Claude Managed Agents Go Self-Hosted: What Moves Home, What Doesn't

Anthropic gave enterprises the one thing they have been asking for since Claude Managed Agents launched in April: the keys to the whole service. On November 12, the company opened a private beta for self-hosted Claude Managed Agents, a version of its agent service that runs entirely on a customer's own cloud account or on-premises servers. The agent harness, the sandboxes, the credentials and the full session history all move inside your perimeter. The model does not. Every request to Claude still travels to an inference provider you pick, Anthropic by default, or Amazon Bedrock, Google Cloud, Microsoft Foundry or your own gateway. That split is the whole story: you gain control of the data and the runtime, but you do not gain a local Claude, and Anthropic has published no price for the privilege yet.

What Anthropic announced on November 12

Claude Managed Agents is Anthropic's hosted service for running Claude as an autonomous agent on long jobs: fixing broken builds, testing releases, triaging alerts and working through bug backlogs. It launched in public beta in April 2026. You define an agent, a model, a system prompt, tools, MCP servers and skills, through the API, and Anthropic runs the agent loop, the sandbox and the session state for you. Every request carries the managed-agents-2026-04-01 beta header, and access is enabled by default for all API accounts.

In May 2026 Anthropic added self-hosted sandboxes, which moved the isolated environment where an agent's code runs onto customer infrastructure while Anthropic kept running the agent itself and storing skills, memory stores and session history. The November 12 announcement finishes that move. Anthropic's release notes put it plainly: "You run the whole Managed Agents service, not only self-hosted sandboxes, on your own infrastructure, and you store agents, sessions, and session history there." The announcement came through Anthropic's ClaudeDevs account, and the documentation pages for the self-hosted edition went live the same day.

The timing is not a coincidence. Six days earlier, on November 6, Mistral moved its own Studio managed agents and apps into customers' virtual private clouds, a story we covered in our Mistral Studio piece. The two vendors are answering the same enterprise objection from opposite directions: agents are welcome inside the building, but the data stays ours.

What actually moves onto your servers

A self-hosted deployment has three customer-operated pieces, plus a console and an admin tool. Anthropic's documentation lays out exactly what runs where:

Three credentials hold the setup together, and the split between them is the security design. The server API key authenticates requests to your server, playing the role a Claude API key plays with the hosted service. The inference credential lives on the server alone and authenticates the server's model calls to your provider; applications and workers never see it. The environment key lets your workers poll one environment's work queue. Your applications reach the server with the Claude SDK or the ant CLI, which work against your own server exactly as they work against Anthropic's, because both expose the same API.

Self-hosting also adds four features the hosted service does not have: a choice of inference provider, single sign-on through your OpenID Connect identity provider, your own secret manager for vault credentials, and agent identity, where the server signs a short-lived token for an agent's calls to an MCP server.

The one thing that does not move home

The model stays outside. For each model call, the server sends the conversation so far, including tool inputs and tool results, to your inference provider. By default that is the Claude API, and a call to the Claude API also carries the IDs of its session and of that session's agent and environment. You set the provider with the inference.provider setting: Anthropic by default, or Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry, or your own model gateway.

So self-hosting the service does not by itself keep model traffic inside your network. What it does keep inside is everything around the model call: the harness, the sandboxes, the credentials agents use, and the full history of every session. Anthropic says it has no remote access to a customer's self-hosted server or its logs, and the server connects only to a closed list of destinations that the documentation enumerates.

That split also fixes one compliance gap. The hosted service is not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement coverage, because sessions are stateful and transcripts persist until you delete them. Anthropic's own overview names self-hosted Claude Managed Agents as the exception for Zero Data Retention: you store that data yourself. Note the limit of that exception: it covers data retention, and Anthropic has said nothing about HIPAA coverage for the self-hosted edition.

What it costs

Here is the honest answer first: Anthropic has published no price for the self-hosted edition. Its pricing page says, in full, "For pricing of self-hosted Claude Managed Agents, contact your Anthropic account team." There is no license fee on the page, no per-server rate, no seat count. The server software is licensed under Anthropic's Software License Agreement for the Claude Managed Agents Server, which is a separate document from the API terms.

