Anthropic has opened a private beta of self-hosted Claude Managed Agents, letting companies run the agent harness, sandboxes, credentials and session history inside their own cloud or on-premises infrastructure. Anthropic announced the option on November 12, 2026, summing up the arrangement this way: customers "host the agents, credentials, and session history, and choose where requests to Claude are sent."
Managed Agents first launched as a hosted service in which Anthropic runs everything, and self-hosted sandboxes were added later. The hosted version remains the default. The new beta moves the rest of the control plane to the customer side, and access is requested through a customer's Anthropic account team.
In a self-hosted deployment, the customer runs the Managed Agents server, called cma-server, which serves the API, runs the agent loop and stores agents, sessions and history. It sits on a PostgreSQL database, version 16 or later, while separate workers execute shell and file tools inside sandboxes. A web console runs on the server behind the customer's identity provider, and an admin CLI is available for Linux on x86-64 and Arm and for macOS on Apple silicon.
Key facts
- 01Anthropic opened self-hosted Claude Managed Agents in private beta on November 12, 2026.
- 02Customers run the cma-server, a PostgreSQL 16+ database and sandbox workers in their own cloud or on-premises.
- 03Model calls can route to Anthropic, Amazon Bedrock, Google Cloud, Microsoft Foundry or a customer-run gateway.
- 04Three credential types stay out of the sandbox; a proxy injects them for MCP tools and supported API calls.
- 05Access is requested through Anthropic account teams; no pricing was published with the beta.
The model is the main piece that does not move in-house. Customers can send requests to Anthropic directly or route them through Amazon Bedrock, Google Cloud, Microsoft Foundry or their own gateway. Session history lives in the customer's database, and where a zero data retention agreement with Anthropic is in place, it applies to Claude requests the same way it does for other Messages API calls.
Each model call still sends the conversation, tool inputs and tool results to whichever inference provider is selected. Calls that go to the Claude API also carry session, agent and environment IDs, according to Anthropic's documentation.
That documentation describes three kinds of credential: a server API key for applications and command-line tools, generated during setup; an inference credential held only by the server; and an environment key held by the workers that poll the server. Credentials stay out of the sandbox. A proxy outside it injects them for MCP tools and supported API calls, and customers can plug in their own secrets manager.
The design separates the harness, which Anthropic calls the brain, from the sandbox, which it calls the hands. Per-environment allowed-host lists block traffic to any other destination, and with self-hosted sandboxes customers enforce the same limits in their own firewall. Every tool call and result is logged and can be exported over OpenTelemetry. Anthropic said that "the limits have to be built into the system itself."
The documentation is direct that isolation becomes the customer's job. The bash tool "is a real shell with the worker process's permissions and network access," and protection comes from the container or virtual machine the worker runs in. Anthropic ships a Docker Compose stack and a Helm chart named cma-sandboxes, and it recommends a separate deployment for each trust level.
Each release archive includes an operator guide, operator-guide.md, which the docs suggest handing to Claude to read during setup. The server software is distributed under its own license agreement, the Claude Managed Agents Server license. Anthropic did not publish pricing or eligibility criteria with the announcement.
Anthropic's announcement names Amazon Bedrock, Google's Agent Platform and Microsoft Foundry as supported routes for model traffic. It does not name any launch customers for the self-hosted beta.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
