Self-hosted Claude Managed Agents: the whole service on your servers

On November 12, 2026, Anthropic released self-hosted Claude Managed Agents: the entire service, ready to run on your own infrastructure. According to the Claude Release Notes, it is no longer just the sandbox that runs on your side, but also the server that stores agents, sessions and their history. To get access, you have to ask your Anthropic account team.

How is this different from self-hosted sandboxes?

Self-hosted sandboxes have been in beta since May 19, 2026. They move only one thing to your side: the place where the agent runs commands and works on files. Anthropic still runs the agent loop, the API and session storage, so tool inputs and results end up on its servers anyway.

The new option takes the service away from there too. The documentation sums it up in one table:

Option	Sandboxes	Service	Model
Cloud sandboxes (default)	Anthropic	Anthropic	Anthropic
Self-hosted sandboxes	you	Anthropic	Anthropic
Self-hosted Managed Agents	you	you	Anthropic or a provider you choose

So the model stays in the cloud. This is not Claude running locally. What runs locally is the agent’s “shell” around it: the API, the loop and session memory.

What do self-hosted Claude Managed Agents look like inside?

A single deployment is made of several parts:

1. The cma-server server exposes the API, runs the agent loop and calls the model. It does not run the agent’s shell or file tools.
2. The database is PostgreSQL 16 or later. Without it the server keeps data in memory and a restart wipes it.
3. Workers (the ant beta:worker command or a worker from the SDK) pull work from the server and execute tools in your sandboxes.
4. On top of that come a browser console, which you sign in to through your own identity provider, and the cma-server-admin administrator CLI.

The API is the same as in the hosted service, so the SDKs and the ant CLI work once you point them at your server’s address.

For a trial, one machine with at least two CPUs and Docker Compose is enough. According to the quickstart, the stack starts the server, the database and 10 workers, and every session gets its own container. That is the developer setup (plain HTTP on 127.0.0.1:8400). For production, the recommendation is two Helm charts and Kubernetes.

A nice touch: the quickstart opens with a ready-made prompt that lets you hand the whole installation to Claude Code, and every release archive ships an operator-guide.md file meant to be read by Claude ;)

Where do model requests go?

To the Claude API by default. The inference.provider setting lets you switch to Amazon Bedrock, Claude Models on Google Cloud (the Google-managed version), Microsoft Foundry or your own model gateway. With any of those, the server does not need a Claude API key (configuration details).

Every model call sends the whole conversation so far outside your network, tool inputs and results included. If the provider is the Claude API, three headers with the session, agent and environment IDs go along with it. You cannot turn them off, and according to the data and access page they are used to attribute usage.

The same page states that Anthropic has no remote access to the server or its logs. Sessions sit in your database until you delete them yourself, and a ZDR (zero data retention) agreement covers model calls the same way it covers other Messages API requests. Hosted Managed Agents is not eligible for ZDR, because Anthropic stores the session transcripts.

What should you watch out for?

First, the list of gaps. According to the differences overview, a self-hosted server has no cloud environments, Files API, scheduled deployments, dreams, webhooks or the built-in docx, pdf, pptx and xlsx skills. Multi-agent orchestration is down to delegating to subagents from a list (1 to 20), with no dynamic workflows and no advisor. Nothing carries over from the hosted service either, so you create agents, skills and memory stores from scratch.

Second, what is off by default. The web_search and web_fetch tools have to be enabled in the server settings, and the list of allowed MCP hosts starts out empty. On Bedrock neither of the two tools works; on Google Cloud only web_search does.

Third, security, which lands entirely on you. The bash tool is a real shell with the worker process’s permissions, and isolation comes only from the container or VM the worker runs in. One deployment serves one tenant at one trust level, so trusted and untrusted code need separate installations. I covered the basics in my guide to AI agent security, and restricting keys to your own network in the post on the Claude IP allowlist.

Fourth, access. You only get the release archive through your account team, and neither the Release Notes nor the feature description mentions a price. This is an offer for organizations that must keep session history in-house or route traffic through their own cloud provider. For your own experiments, the simpler route is still an agent built on the Claude Agent SDK.

FAQ

Do self-hosted Claude Managed Agents work without a connection to Anthropic?

The server connects to Anthropic only when the model provider is the Claude API. With Bedrock, Google Cloud, Foundry or your own gateway, requests go there instead, but still to Claude models, because the agent refers to its model by a Claude API identifier (e.g. claude-opus-5-5).

Do you need Kubernetes to run it?

Not for testing: Docker Compose on a single machine is enough. Kubernetes and the Helm charts are the recommendation for production deployments.

How do you get access to self-hosted Claude Managed Agents?

Through your account team at Anthropic (in the documentation’s words, “contact your Anthropic account team”). There is no public download.