What you can price today is the hosted service, and it is the closest guide to what the model calls will cost once you pick a provider. Anthropic bills hosted Managed Agents on two dimensions: tokens at standard model rates, and session runtime at $0.08 per session-hour, metered to the millisecond and accruing only while a session's status is running. Idle time costs nothing. Web search inside a session costs $10 per 1,000 searches, and the Batch API discount does not apply because sessions have no batch mode.

Rates are Anthropic's published API prices, verified on its pricing page on November 13, 2026. Haiku 5.5's rates apply to prompts up to 100,000 tokens; longer prompts pay higher rates. Fast mode doubles the input and output rates on the models that support it. Our Claude Fable 5.2 coverage has the full breakdown of that model's pricing tiers.

Anthropic's own worked example shows how small the runtime charge is next to the tokens: a one-hour coding session on Claude Opus 5.5 using 50,000 input tokens and 15,000 output tokens costs $0.20 for input, $0.30 for output and $0.08 for runtime, $0.58 in total. With 40,000 of those input tokens read from the prompt cache, the same session costs $0.428. For readers outside the US, at November 13, 2026 rates ($1 = £0.76, C$1.43, approximate), that $0.58 session is about £0.44 or C$0.83, and the $0.08 hourly runtime charge is about £0.06 or C$0.11. A session running around the clock for a 30-day month would add $57.60 in runtime alone, about £43.49 or C$82.37, before a single token.

Two cautions on using the hosted numbers as a guide. First, if your inference provider is Bedrock, Google Cloud or Foundry rather than Anthropic, you pay that provider's Claude rates, which are set by the provider. Second, the self-hosted server itself is infrastructure you run and pay for: the server, the PostgreSQL database, the workers and the sandboxes all consume your compute, and Anthropic's documentation is explicit that securing them is your responsibility.

What is missing in the private beta

The private beta is not a feature-for-feature copy of the hosted service, and Anthropic publishes the gaps in a dedicated differences page. Read it before you plan a move, because several of the missing pieces are things teams build workflows around:

Three more behaviors catch people out. Web search and web fetch are off until you turn them on in the server's settings file, and while they are off, an agent that simply omits them runs without the tools and no error says so. MCP servers and Git hosts only connect when you list their hostnames in the settings file, with exact matches and no wildcards. And nothing migrates from the hosted service: agents, skills, vault credentials, memory stores and session history all have to be rebuilt on your server, because Anthropic copies nothing across.

Self-hosted, sandboxes, or the hosted service?

Anthropic now offers three ways to run Managed Agents, and the names say what you host:

The middle column matters more than it looks. If your only requirement is that agent code runs on your hardware, self-hosted sandboxes already do that, and have since May, without you operating a server, a database and a worker fleet. Full self-hosting is for teams that also need to hold the session history and credentials themselves, route model calls through their own provider, or meet a Zero Data Retention requirement the hosted service cannot satisfy.

Who this is for, and who should wait

The teams this fits are easy to name: regulated companies that cannot let agent session history or credentials sit on a vendor's servers, organizations already standardized on Bedrock, Google Cloud or Foundry that want their model traffic on an existing contract, and teams with a Zero Data Retention obligation. For them, the private beta is worth a conversation with their Anthropic account team now, because access is the bottleneck, not the software.

Everyone else should wait, or start with the hosted service. If your agents depend on scheduled deployments, webhooks or the Files API, the self-hosted edition cannot run them yet. If you are a small team, weigh the operations load honestly: you run and secure the server, its database and your sandboxes, you install each release yourself, and Anthropic's documentation assigns you the jobs it used to do, including hosting memory stores and detecting unusual usage. Each trust level needs its own deployment. And if you have no account team relationship with Anthropic, there is currently no other way in.

There is also a simpler question to ask first. Most of what teams want from "self-hosted agents" is an agent that works inside their systems without their code and data leaving the building. This release gives you the second half of that sentence. The model still leaves the building on every call, and for teams whose real worry is what the model sees, that is the fact that decides the purchase.

