Claude Managed Agents adds self-hosted sandboxes and MCP tunnels

Anthropic added two enterprise-focused features to Claude Managed Agents: self-hosted sandboxes, now in public beta, and MCP tunnels, in research preview. The announcement extends last month's brain-from-hands split, where the orchestration loop was already separated from the sandbox. The new piece is that customers can run the sandbox itself on their own infrastructure, through Cloudflare, Daytona, Modal, or Vercel, while Anthropic still hosts the agent loop and context management.

The MCP tunnel is the more interesting of the two. It is a small gateway you deploy inside your network. The gateway opens a single outbound connection to Claude's side, with no inbound firewall rules and no public endpoint, so the agent can reach private MCP servers like an internal database, ticketing system, or vector store without exposing them. Traffic is encrypted end to end, and the tunnel is managed from the Claude Console by an org admin.

Anthropic names Clay, Rogo, and Amplitude as customers already running production agents with these features. The pitch lands with teams that want Claude but had compliance reasons to keep tool execution and internal services off vendor infrastructure: you keep them, but you do not have to maintain the orchestration loop yourself.

Why it matters

If your security team has been blocking agent rollouts because tool calls hit vendor sandboxes or because an MCP server would need a public endpoint, this is the version worth bringing back to them. Test the sandbox provider you already trust first; the orchestration latency now lives in a different place from the code execution, which can change how you reason about timeouts.