy.ts201 req: IncomingMessage,COMMENT
LOWsrc/sandbox/tls-terminate-proxy.ts221 // with `Host: B` (where B is some other allowlisted host). If weCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts901 const args: string[] = []COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1061 // Handle non-existent paths by mounting /dev/null to block creation.COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1241 // realPath was already normalized (tilde-expanded, realpath'd) by theCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1261 // --ro-bind /dev/null <host> from denyRead, which landed first.COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1321 // maskedFiles holds both the symlink path and its resolved target soCOMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1621 // Mount fresh /proc if PID namespace is isolated (secure mode).COMMENT
LOWsrc/sandbox/linux-sandbox-utils.ts1641COMMENT
LOWsrc/sandbox/macos-sandbox-utils.ts321 // Allow stat/lstat on all directories so that realpath() can traverseCOMMENT
LOWsrc/sandbox/macos-sandbox-utils.ts661 // ::ffff:127.0.0.1, which Seatbelt's "localhost" filter does not match.COMMENT
LOWsrc/sandbox/sandbox-manager.ts121// under a different SID.COMMENT
LOWsrc/sandbox/sandbox-manager.ts521 `(thumb=${installed.thumb}) doesn't match this ` +COMMENT
LOWsrc/sandbox/sandbox-manager.ts1261 }COMMENT
LOWsrc/sandbox/sandbox-manager.ts1421 // expand, normalize, missing→drop) — so a per-exec entryCOMMENT
LOWsrc/sandbox/sandbox-config.ts961 entry: { mode: string; injectHosts?: string[] },COMMENT
LOWsrc/sandbox/windows-sandbox-utils.ts1281 env: NodeJS.ProcessEnvCOMMENT
LOWsrc/sandbox/windows-sandbox-utils.ts1301 p.proxyAuthToken,COMMENT
Verbosity Indicators4 hits · 6 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/macos-seatbelt.test.ts393 // Step 1: Try to rename the denied directoryCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts81 // Step 1: Verify sandbox correctly blocks writes outside workspaceCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts107 // Step 2: Create symlink /tmp/claude -> /COMMENT
LOWtest/sandbox/symlink-boundary.test.ts131 // Step 3: Verify sandbox still blocks writes outside workspaceCOMMENT
Structural Annotation Overuse4 hits · 6 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/macos-seatbelt.test.ts393 // Step 1: Try to rename the denied directoryCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts81 // Step 1: Verify sandbox correctly blocks writes outside workspaceCOMMENT
LOWtest/sandbox/symlink-boundary.test.ts107 // Step 2: Create symlink /tmp/claude -> /COMMENT
LOWtest/sandbox/symlink-boundary.test.ts131 // Step 3: Verify sandbox still blocks writes outside workspaceCOMMENT
Cross-Language Confusion (JS/TS)1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHtest/sandbox/macos-allow-local-binding.test.ts56print('IPC', cli.recv(2).decode())CODE
Modern AI Meta-Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMREADME.md9> The Sandbox Runtime is a research preview developed for [Claude Code](https://www.claude.com/product/claude-code) to eCODE
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOWtest/sandbox/credential-mask-files.test.ts642 b64u('{"sub":"1234567890","name":"John Doe","iat":1516239022}') +CODE