Claude Managed Agents: Self-Hosted Sandboxes and MCP Tunnels Setup Guide

On May 26, 2026, Anthropic held its first developer conference outside the United States — Code with Claude London — and the most significant announcements were not about new models. They were about infrastructure: self-hosted sandboxes for Claude Managed Agents, now in public beta, and MCP tunnels, now in research preview. Both features address the same root problem that has kept regulated industries from deploying Claude agents in production: tool execution and private data access happening outside the enterprise security perimeter.

The architecture Anthropic landed on is elegant in how it draws the boundary. The agent loop — orchestration, context management, error recovery, retry logic — stays on Anthropic infrastructure. Tool execution and private MCP server access move inside the customer perimeter. You get the benefit of Anthropic running a highly available, managed agent runtime without giving up data residency, audit logging, or network policy enforcement. This guide covers what each feature does, how to set it up, and the production patterns that matter for enterprise deployments.

Why the Previous Architecture Created Enterprise Blockers

Claude Managed Agents before this announcement had a fundamental tension: the agent needed to call tools — execute bash commands, read files, call internal APIs, write to databases — but all of that execution happened on Anthropic infrastructure. For a startup building a coding assistant, this is fine. For a financial services firm, a healthcare provider, or a defense contractor, it creates a list of blockers that no amount of contractual language fully resolves.

• Data residency: Files, code, and database contents moving off-perimeter for processing violated data residency requirements in the EU, financial regulations in the US, and data localization laws in markets like India and Brazil.
• Audit logging: Tool execution logs resided on Anthropic infrastructure rather than the SIEM and audit systems the security team already manages.
• Network policy: Giving an agent access to internal APIs meant either exposing those APIs to the public internet or managing a complex allowlist of Anthropic egress IPs — both operationally expensive and security-unfriendly.
• Compute sizing: Long-running builds, image generation, or data processing jobs needed to fit within Anthropic's infrastructure constraints rather than being matched to the customer's own compute resources.

Both new features address these blockers directly, at the architecture level rather than through contractual workarounds.

Self-Hosted Sandboxes: Tool Execution Inside Your Perimeter

A self-hosted sandbox moves the execution environment for Claude Managed Agents from Anthropic infrastructure to an environment you control. Anthropic supports four managed providers out of the box — Cloudflare, Daytona, Modal, and Vercel — plus a custom sandbox client API for teams that need to run on their own infrastructure, a private cloud, or an air-gapped environment.

The split is precise: the agent loop itself — the code that decides what tool to call next, manages the conversation context, handles errors and retries, and tracks the agent's state across steps — continues to run on Anthropic's infrastructure. What moves to your sandbox is tool execution: the actual bash commands, file reads, API calls, and code interpretation that the agent invokes when it acts on the world.

What This Means in Practice

When the agent decides to run git clone https://internal.company.com/repo.git, that command executes inside your sandbox. The file system, the network access, the environment variables, the runtime image — all configured by you. Your network policies apply. Your audit logging captures the execution. The files never leave your perimeter. When the command completes, the result travels back to the Anthropic-hosted agent loop as a tool response — text output, structured JSON, or an error — and the agent continues from there.

For compute-heavy workloads, this also means you can size the execution environment for the task. A coding agent running a full test suite on a large repository can have 16 cores and 64GB of RAM if the task needs it. A lighter research agent can run in a small container. The compute sizing is your decision, not constrained by Anthropic's default allocation.

Setting Up a Self-Hosted Sandbox

The setup flow from the Claude Console (available to organization admins) involves three steps: selecting a sandbox provider, configuring the connection, and enabling it for specific agents or agent workflows.

For a Modal sandbox, the configuration looks approximately like this:

# Deploy a Modal sandbox for Claude Managed Agents
import modal

app = modal.App("claude-agent-sandbox")

# Define the runtime image with your tools pre-installed
sandbox_image = (
    modal.Image.debian_slim()
    .pip_install(["anthropic", "httpx", "boto3"])
    .run_commands(
        "apt-get install -y git curl jq",
        "curl -fsSL https://deb.nodesource.com/setup_22.x | bash -",
        "apt-get install -y nodejs",
    )
)

@app.function(
    image=sandbox_image,
    cpu=4,
    memory=16384,
    timeout=3600,
    secrets=[modal.Secret.from_name("internal-api-keys")],
)
def execute_tool(command: str, working_dir: str) -> dict:
    import subprocess
    result = subprocess.run(
        command,
        shell=True,
        cwd=working_dir,
        capture_output=True,
        text=True,
        timeout=300,
    )
    return {
        "stdout": result.stdout,
        "stderr": result.stderr,
        "returncode": result.returncode,
    }

The Claude Console sandbox configuration then points at your Modal deployment endpoint. Anthropic handles the API authentication between the agent loop and your sandbox. Your sandbox authenticates with your internal systems using the secrets you configure — those secrets never pass through Anthropic infrastructure.

For teams using Vercel, the setup leverages Vercel's edge runtime for lighter execution tasks, particularly useful for API calls and data transformations that don't need a full OS environment. Cloudflare Workers sandboxes are similarly scoped — fast startup, V8 isolate environment, useful for specific tool categories. Daytona provides a full development environment model, closest to the original Managed Agents execution environment but running on infrastructure you control or provision through Daytona's managed offering.

Custom Sandbox Client

For air-gapped environments or private cloud deployments, Anthropic publishes a custom sandbox client specification. You implement a small HTTP server that exposes a defined API surface — tool execution, file system access, process management — and Claude Managed Agents calls your server for tool execution instead of a managed provider. The server can run on-premises, in a private VPC, or in any environment with outbound HTTPS access to the Anthropic agent loop API.

// Minimal custom sandbox server — Express implementation
import express from 'express'
import { exec } from 'child_process'
import { promisify } from 'util'
import path from 'path'
import fs from 'fs/promises'

const execAsync = promisify(exec)
const app = express()
app.use(express.json())

// Anthropic calls this endpoint for each tool execution
app.post('/execute', async (req, res) => {
  const { tool, input, workingDir } = req.body

  try {
    if (tool === 'bash') {
      const { stdout, stderr } = await execAsync(input.command, {
        cwd: workingDir ?? process.env.SANDBOX_ROOT,
        timeout: 120_000,
        env: { ...process.env, ...input.env },
      })
      return res.json({ output: stdout, error: stderr, exitCode: 0 })
    }

    if (tool === 'read_file') {
      const filePath = path.resolve(workingDir ?? '', input.path)
      const content = await fs.readFile(filePath, 'utf-8')
      return res.json({ output: content })
    }

    if (tool === 'write_file') {
      const filePath = path.resolve(workingDir ?? '', input.path)
      await fs.writeFile(filePath, input.content, 'utf-8')
      return res.json({ output: 'File written successfully' })
    }

    return res.status(400).json({ error: `Unknown tool: ${tool}` })
  } catch (err) {
    const message = err instanceof Error ? err.message : String(err)
    return res.status(500).json({ error: message, exitCode: 1 })
  }
})

app.listen(8080, () => {
  console.error('[sandbox] Ready on :8080')
})

The sandbox server validates the Authorization header on each request using a shared secret configured in the Claude Console. Anthropic's agent loop attaches this header to every tool execution call. Your server rejects any request without a valid authorization header — so even if the endpoint is reachable from the internet, unauthorized execution is not possible.