Claude Managed Agents can now be self-hosted with Bedrock, Google Cloud or Foundry

14 hours ago

8 min read

Anthropic has launched self-hosted Claude Managed Agents, a deployment option that lets an organization run the entire Managed Agents service on its own infrastructure instead of on Anthropic's. The change was published in the Claude Platform release notes on November 12, 2026, and it goes further than the self-hosted sandboxes Anthropic already offered: the API server, the agent loop and the storage for agents, sessions and session history now run in the customer's cloud account or on-premise data center, together with the sandboxes where the agent's tools execute.

The model is the only part that can stay outside. By default the self-hosted server sends model requests to the Claude API, but it can be configured to call Claude through Amazon Bedrock, Claude Models on Google Cloud (Google managed), Microsoft Foundry or a company's own model gateway. The server exposes the same API as the hosted service, so the Claude SDKs and the ant command-line tool work against it with a changed base URL and key.

Access is gated. Anthropic's documentation says that companies must contact their Anthropic account team to request the release archive, and no public price, license fee or usage tier has been published for the self-hosted option. The documented minimum stack is a server, a PostgreSQL 16 or later database and a set of workers, which can run on a single machine with Docker Compose for development or on Kubernetes 1.30 or later for production.

··········

SELF-HOSTED CLAUDE MANAGED AGENTS COMPARED WITH THE HOSTED OPTIONS.

Claude Managed Agents now offers three hosting arrangements, and the difference between them is which of three layers the customer operates: the sandboxes, the service and the model. Anthropic defines the sandboxes as the containers, virtual machines or other isolated workspaces where an agent's tools run commands and work on files, and the service as the API, the agent loop and the storage of agents, sessions and history.

........

Hosting option	Sandboxes	Service and storage	Model
Cloud sandboxes (default)	Anthropic	Anthropic	Anthropic
Self-hosted sandboxes	Customer	Anthropic	Anthropic
Self-hosted Managed Agents	Customer	Customer	Anthropic or a chosen provider

........

The intermediate option, self-hosted sandboxes, already let a company keep files and processes on its own workers while Anthropic ran the loop and stored the conversation. In that arrangement the conversation history, tool results, skills and memory stores still reach the Managed Agents service operated by Anthropic, because that is how the model receives each tool result. The new option removes that dependency for storage: agents, sessions and session history live in the customer's PostgreSQL database, and the only outbound traffic needed for reasoning is the model call itself.

Anthropic's own guidance is explicit about when each option fits. A team that only needs tools to run inside its network is pointed to self-hosted sandboxes. The full self-hosted service is recommended when storage must sit on the customer's infrastructure or when model calls must go to a specific inference provider, such as Bedrock or Foundry, rather than to Anthropic directly.

··········

HOW THE SELF-HOSTED CLAUDE MANAGED AGENTS STACK IS BUILT.

The core component is cma-server, which serves the API, runs the agent loop and stores agents, sessions and session history. It calls the configured inference provider whenever the model is needed, and the documentation stresses that it never runs an agent's shell or file tools itself. Those tools run in workers, programs that take work from the server and execute bash and file operations inside the customer's sandboxes; a worker can be an ant beta:worker command or a worker built with the SDKs.

Persistent data requires PostgreSQL 16 or later. The server can start without a database, but in that mode it keeps everything in memory and a restart erases every agent and session. The release also includes a web console served from the server's own address, where people sign in through the company's identity provider to create agents and run sessions, and an admin CLI, cma-server-admin, that creates environments and environment keys on Linux (x86-64 and Arm) and on macOS with Apple silicon.

Three credentials keep the layers separate. The server API key authenticates applications, the ant CLI and the admin CLI against the self-hosted server, playing the role that a Claude API key plays with the hosted service. The inference credential, which can be a Claude API key, a cloud credential or a gateway token, is held only by the server, so applications and workers never see it. Environment keys authenticate workers that poll one environment's work queue.

The server reads its settings from a single YAML file, with environment variables overriding the file and unknown keys stopping startup. The configuration reference shows this minimal example for a deployment that stores data in PostgreSQL and sends model calls to Amazon Bedrock:

server:
  addr: 0.0.0.0:8400
store:
  backend: postgres
  database_url: postgres://...        # or CMA_STORE__DATABASE_URL
inference:
  provider: bedrock
  region: us-east-1                   # CMA_INFERENCE__REGION
  api: invoke_model

··········

CLAUDE MODEL PROVIDERS SUPPORTED BY THE SELF-HOSTED SERVER.

The inference.provider setting accepts five values: anthropic, which is the default, bedrock, vertex, foundry and gateway. Bedrock deployments can use the invoke_model API or the newer messages API, Google Cloud deployments need a region and usually a project ID, and Foundry deployments point at an Azure resource or base URL. The gateway mode is aimed at companies that route all model traffic through an internal proxy: it takes a URL template, one of three request formats (bedrock-invoke, anthropic-messages or vertex-raw-predict), a model map and a credential supplier that can exchange short-lived OAuth tokens.

The choice of provider changes which agent features are available, and the documentation lists the differences precisely.

........

Feature	Works with provider	Behavior with other providers
web_search tool	anthropic, vertex, foundry	Not offered to the model
web_fetch tool	anthropic, foundry	Not offered to the model
inference_geo setting	anthropic	Agents that set it are refused
Fast mode (speed: "fast")	Depends on provider and model	Turns end with an error if not served
Server-side model fallback	anthropic (on by default)	Declined requests end with a refusal

........

