Self-Hosted Claude Managed Agents: Run AI Agents on Your Own Servers

Anthropic has taken Claude Managed Agents inside the firewall. On 12 November 2026 the company announced a private beta of self-hosted Claude Managed Agents: businesses can now run the entire Managed Agents service on their own cloud or on-premises infrastructure, including the agent harness, the sandboxes, the credentials and the session history.

The short version: the service moves home, but the model does not. Your servers run the agent loop and hold the history. Every model call still goes to a provider you choose: Anthropic, Bedrock, Google Cloud, Microsoft Foundry, or your own gateway.

What self-hosted Claude Managed Agents actually is

Claude Managed Agents is Anthropic's service for long-running AI agents: agents that work through a bug backlog, fix builds, test releases and triage alerts over hours, rather than answering one chat message and stopping. It launched as a fully hosted beta on 8 to 9 April 2026, gained self-hosted sandboxes in May, and now the whole service can move home. Anthropic announced it through its ClaudeDevs account and release notes; it was covered the same day by Help Net Security. Anthropic is not alone: on 6 November 2026 Mistral took its Mistral Studio to customer VPC and on-premises deployments.

Three pieces now live on your side of the boundary. The cma-server serves the Managed Agents API, runs the agent loop and stores agents, sessions and history. A PostgreSQL 16 or later database holds that history. Workers run the agents' shell and file tools inside your own sandboxes. The server itself never runs an agent's shell or file tools.

What runs on your servers, and what does not

Here is the split.

• cma-server: serves the Managed Agents API, runs the agent loop, and stores agents, sessions and history.
• PostgreSQL 16 or later: holds that history. Without it, the server keeps data only in memory, and a restart erases it.
• Workers: run the agents' shell and file tools inside your sandboxes, under your controls.
• Credentials: vault credentials live with the deployment, inside your infrastructure.

What does not move home is the model itself. Each model call goes to Anthropic by default, or to a provider you pick with the inference.provider setting. Anthropic says it has no remote access to your self-hosted server or its logs: a real control over the harness, not over the model traffic. Our chatbot-versus-agent guide explains the difference.

The model traffic question: what leaves your network

Self-hosting the harness is not the same as self-hosting the model. When an agent reasons, the prompt, the context and the tool results travel to your chosen provider, and the response comes back. With Anthropic's own API, your agent's working material leaves your network on every model call, even though history, credentials and sandboxes stay home.

That makes the routing decision the whole game. Route calls through your own gateway and you control the path and the egress. Use a provider with a zero-data-retention agreement and you have a contractual answer for the data that does leave. Or accept the default route and treat the beta as a control upgrade, not a data-residency solution. Our RAG chatbot guide makes the same point.

For regulated businesses this is the first question to settle, before any pilot. A team that hears "self-hosted" and assumes nothing leaves the building will be unpleasantly surprised. The honest pitch is narrower: credentials and history stay in-house, execution stays in-house, and model traffic goes exactly where you point it.

What you lose compared with the hosted service

Self-hosting is a trade, not a free upgrade: the self-hosted server does not yet match the hosted service.

• Scheduled deployments: unavailable. If your agents run on a timetable, that timetable does not move home yet.
• Dreams: unavailable. Anthropic's background processing feature does not run on the self-hosted server.
• Webhooks: unavailable. Nothing pushes events out to your systems from the self-hosted deployment.
• Web search and web fetch: off until you enable them. A sensible default for a private deployment, and a real limit for research work.
• Migration: nothing moves from hosted. Agents, skills, vault credentials, memory stores and session history must all be rebuilt.

If your use case depends on scheduled runs or webhooks, wait. If it depends on agents working a backlog inside your perimeter, the missing features may not matter. Our governed AI agents coverage weighs the control you gain against the conveniences you give up.

Who this is for, and who should wait

The strongest fit is a regulated business with long-running agent work and a real perimeter to protect: a bank triaging alerts, a healthcare provider working a bug backlog, or a law firm testing releases. Their credentials and history are the sensitive part, and those now stay in-house. Our AI agents and automation development service builds this kind of agent work for clients, and the perimeter question comes up in every first meeting.

Three groups should wait: anyone whose compliance case depends on no data leaving the network, until traffic runs through their own gateway or a zero-retention agreement; teams that need scheduled deployments, dreams or webhooks on day one; and teams deep into the hosted beta, for whom rebuilding everything is a real migration cost. Our AI agents for small business automation guide lists the jobs worth automating first.

Access is also limited: the beta is available only through the Anthropic account team, for eligible organisations, with no public pricing, no list of covered countries and no general-availability date. Our Claude usage policy coverage shows how fast Anthropic's rules move; treat any date you hear as provisional until it is in writing.

How to evaluate it: a practical plan

Two deployment routes exist. Docker Compose is for development, and Anthropic says explicitly that it is not for production. Helm-based tooling is the recommended route for a persistent production install.

Week 1: settle the traffic route

Before any agent runs, decide where model calls go: the default route, a cloud provider, or your own gateway. Get compliance sign-off, confirm the PostgreSQL 16 database is in place, and set web search and web fetch deliberately. Our how to build an AI voice agent guide covers the same discipline: deployment decisions made before launch matter more than the ones made after. See our Claude Duet coverage and AI calling agent cost guide for what agent work costs in production.

Week 2: rebuild one agent, not five

Pick one bounded job, such as triaging a week of alerts, and rebuild that single agent from scratch. Measure three things: does it finish without human rescue, does the history survive a restart, and does the audit trail show every shell command it ran? Our n8n vs Make vs Zapier comparison shows how agent work slots into a workflow once proven. Our GDPx agent benchmark post showed even the best models score only around 12% on long-horizon agent tasks.

Week 3: test the failure modes

Restart the server and check the history is intact. Revoke a credential and confirm the agent fails safely. Point an agent at a repository it should not touch and confirm the sandbox holds. If you want a second pair of eyes, talk to Coheser. Our custom software cost guide covers what the system around an agent costs, and our SaaS scaling guide covers building it once. More from Coheser on AI agents and automation.

Frequently asked questions

What are self-hosted Claude Managed Agents?

A private beta announced by Anthropic on 12 November 2026. Businesses run the entire Claude Managed Agents service, harness, sandboxes, credentials and history, on their own cloud or on-premises infrastructure.

Does self-hosting Claude Managed Agents keep all my data on-premises?

No. Credentials, history and code execution stay inside your infrastructure, but every model call still goes to a provider you choose. That traffic leaves your network unless you route it through your own gateway or a zero-data-retention agreement.

What do I need to run the self-hosted server?

The cma-server component, a PostgreSQL 16 or later database for session history, and workers that run agents' shell and file tools inside your sandboxes. Without the database, a restart erases the history. Docker Compose is for development only; Helm tooling is recommended for production.

Can I migrate my existing hosted agents to the self-hosted server?

No. Anthropic says nothing migrates: agents, skills, vault credentials, memory stores and session history must all be rebuilt. Scheduled deployments, dreams and webhooks are also unavailable on the self-hosted server.