Self-Hosted Claude Managed Agents: What It Is, Setup and Security (Private Beta Guide)

On November 12, 2026, Anthropic opened a private beta for self-hosted Claude Managed Agents. You can now run the whole Managed Agents service (harness, sandboxes, credentials and session history) inside your own cloud or data centre.

This matters for banks, hospitals and any team that cannot let agent transcripts or secrets sit on someone else’s servers. In this guide I walk through what it is, who can get it, how setup works and what you give up.

What Self-Hosted Managed Agents Is

Claude Managed Agents is Anthropic’s hosted service for running long, tool-using agents. Anthropic normally runs the agent loop, the sandboxes where shell and file tools execute, the credential vault and the stored session history.

Earlier in 2026, teams could already self-host only the sandbox. The new beta goes much further. You now host the agents, credentials and session history, and you choose where model requests go.

Developers keep using the same core APIs, the SDK and the ant CLI. Your apps simply point at your own server address instead of Anthropic’s.

Who Can Get It and What It Costs

This is a private beta. Anthropic says to request access through your Anthropic account team. If your Claude Console organisation already has access, you sign in and switch to that organisation.

• Best fit: enterprises with strict data residency, regulated industries and teams that must keep secrets in their own vault.
• Not a fit: solo developers or anyone without an account team. There is no public sign-up button.
• Zero data retention: Anthropic says self-hosting is the only Managed Agents option eligible for ZDR, because you store the transcripts.

Pricing

The hosted service charges token prices plus a session runtime fee of $0.08 per session-hour while a session is running. For self-hosted pricing, Anthropic’s pricing page only says to contact your account team.

The server software licence itself is royalty-free. Model usage falls under your normal Anthropic or cloud provider agreement. For token prices, see my Claude API pricing guide.

The Parts You Will Run

The official docs list the pieces of a self-hosted deployment. Here is what each one does.

Three credentials, three jobs

• Server API key: held by your apps and CLIs. It works like a Claude API key, but for your own server.
• Inference credential: held only by the server. It is your Claude API key, cloud credential or gateway token.
• Environment key: held by workers. It unlocks one environment’s work queue.

Where model calls can go

• Claude API: the default.
• Amazon Bedrock.
• Claude models on Google Cloud.
• Microsoft Foundry.
• Your own model gateway.

Note: for each model call, the server sends the full conversation, including tool inputs and results, to that provider. Self-hosting does not keep prompts inside your network.

Setup Overview (Docker Compose Quickstart)

Anthropic ships a release archive with a Docker Compose stack for development and Helm charts for production on Kubernetes. The quickstart below runs everything on one machine. It is for testing only.

What you need first

• Release archive: from your account team.
• Claude API key: from the Claude Console keys page.
• Docker: the latest Docker Engine with the Compose plugin (docker compose).
• Host: at least two CPUs, x86-64 or Arm.
• Tools: openssl and the ant CLI.

Step by step

1. Extract the archive. Run tar -xzf <archive>.tar.gz && cd <archive>/compose. If your umask is stricter than 022, set it to 022 and extract again.
2. Create the .env file. It holds a random Postgres password, your Claude API key, a random server API key and a credentials encryption key. Run chmod 600 .env afterwards.
3. Start the stack. Run docker compose up --build -d, then follow the logs until you see cma-server listening.
4. Check readiness. Call http://127.0.0.1:8400/cma-server/readyz. A healthy server returns "status":"ready".
5. Point the CLI at your server. In a second terminal, set ANTHROPIC_BASE_URL to http://127.0.0.1:8400 and ANTHROPIC_API_KEY to your server API key (not your Claude key).
6. Create an agent. Save a small agent file and run ant apply --yes quickstart-agent.md. A 404 warning about organisation and workspace is expected here.
7. Start a session and chat. Create a session with ant beta:sessions create, then run ant beta:sessions connect. Ask the agent to run hostname; the answer should start with cma-sandbox-.
8. Stop when done. docker compose down --remove-orphans keeps the database. Adding -v deletes all agents, sessions and history.

The .env file from step 2 looks like this in the official quickstart:

cat > .env <<EOF
CMA_PG_PASSWORD=$(openssl rand -hex 32)
ANTHROPIC_API_KEY=sk-ant-...
CMA_SERVER__API_KEY=$(openssl rand -hex 32)
CMA_STORE__CREDENTIALS_ENCRYPTION_KEY=$(openssl rand -base64 32)
EOF
chmod 600 .env

And the minimal agent file from step 6:

---
name: Quickstart agent
model: claude-opus-5-5
tools:
  - type: agent_toolset_20260401
---

You are a helpful assistant.

Warning: the optional console demo uses a mock sign-in provider that gives admin access to anyone who can reach it. Use throwaway data only, and never expose that stack to a network.

For production, Anthropic points you to the cma-sandboxes Helm chart, which starts each session’s worker in its own pod. Deeper settings live in an operator-guide.md file inside each release.

Hosted vs Self-Hosted Compared

The API is the same, apart from a list of documented differences. Nothing migrates from the hosted service, so you must recreate agents, skills, vault credentials and memory stores.

