Anthropic Opens Private Beta of Self-Hosted Claude Managed Agents: Harness, Sandboxes, Credentials and Session History Run in Your Own Cloud or Data Center, With Model Calls Routable to Bedrock, Foundry or Your Own Gateway

Background and pain points

Teams increasingly let agents run unattended to fix broken builds, test releases, triage alerts and work through bug backlogs, all of which touch company code and internal systems. Claude Managed Agents began as an Anthropic-hosted API (agent harness, sandboxes, credential handling, session history) and later added self-hosted sandboxes, but the service itself still ran at Anthropic. Regulated companies that wanted the whole stack inside their own perimeter had to build the platform themselves.

Architecture highlights

The self-hosted edition hands the company the server cma-server (API, agent loop, session storage), a PostgreSQL 16+ database, and the workers that run shell and file tools. Anthropic stresses splitting the brain from the hands: the harness calls Claude, code runs only in the sandbox, and session history and secrets stay outside it. A proxy outside the sandbox injects credentials, or you can plug in your own secrets manager. Each environment can have a host allowlist, and every step exports over OpenTelemetry. Model calls can go to Anthropic, Amazon Bedrock, Claude on Google Cloud, Microsoft Foundry or your own gateway, and existing zero data retention terms still apply.

Benchmarks and data

This is a platform and deployment update. Anthropic has published no performance benchmarks or pricing. The public data point is reach: the @ClaudeDevs launch post had about 11K likes and 790K views at writing time. Head of platform Katelyn Lesse wrote that it also ships Anthropic's first real evals product, plus agent identity, OTel observability and kill switches, with customers already using it for bio research and chip design. These are vendor and employee claims.

Getting started

It is a private beta, so request the download through your Anthropic account team. Then follow the Get started guide to bring the server up with Docker Compose or Helm. The SDK and ant CLI use the same API as the hosted service, so existing code carries over. The docs warn that the worker's bash tool is a real shell, so isolation must come from a container or VM. Each trust level needs its own deployment, and some features exist only on the hosted service, so check the differences page first. If you only need tools to run locally, self-hosted sandboxes are enough.