Self-hosted Claude Managed Agents: your servers, Anthropic's rules
Anthropic opened a private beta on Thursday that lets companies run the whole Claude Managed Agents stack on their own cloud or on-prem: https://claude.com/resources/articles/self-hosted-claude-managed-agents. The harness, the sandboxes, the credentials and the session history all sit inside the customer's environment. The customer runs the Managed Agents server, its database and its workers. Model calls can go to Anthropic directly, or through Bedrock, Google's Agent Platform, Microsoft Foundry or the customer's own gateway. The APIs are the same as the hosted version. Docs: https://platform.claude.com/docs/en/managed-agents/self-hosted
The design follows four rules Anthropic spells out. The brain and the hands are split, so the harness runs outside the sandbox where the agent executes code. Credentials never enter the sandbox; a proxy adds them on the way out, and companies can plug in their own secrets manager. Network access goes through allowlists. And the full session record exports over OpenTelemetry. For a bank or a hospital that couldn't send agent sessions to someone else's cloud, this is the version they can actually deploy.
The catch is in the license: https://www.anthropic.com/legal/self-hosted-managed-agents-license. It is binary-only, with no modification and no reverse engineering of the "source code, prompts, or logic." Clause 3(c) says that, except where the docs expressly permit it, the software can't be used with any third-party model, including by pointing it at one. So the hardware and the data are yours, but the agent runtime only talks to Claude. Anthropic can also push "Safety Updates" into your deployment.
That is the honest trade. Self-hosting usually means freedom, and here it means custody without portability. It fits a pattern this month: Anthropic's Enterprise Frontier Safeguards also run in customer infrastructure, and OpenAI's Control Room put the kill switch in the inference layer. Control is moving into the buyer's own building, on the vendor's terms. Buyers who want a model-agnostic harness still have to build or buy one elsewhere.
Disclosure: clauday is written with Claude, and this piece covers an Anthropic product.
← Back to all articles
The design follows four rules Anthropic spells out. The brain and the hands are split, so the harness runs outside the sandbox where the agent executes code. Credentials never enter the sandbox; a proxy adds them on the way out, and companies can plug in their own secrets manager. Network access goes through allowlists. And the full session record exports over OpenTelemetry. For a bank or a hospital that couldn't send agent sessions to someone else's cloud, this is the version they can actually deploy.
The catch is in the license: https://www.anthropic.com/legal/self-hosted-managed-agents-license. It is binary-only, with no modification and no reverse engineering of the "source code, prompts, or logic." Clause 3(c) says that, except where the docs expressly permit it, the software can't be used with any third-party model, including by pointing it at one. So the hardware and the data are yours, but the agent runtime only talks to Claude. Anthropic can also push "Safety Updates" into your deployment.
That is the honest trade. Self-hosting usually means freedom, and here it means custody without portability. It fits a pattern this month: Anthropic's Enterprise Frontier Safeguards also run in customer infrastructure, and OpenAI's Control Room put the kill switch in the inference layer. Control is moving into the buyer's own building, on the vendor's terms. Buyers who want a model-agnostic harness still have to build or buy one elsewhere.
Disclosure: clauday is written with Claude, and this piece covers an Anthropic product.
Comments