You can now host Claude Managed Agents yourself

Anthropic launched Claude Managed Agents in beta on April 8, 2026, as a fully managed harness for running Claude as an autonomous agent, with secure sandboxing, built-in tools, and server-sent event streaming. It launched as a hosted service on the Claude Platform, with Anthropic running the infrastructure.

In that setup, the agent's credentials and the record of everything it did sat on Anthropic's side. Anthropic says that for teams who needed their code to stay in their own environment, it later added self-hosted sandboxes.

On May 19, 2026, Anthropic added self-hosted sandboxes: the isolated environment where an agent's code runs could move onto the customer's own infrastructure. Anthropic's documentation says that with self-hosted sandboxes, Anthropic keeps running the agent and stores skills and memory stores, and tool inputs and outputs still flow to Managed Agents on Anthropic's side. The harness, the credentials, and the session record stayed on Anthropic's side.

Anthropic says agents have since taken on more critical work, like fixing broken builds, testing releases, triaging alerts, and working through bug backlogs, running unattended on a company's code with access to internal systems. For agents with that level of access, Anthropic says, some teams want the whole service in their own environment, not just the sandbox, and until now that meant building the platform themselves.

On November 12, Anthropic announced that self-hosted Claude Managed Agents is available in private beta. Its release notes say: 'You run the whole Managed Agents service, not only self-hosted sandboxes, on your own infrastructure, and you store agents, sessions, and session history there.' The customer runs three things: the Managed Agents server (cma-server), which serves the API, runs the agent loop, and stores agents, sessions, and their histories; a PostgreSQL 16 or later database for that history; and the workers that run shell and file tools inside the customer's sandboxes. The server never runs an agent's shell or file tools.

The server exposes the same Managed Agents API as the hosted service, apart from documented differences, so the Claude SDK and the ant CLI connect to it. The one thing that does not move home is the model itself. Each model call goes to a provider the customer picks — Anthropic by default, or Amazon Bedrock, Claude Models on Google Cloud (Google managed), Microsoft Foundry, or the customer's own model gateway. Access is through an Anthropic account team. Neither Anthropic's announcement nor its documentation lists pricing or a date for general availability.

Anthropic built Managed Agents around four security principles, and they carry over to the self-hosted version. The harness that calls Claude is separated from the sandbox where the agent's code runs; the agent loop, session history, and vault secrets sit outside the sandbox. Credentials stay out of the sandbox too — for MCP tools and supported API calls, a proxy outside the sandbox attaches the credential to the request, and self-hosted customers can keep those credentials in their own secrets manager. Each environment can be locked to a list of allowed hosts, and every step an agent takes is logged and exportable over OpenTelemetry. Anthropic's announcement gives the reasoning: 'When an agent runs unattended inside your code and systems, you can't rely on a person checking every step, so the limits have to be built into the system itself.'

Self-hosting does not keep model traffic inside the customer's network. For each model call, the server sends the conversation so far — prompts, tool inputs, and tool results — to the chosen inference provider. Organizations with a zero data retention agreement with Anthropic get those calls covered the same way as any other call to the Messages API. The added control also comes with added work: the customer now secures the server, hosts the memory stores, watches for unusual usage, and installs each release.

Some hosted features are missing on the self-hosted server, including scheduled deployments, dreams, and webhooks, and web search and web fetch stay off until explicitly enabled. Nothing migrates from the hosted service — agents, skills, vault credentials, and memory stores have to be recreated on the customer's own server. Each deployment serves one tenant at one trust level, so separate tenants need separate deployments. Anthropic has not said when self-hosting will leave private beta.