Self-hosted Claude Managed Agents keeps agent credentials in your environment
Anthropic has released a self-hosted version of Claude Managed Agents. Companies can run the agent harness, sandboxes, credentials, and session history in their cloud or on-premise. The option opened as a private beta on November 12, and customers request access through their Anthropic account team.
The change matters for agents that already work unattended inside corporate systems, fixing broken builds, testing releases, triaging alerts, and working through bug backlogs. Until now, customers could host the sandbox themselves. That is the isolated environment where an agent’s code runs. Anthropic ran everything else, including the credential handling and the record of what each agent did. Teams that wanted the whole service inside their perimeter had to build the platform themselves.
What the customer runs now
In the self-hosted setup, the customer operates three things: the Managed Agents server, its PostgreSQL database, and the workers where agents run their shell and file tools. Session history lives in that database. Developers build agents with the same core APIs as the hosted service.
Model requests go wherever the customer points them: to Anthropic directly, to Amazon Bedrock, Google’s Agent Platform or Microsoft Foundry, or to the customer’s gateway. Claude itself still runs outside the customer’s network, so prompts go out and completions come back. Some organizations have a zero data retention (ZDR) agreement with Anthropic. For them, these requests are covered the same way as any other call to the Messages API, Anthropic’s standard interface for model requests.
Where the credentials go
Anthropic built Managed Agents around four security principles. They apply whether Anthropic hosts everything, the customer hosts only the sandbox, or the customer hosts all of it. The company’s reasoning is that a team can’t count on a person checking each step of an unattended agent, so “the limits have to be built into the system itself.”
The first principle separates the harness, which calls Claude, from the sandbox, where the agent’s code runs. The agent loop, session history, and vault secrets sit outside the sandbox, and a sandbox starts only when a tool needs one. Credentials stay out of the sandbox too. For MCP tools and supported API calls, a proxy outside the sandbox attaches the credential to the request. Self-hosted customers can keep those credentials in their own secrets manager. Anthropic limits that protection to MCP tools and “supported API calls,” so any other service an agent reaches is worth checking before the agent goes live.
Allowlists and logs
Each environment can be locked to a list of allowed hosts, and requests to any other host are blocked. For an agent that fixes broken builds, Anthropic suggests the list might be just the git host and the package registry. Customers who host the sandbox enforce those limits in their firewall, which makes the allowlist their configuration to get right.
Managed Agents also keeps a log of every step an agent takes: each tool call it made and what it got back. The log exports over OpenTelemetry, so security teams can pipe it into the monitoring tools they already run and look at agent activity next to everything else they watch.
The server, the database, and the firewall rules are now the customer’s to run, and so is the job of keeping them patched and set up correctly.
Download: The IT and security field guide to AI adoption