The fallback row has a practical consequence for compliance teams. Under the anthropic provider, the server requests the Claude API's server-side fallback by default, so a model other than the one requested may answer a request that a safety classifier declined, and no event reports the switch, although the session records the answering model's ID. Setting inference.model_fallback: false turns that behavior off.

··········

[[ADPLUS_300x250_1]]

WHAT SELF-HOSTED CLAUDE MANAGED AGENTS DOES NOT SUPPORT.

A self-hosted server has the same API surface as the hosted service with a documented list of exceptions, and several of them affect existing agent designs. Only self_hosted environments exist, so a request for an Anthropic cloud environment returns a 400 error. The Messages API and Models API endpoints return 404, the Files API is absent and file session resources are rejected, which means input files must be placed in the worker's working directory or sent as base64 inside a message.

Several hosted conveniences are missing entirely. Scheduled deployments and the Dreams memory feature have no routes on the self-hosted server, and the documentation tells operators to start sessions from their own scheduler, such as cron. Webhooks are not sent, so applications follow sessions through the event stream. The prebuilt docx, pdf, pptx and xlsx skills are refused and must be downloaded from the skills repository and uploaded as custom skills, and mcp_oauth vault credentials are rejected because the server has no OAuth refresh flow.

Multiagent work is also narrower. Agents can delegate only to listed subagents, with multiagent set to the coordinator type and between 1 and 20 agents; dynamic workflows, the advisor and agent-defined subagents are unavailable. MCP servers, Git hosts and web tools are closed by default and must be allowlisted in the configuration file, and MCP tool results larger than mcp.max_result_bytes, 100 KiB by default, are truncated without being saved to a file as the hosted service does.

··········

SELF-HOSTED CLAUDE MANAGED AGENTS ACCESS, DEPLOYMENT AND OPERATING COSTS.

Companies cannot download the software from a public page. The release archive comes from the Anthropic account team, and each archive carries an operator-guide.md for its version. Anthropic has not published a price for the self-hosted option, so the known costs are the infrastructure a company runs and the model usage it pays to its chosen provider. Model calls sent to the Claude API are billed under the customer's Claude API agreement, and calls routed through Bedrock, Google Cloud or Foundry are billed by those platforms.

The two documented deployment paths serve different purposes. The Docker Compose quickstart runs the full stack on one machine with at least 2 CPUs, starts cma-server on port 8400 with 10 sandbox workers, and is described as unsuitable for production because it serves plain HTTP. The production path uses two Helm charts on Kubernetes 1.30 or later and requires the Agent Sandbox controller, nodes running the gVisor runtime and a network plugin that enforces NetworkPolicy; on GKE these map to the Agent Sandbox add-on, a GKE Sandbox node pool and Dataplane V2 or Calico.

........

Deployment detail	Docker Compose quickstart	Kubernetes with Helm
Intended use	Development on one machine	Production
Database	PostgreSQL container in the stack	PostgreSQL 16+ run outside the charts
Sandbox isolation	One container per session	gVisor sandbox pod per session
Default egress	Docker networking	Closed: no DNS, no public internet
Workspace per session	Ephemeral container	10 GiB /workspace volume
Transport	Plain HTTP on 127.0.0.1:8400	TLS ingress required in front

........

Operating the service also means taking over duties that Anthropic performs in the hosted version. The documentation states that the agent's bash tool is a real shell with the worker's permissions and network access, that the worker does not isolate it, and that isolation comes only from the container or pod around it. The customer becomes responsible for securing the server, hosting memory stores, detecting unusual usage and installing each release, and Anthropic advises a separate deployment for each trust level. Kubernetes environment keys are valid for 365 days and must be renewed through a Helm upgrade, while the dispatcher certificate lasts 825 days.

For teams evaluating the option alongside existing Claude integrations, our overview of Claude API endpoints, structured outputs and enterprise authentication covers the API conventions the self-hosted server mirrors, and our report on Anthropic-managed Claude deployments on Google Cloud describes the alternative in which Managed Agents stays operated by Anthropic inside a cloud provider. The recent Claude API message threads beta is relevant to long agent loops on either path.

··········

SELF-HOSTED CLAUDE MANAGED AGENTS: CONFIRMED FACTS AND OPEN QUESTIONS.

The documented facts are specific. Self-hosted Claude Managed Agents launched on November 12, 2026; it moves the API, agent loop and storage of agents, sessions and history onto customer infrastructure; it requires PostgreSQL 16 or later for persistence; it supports Anthropic, Amazon Bedrock, Google Cloud, Microsoft Foundry and custom gateways for inference; and it ships with Docker Compose and Kubernetes deployment paths, a self-hosted console and an admin CLI.

The open points concern commercial terms and scale. Anthropic has published no price or license structure for the self-hosted software, no hardware sizing beyond the quickstart's two-CPU minimum, and no list of which customers or plans qualify for access beyond the requirement to go through an account team. The gap between the self-hosted server and the hosted service is also substantial for teams that depend on Dreams, scheduled deployments, webhooks, the Files API or the advisor, and the documentation offers manual workarounds rather than equivalents for most of them.

For a regulated company, the decisive detail is the data path. With the default anthropic provider, each model call still sends the conversation so far, including tool inputs and results, to the Claude API along with session, agent and environment IDs. Keeping that traffic inside a chosen cloud requires switching the provider to Bedrock, Google Cloud, Foundry or an internal gateway and accepting the feature differences that come with each one, such as losing web_fetch on Bedrock and Google Cloud.

··········

·····

DATA STUDIOS

·····

datastudios.org