news • May 19, 2026 • 2 min read

Anthropic Ships Self-Hosted Sandboxes and MCP Tunnels for Claude Managed Agents

At Code with Claude London, Anthropic moved the agent tool-execution boundary inside the customer perimeter — self-hosted sandboxes in public beta, MCP tunnels in research preview. For enterprises that have been blocked by 'where does the agent actually run code and reach our systems?', the answer just got cleaner.

Source: Anthropic

Blue circular Claude orchestrator on the left linked to an orange customer-controlled vault on the right via an encrypted tunnel with a central lock symbol
CrateOS monitoring note: the boundary that just moved is the one most enterprise deployments stall on. Where tool code runs, and how that code reaches WMS / ERP / OMS without opening inbound firewall holes, is the part that takes months to negotiate. Anthropic is shrinking that to a configuration choice.

On May 19, at its Code with Claude London event, Anthropic shipped two updates to Claude Managed Agents aimed squarely at enterprise blockers. Self-hosted sandboxes — now in public beta — let companies run tool execution on their own infrastructure or through managed providers like Cloudflare, Daytona, Modal, and Vercel, while Anthropic continues to host the orchestration loop, context management, and error recovery. Compute sizing and runtime images are set on the customer side, so long builds, image generation, or heavy data work get the CPU and memory the workload actually needs. The second feature, MCP tunnels (research preview), lets agents reach internal Model Context Protocol servers via a single outbound encrypted gateway — no inbound firewall rules, no public endpoints, end-to-end encryption. MCP tunnels are supported in Managed Agents and the Messages API.

For supply chain and operations teams, this is the boundary that mattered. The standard objection to letting a vendor-managed agent touch a warehouse system has been "we are not opening an inbound path from Anthropic into our network" — a defensible position that historically forced either a proxy build-out or a no-go. An outbound-only tunnel plus customer-side tool execution removes the architectural objection without forcing the data graph into a third party. The remaining work — identity, audit, kill switches, policy on which agents reach which systems — is still operator work. But the room where that conversation happens just shifted from "should we" to "how do we." For anyone running a Claude-based agent program, request access to MCP tunnels and start the security-review conversation now; the integration patterns will set quickly once a few enterprises ship.

Your exceptions are costing you.Let's talk.