Anthropic lets companies self-host the whole Claude Managed Agents stack, in private beta

Anthropic has opened a private beta of self-hosted Claude Managed Agents. Until now the service ran on the Claude Platform, with an option to host only the sandbox. Now the harness, sandboxes, credentials and session history can all run in your own cloud or data center, while developers keep the same core APIs as the hosted service.

What you run

You operate the Managed Agents server, its database and the workers where agents run shell and file tools. Session history lives in your database. Model requests go where you point them: Anthropic directly, Amazon Bedrock, Google’s Agent Platform, Microsoft Foundry, or your own gateway. If your organization has zero data retention with Anthropic, it applies to those Claude requests like any other Messages API call.

The quickstart gives two routes:

Route	What it is	Notes from the docs
Docker Compose	Server, PostgreSQL and workers that give each session its own sandbox container	Development only; plain HTTP on port 8400, published on loopback by default
Helm	The release’s two charts	Anthropic’s recommendation for production

Read the docs’ warnings before trying the Compose stack. Under some Docker Engine releases before 28.3.3, machines on your local network can reach that port, and the mock provider hands an administrator token to anyone who reaches it. Anthropic says to use a machine that holds nothing you need to protect.

The security design

Anthropic lists four principles that apply whether it hosts everything or you do:

• Brain and hands split. The harness that calls Claude stays outside the sandbox where agent code runs, along with session history and vault secrets.
• Credentials stay out of the sandbox. A proxy outside it adds credentials to MCP and supported API calls. Self-hosters can use their own secrets manager.
• Network allowlists. Each environment can be limited to a list of allowed hosts; self-hosters set the same limits in their own firewall.
• A full record. Every step and tool call is logged and exports over OpenTelemetry, the same plumbing behind Claude Platform’s trace export.

Access goes through your Anthropic account team. Neither the article nor the docs list a price.

Why this matters

Hosted agent harnesses are now table stakes, from Anthropic’s service to Moonshot’s Kimi Hosted Agents. Self-hosting moves the stateful parts, session logs and secrets, inside your own perimeter. That matters because agent memory and keys are real attack surface, as Darktrace’s lab demo with stolen Claude API keys showed this week. It also makes you the operator, so the Compose warnings above are yours to heed.