Self-hosted Claude Managed Agents runs Anthropic's agent service on your own cloud account or data centre, with your own PostgreSQL database. Sessions and history stay with you, but every model call still leaves for your chosen provider. Unless you must store sessions yourself or route model calls to your own provider, we'd use self-hosted sandboxes instead (tools run on your machines, the service stays Anthropic's) and skip operating the server.
Its licence took effect on 12 November 2026, and access is by request through your Anthropic account team.
Do you need the full service, or does a self-hosted sandbox do?
Think of three rungs, which differ in who hosts the sandboxes, the service and the model.
| Rung | Sandboxes | Service | Model |
|---|---|---|---|
| 1. Cloud sandboxes | Anthropic | Anthropic | Anthropic |
| 2. Self-hosted sandboxes | You | Anthropic | Anthropic |
| 3. Self-hosted Managed Agents | You | You | Anthropic or your chosen provider |
If you're unsure, Anthropic's guidance is to start at rung one, and move to rung two when tools must run on your infrastructure. On either, conversation history and tool results go to the service Anthropic operates. The docs name two reasons to climb to rung three:
- You must store agents, sessions and history yourself.
- Model calls must go to Bedrock, Claude Models on Google Cloud, Microsoft Foundry or your own gateway.
So when a customer says "we want this in our own cloud", ask which thing they mean. If it's where files and processes run, that's rung two. If it's where session data is stored, that's rung three. Anything softer than a stated requirement stays on rung one or two. For the wider question of what agents may touch, see AI in the engineering workflow: tools, permissions and policy.
What still leaves your network?
More than the word "self-hosted" suggests. The data and access page says each model call sends the conversation to the provider: prompts, tool inputs and tool results. If a customer's worry is where conversation text travels, rung three doesn't settle it; only your provider choice does. What you do get is that Anthropic has no remote access to your server or its log.
Retention works like this. Anthropic's hosted Managed Agents service isn't covered by zero data retention. Self-hosted is the exception for session data, because the transcripts sit in your database and you decide how long they stay. The model calls are a separate matter, governed by your arrangement with whichever provider you route to. If that provider is Anthropic, our piece on the 30-day data retention question covers which Claude 5.2 models need 30-day retention.
Which model providers can it call, and what do you lose?
You set inference.provider to one of five values, and each changes which tools work.
| Provider | Credentials | web_search | web_fetch |
|---|---|---|---|
| anthropic | ANTHROPIC_API_KEY | yes | yes |
| bedrock | AWS credentials | no | no |
| vertex | Application Default Credentials | yes | no |
| foundry | API key or Entra ID | yes | yes |
| gateway | your own | no | no |
Web tools are off until you enable them. Pinning inference to a region with inference_geo works only on the anthropic provider; under any other, the server refuses to save an agent that sets it. So a regional-data requirement met through Bedrock costs you both web tools and that setting. Picking vertex also raises the question of who holds your Claude contract on Google Cloud, a question we work through in which contract should carry your Claude spend on Google Cloud.
What do you run, and what's missing?
You run and secure a server, its database and your sandboxes, and you install each release yourself. That means cma-server, PostgreSQL 16 or later, workers that host the sandboxes, and a console and admin CLI on your own server. Skip the database and everything lives in memory, so one restart erases it.
The Bash tool is a real shell with the worker's permissions, so isolation depends on what you run the worker in. Allowlists for MCP hosts, Git hosts and web tools are yours to maintain.
Each deployment serves one tenant or one trust level, because its server API key reaches every environment inside it. A second customer at a different trust level therefore means a second deployment, with its own database, key and workers.
The hosted service's features aren't all here. Missing:
- Cloud environments, the Messages and Models APIs, and the Files API
mcp_oauthvault credentials- The prebuilt docx, pdf, pptx and xlsx skills
- Scheduled deployments, dreams and webhooks
Nothing migrates, so you recreate agents, skills, vault credentials and memory stores by hand, and the Console at platform.claude.com won't show your server. On the plus side, provider choice, OIDC single sign-on and your own secret manager exist only on your server, and those are what an enterprise security review tends to ask about.
What does the licence make you do, and who is on call?
The licence is royalty-free, and model usage stays under your separate agreement with the provider. The obligations are where the staffing lives:
| Clause | What it means for you |
|---|---|
| Section 5.3 | Disable or roll back within 8 hours of a risk notice |
| Section 5.2 | Each Safety Update deployed within 1 business day of delivery |
| Section 5.1 | Updates aren't guaranteed, so don't plan around support |
| Section 8.2 | Anthropic's total liability is capped at US$100,000 |
The clauses run per deployment, so the two-deployment setup above doubles your exposure to a Friday-evening notice. A server patched on Anthropic's schedule needs a named owner and a rota before the first production tenant, not after.
Worked example: a 40-engineer SaaS with an EU bank customer
The bank's contract says agent session data must be stored in the customer's own region account. A second customer sits at a different trust level.
- Cloud sandboxes fail, because Anthropic stores transcripts until you delete them.
- Self-hosted sandboxes fail, because history still sits with Anthropic's service.
- Self-hosted Managed Agents meets it. Sessions sit in your PostgreSQL, and
inference.provider: bedrockwith a region and model-ID prefix of the bank's choosing sends model calls to Bedrock. The server defaults to a US cross-region profile (us.anthropic.), so the prefix needs changing.
The price of that yes is the second deployment and its on-call clocks. If the team uses webhooks or scheduled deployments today, it also writes its own scheduler and event-stream polling.
The storage clause alone justifies rung three here. Without it, this team stops at rung two.
Who should wait, and what to ask Anthropic first?
Wait if nobody can own a server and a database, or if you depend on the missing features above. Before committing, ask your account team what the server costs, what model calls cost on the provider route you chose, and how often releases ship. To size the work, run the Compose stack on a throwaway host, then plan the Helm deployment with your platform team.
What this means for your agent plans
The decision for a CTO or VP Engineering is narrow: do you need agent infrastructure that stores session data and routes model calls on your side, or only tools running on your machines? A customer contract or regulator is the only good reason for the first. Get that requirement in writing from the customer and match it to the rungs before anyone provisions a database.
If it holds, budget for an owner and an on-call rota per deployment, because the licence puts clocks on you. If it doesn't, rung two gives you machine-local tools with far less to operate, and you can climb later if the requirement shows up.
The harder version of this decision is the one your customer presses on you from the other side, covered in when a customer asks for a self-hosted version.
FAQ
Can you self-host Claude Managed Agents?
Yes. You request access through your Anthropic account team, then run the service and its sandboxes on your own cloud account or data centre.
Does self-hosting keep my data inside my network?
Storage, yes: sessions and history sit in your PostgreSQL. Model calls don't. Each one carries the conversation, tool inputs and tool results to the provider you choose.
Does self-hosted Managed Agents work with zero data retention?
The hosted service isn't covered by zero data retention. Self-hosted is the exception for session data, because you store the transcripts yourself. Zero data retention for the model calls depends on your arrangement with the provider.
How much does self-hosted Managed Agents cost?
The licence is royalty-free, and model usage is under a separate agreement. Infrastructure, staff time and any server fee aren't published, so ask your account team.
Can I use Bedrock, Vertex or Foundry?
Yes. inference.provider accepts anthropic, bedrock, vertex, foundry or a gateway. Web search works on anthropic, vertex and foundry; web fetch only on anthropic and foundry.