Safer defaults you must switch on

• MCP servers: the server only connects to hosts in mcp.allowed_hostnames, which starts empty. No wildcards.
• Git repositories: blocked until you list Git hosts and allowed push branches.
• Web search and fetch: off until you enable web_tools in server settings.
• MCP results: cut at 100 KiB by default, set by mcp.max_result_bytes.

If you are new to the hosted product, my Claude Agent SDK guide and Claude Skills guide cover the building blocks that carry over.

Security Model and Your Responsibilities

Anthropic describes four design principles that apply whether you self-host everything, only the sandbox, or nothing.

• Brain and hands are separate: the harness calls Claude while agent code runs in a sandbox. Sandboxes start only when a tool needs them.
• Credentials stay out of the sandbox: for MCP tools and supported API calls, a proxy outside the sandbox adds the credential.
• Network access can be limited: each environment can have an allowed-hosts list, enforced by your own firewall when self-hosted.
• Full audit record: every step, including tool calls and results, is logged and exportable through OpenTelemetry.

What becomes your job

Self-hosting hands you the work Anthropic used to do. The docs are blunt that the bash tool is a real shell with the worker’s permissions and network access.

• Isolation: comes from the container or pod the worker runs in, so run workers in disposable containers or VMs.
• Trust levels: each trust level needs its own deployment.
• Operations: securing the server, hosting memory stores, patching and spotting unusual usage are on you.
• Git pushes: the server does not block force pushes, so protect branches on your Git host.

Tip: before you connect real systems, read the official secure deployment page and my MCP security best practices. If you already use admin controls, my Claude Enterprise security controls guide pairs well with this.

Licence Terms Worth Reading

The software comes under a separate Software License Agreement for the Claude Managed Agents Server. A few clauses stand out for operations teams.

• Safety updates: deploy each one within 1 business day after Anthropic delivers it.
• Emergency rollback: disable a feature or roll back within 8 hours of a written safety notice.
• Usage signals: you may not remove, block or falsify the signals the server sends to Anthropic.
• Termination: either side can end it for convenience with 90 days’ written notice.

On the Claude API provider, calls carry session, agent and environment IDs, with no names or content. Plan your change process around these rules before you commit.

My Take

This is a big step for enterprise agents. Session history, secrets and audit logs are often the real blockers in a security review, and now they can live in your own database and vault.

Still, be honest with your team: prompts still leave your network for inference. You also take on patching duties with tight deadlines and lose handy hosted features like webhooks and the Files API.

If you need data residency for stored transcripts, ask your account team for a trial. If you just want less ops work, the hosted service plus self-hosted sandboxes is still the simpler path.

Troubleshooting

• Server never comes up: run docker compose logs migrate. The migrate container must exit with status 0.
• Readiness stays “degraded”: make sure ANTHROPIC_BASE_URL is not set in the terminal where you ran docker compose up, or the server calls itself.
• Readiness returns “not_ready” with upstream failed: your Claude API key was rejected. Fix it in .env and restart.
• Agent replies but the tool never finishes: check docker compose logs sandbox. Set CMA_DOCKER_SOCKET if workers cannot reach Docker.
• Tool calls wait forever: all 10 quickstart workers may be busy, since idle sessions hold one for up to an hour. Archive sessions you do not need.
• Images or PDFs ignored: URL and file sources are silently dropped. Send them as base64.
• Agent with an MCP server will not save: add the exact host to mcp.allowed_hostnames.
• Zip skill upload returns 400: the server does not unpack zips. Use ant apply or upload files separately.

Frequently Asked Questions

Does self-hosting mean Claude runs on my own GPUs?

No. The server, database and workers run on your infrastructure, but model inference still happens at Anthropic or at the provider you choose, such as Bedrock or Microsoft Foundry.

How do I get access to the private beta?

Contact your Anthropic account team. There is no public sign-up form for the self-hosted release archive.

How much does self-hosted Managed Agents cost?

Anthropic has not published a self-hosted rate and says to ask your account team. The server licence is royalty-free, and model usage is billed under your normal agreement.

Can I move my hosted agents and sessions over?

No. Nothing is copied from the hosted service. You recreate agents, skills, vault credentials and memory stores on your own server.

Is Kubernetes required?

Not for testing, because a Docker Compose stack is included. For production, Anthropic recommends its Helm charts on Kubernetes.

Which features are missing compared with hosted?

Cloud environments, the Files API, mcp_oauth credentials, webhooks, scheduled deployments, dreams and the prebuilt document skills are not available. Multiagent works in coordinator mode only.

Is it eligible for zero data retention?

Yes. Anthropic says self-hosted is the only Managed Agents option eligible for ZDR, and existing ZDR terms apply to its model requests like any Messages API call.

Sources

• Anthropic: Operate Claude Managed Agents inside your security perimeter
• Claude Docs: Self-hosted Managed Agents
• Claude Docs: Self-hosted quickstart
• Claude Docs: Differences from the hosted service
• Claude Docs: Pricing
• Anthropic: Software License Agreement, Claude Managed Agents Server
• Help Net Security: Self-hosted Claude Managed Agents