Starting today, Claude Managed Agents can operate in a sandbox you control and connect to your private Model Context Protocol (MCP) servers. Both the sandbox where an agent executes tools and the services it reaches run within the established boundaries of your enterprise, under your security and runtime controls. The sandbox runs on your own infrastructure, or with managed providers like Cloudflare , Daytona , Modal , or Vercel to handle the compute and isolation for you. On the Claude Platform, self-hosted sandboxes is available in public beta and MCP tunnels in research preview ( request access ). Self-hosted sandboxes: keep agent execution within your perimeter A self-hosted sandbox lets a Claude Managed Agent execute tools on infrastructure you control or with a managed sandbox provider. Code execution, sensitive files, packages, services, and data stay within your enterprise perimeter, under your security and runtime controls. With self-hosted sandboxes, you keep sensitive files, packages, and services in your own infrastructure or with a managed sandbox provider. The agent loop that handles orchestration, context management, and error recovery stays on Anthropic’s infrastructure, while tool execution moves to your own configured environment. Inside your perimeter, network policies, audit logging, and security tooling are already in place, and files and repositories don't leave. You also control the compute: resource sizing and the runtime image are set on your side, so agents running compute-heavy work such as long builds or image generation get the CPU, memory, and capacity the task needs. Choose your sandbox client Bring any sandbox client you want, or start with one of our supported providers: Cloudflare runs sandboxes at scale using microVMs and lighter weight isolates. Outbound network requests are in your control with zero-trust secrets injection, customizable proxies to audit, reroute, or modify egress, and the ability to connect to internal services over Cloudflare's network. Amplitude is building Design Agent, an internal tool for on-brand production UI and marketing design, on Managed Agents and Cloudflare for tighter observability and control. Daytona sandboxes are full composable computers, long-running and stateful. The same primitive runs a quick burst or an agent that works for hours. The sandbox stays accessible while a session runs over SSH or an authenticated preview URL, or can be paused and restored with full state preserved. Clay’s GTM engineering agent, Sculptor, builds, tests, and monitors workflows autonomously on Managed Agents and Daytona. Modal is a cloud platform built for AI workloads, where sandboxes share the same foundation as Modal's functions, storage, and networking primitives, giving you everything you need to build production AI systems. Modal's custom container runtime delivers sub-second startup on any image, scales to hundreds of thousands of concurrent sandboxes, and gives you CPU and GPU resources on demand. Vercel sandboxes combine VM security, VPC peering, and bring your own cloud with millisecond startup time. Managed Agents handles the model, tools, and session state, while the Vercel Sandbox firewall injects credentials at the network boundary so they never enter the sandbox. Rogo , an AI platform for institutional finance, is building an analyst agent on Managed Agents and Vercel Sandbox to handle their proprietary data securely. MCP tunnels: Connect to services within your private network MCP tunnels connect Claude Managed Agents to Model Context Protocol (MCP) servers inside your private network without exposing them to the public internet. Internal databases, private APIs, knowledge bases, and ticketing systems become tools your agents can call. A lightweight gateway you deploy makes a single outbound connection, no inbound firewall rules, no public endpoints, and traffic encrypted end to end. MCP tunnels is supported in Managed Agents and the Messages API. MCP tunnels is managed from workspace settings within the Claude Console by organization admins.
从今天开始，Claude Managed Agents 可以在由你控制的 sandbox（沙箱）中运行，并连接到你的私有 Model Context Protocol (MCP) 服务器。agent 执行工具的 sandbox，以及它所访问的服务，都运行在你企业既有边界之内，受你的安全与运行时控制。该 sandbox 可运行在你自己的基础设施上，或交由 Cloudflare、Daytona、Modal、Vercel 等托管提供商为你处理计算与隔离。在 Claude Platform 上，self-hosted sandboxes 已进入 public beta，MCP tunnels 处于 research preview（request access）。Self-hosted sandboxes：让 agent 执行保持在你的边界内 self-hosted sandbox 允许 Claude Managed Agent 在你控制的基础设施上，或通过托管 sandbox 提供商执行工具。代码执行、敏感文件、packages、服务和数据都留在你的企业边界内，受你的安全与运行时控制。借助 self-hosted sandboxes，你可以将敏感文件、packages 和服务保留在自己的基础设施中，或放在托管 sandbox 提供商处。负责编排、上下文管理和错误恢复的 agent loop 保留在 Anthropic 的基础设施上，而工具执行则转移到你自行配置的环境中。在你的边界内，网络策略、审计日志和安全工具都已就位，文件和代码仓库不会离开。你还可以控制计算资源：资源规格和运行时镜像都由你这一侧设定，因此运行长时间构建或图像生成等高计算负载任务的 agents，能够获得任务所需的 CPU、内存和容量。选择你的 sandbox client 你可以使用任何想用的 sandbox client，或直接从我们支持的提供商开始：Cloudflare 使用 microVM 和更轻量的 isolate 大规模运行 sandboxes。出站网络请求由你控制，支持 zero-trust secrets injection、可自定义代理以审计、重路由或修改出口流量，并可通过 Cloudflare 的网络连接到内部服务。Amplitude 正在基于 Managed Agents 和 Cloudflare 构建 Design Agent，这是一款用于符合品牌规范的生产级 UI 和营销设计的内部工具，以获得更强的可观测性与控制能力。Daytona sandboxes 是完整、可组合的计算机，支持长时间运行并保持状态。同一种基础原语既可用于短时突发任务，也可用于连续工作数小时的 agent。session 运行期间，sandbox 可通过 SSH 或经认证的预览 URL 持续访问，也可以暂停并恢复，同时完整保留全部状态。Clay 的 GTM engineering agent——Sculptor——正基于 Managed Agents 和 Daytona 自主构建、测试并监控工作流。Modal 是一个面向 AI 工作负载的云平台，其中 sandboxes 与 Modal 的 functions、storage 和 networking primitives 建立在相同基础之上，为你提供构建生产级 AI 系统所需的一切。Modal 的自定义容器运行时可让任意镜像实现亚秒级启动，扩展到数十万个并发 sandboxes，并按需提供 CPU 和 GPU 资源。Vercel sandboxes 将 VM 安全性、VPC peering 和 bring your own cloud 与毫秒级启动时间结合起来。Managed Agents 负责模型、工具和 session 状态，而 Vercel Sandbox firewall 会在网络边界注入凭证，因此凭证永远不会进入 sandbox。Rogo——一个面向机构金融的 AI 平台——正在基于 Managed Agents 和 Vercel Sandbox 构建 analyst agent，以安全处理其专有数据。MCP tunnels：连接你私有网络中的服务 MCP tunnels 可将 Claude Managed Agents 连接到你私有网络内部的 Model Context Protocol (MCP) 服务器，而无需将其暴露到公共互联网。内部数据库、私有 API、知识库和工单系统都可以成为你的 agents 可调用的工具。你部署的轻量级 gateway 只需建立一条出站连接：无需入站防火墙规则、无需公共端点，且流量全程端到端加密。MCP tunnels 已在 Managed Agents 和 Messages API 中获得支持。MCP tunnels 由组织管理员在 Claude Console 的 workspace settings 中进行管理。