How to get access

Access runs through Anthropic's account team, which hands over the release archive; there is no public download and no self-serve signup. Each release's archive includes an operator guide, and Anthropic suggests having Claude read that file to help configure and run the server and write code that connects to it. Anthropic's documentation describes a Docker Compose setup for development and warns explicitly that it is not appropriate for production; a production install uses separate Helm charts for the server and the sandboxes, on a Kubernetes cluster running version 1.30 or later. Anthropic has published no date for general availability, no list of covered countries, and no pricing.

Check before you start

A few mistakes are easy to make with this release, and the documentation warns about most of them. Do not assume self-hosted means offline: the model calls still leave your network, and the provider you pick determines where they go. Do not assume migration: every agent, skill, vault credential and memory store has to be rebuilt, and session history does not carry over. Do not run the development Docker Compose setup in production; Anthropic says so directly. Turn web search and web fetch on explicitly in the settings file, or your agents will quietly run without them. Keep a worker polling each environment, because a session's model turns run even when no worker is polling, and the first tool call then waits with no error until a worker runs it. And send images and documents to the model as base64: the server accepts an image or document block with a URL source, but the model never sees it, and there is no error.

Is self-hosted Claude Managed Agents available now?

Only in private beta. Anthropic announced it on November 12, 2026, and access is limited to eligible organizations through their Anthropic account team. There is no public download, no self-serve signup, and no published date for general availability.

Does self-hosting keep my prompts private from Anthropic?

Not by itself. Every model call sends the conversation, including tool inputs and tool results, to your inference provider. If that provider is Anthropic, the call also carries your session, agent and environment IDs. What stays on your infrastructure is the harness, the sandboxes, the credentials and the session history, and Anthropic says it has no remote access to your server or its logs.

How much does self-hosted Claude Managed Agents cost?

Anthropic has published no price. Its pricing page directs you to contact your Anthropic account team. For reference, the hosted service bills tokens at standard model rates plus $0.08 per session-hour, and the model rates range from $0.10 per million input tokens for Haiku 5.5 to $8 for Fable 5.2.

Can I move my existing agents and session history from the hosted service?

No. Anthropic copies nothing from the hosted service, session history included. You create your agents, skills, vault credentials and memory stores again on your own server.

What is the difference from self-hosted sandboxes?

Self-hosted sandboxes, added in May 2026, move only the isolated environment where an agent's code runs onto your infrastructure. Anthropic still runs the service and stores the data. Self-hosted Managed Agents moves the service too: the API, the agent loop and all storage run on your servers.

Does it work with Bedrock or Google Cloud?

Yes. The server's inference.provider setting accepts Anthropic by default, Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry, or your own model gateway. Some features vary by provider: web search works under Anthropic, Vertex and Foundry, while web fetch works under Anthropic and Foundry.

Self-hosted Claude Managed Agents is a real answer to a real enterprise objection, and its limits are printed on the same pages as its promises. The harness, the sandboxes and the history can now live on your servers; the model cannot, the price is not published, and several hosted features have not made the trip yet. If your blocker was data residency, talk to your Anthropic account team. If your blocker was cost, or a feature on the missing list, the hosted service is still the way in. Check Anthropic's self-hosted documentation and the differences page before you decide.

Sources

• Anthropic, "Self-hosted Claude Managed Agents", Claude Platform Docs — platform.claude.com/docs/en/managed-agents/self-hosted
• Anthropic, "Differences from the hosted service", Claude Platform Docs — platform.claude.com/docs/en/managed-agents/self-hosted/differences
• Anthropic, "Claude Managed Agents overview", Claude Platform Docs — platform.claude.com/docs/en/managed-agents/overview
• Anthropic, "Pricing", Claude Platform Docs — platform.claude.com/docs/en/about-claude/pricing
• Help Net Security, "Self-hosted Claude Managed Agents keeps agent credentials in your environment", November 12, 2026 — helpnetsecurity.com
• Derrington Collaborative AI, "You can now host Claude Managed Agents yourself", November 12, 2026 — derringtoncollaborativeai.com
• AI Frontier Post, "Anthropic lets enterprises self-host the full Claude Managed Agents stack — private beta now open", November 12, 2026 — aifrontierpost.com