On May 19, during the Code with Claude event in London, Anthropic unveiled two new components for Claude Managed Agents: self-hosted sandboxes (now in public beta) and MCP tunnels (in research preview).
Finally, a partial compromise: execution environment can stay on your premises
Previously, when Claude Managed Agents ran tools, everything happened on Anthropic's servers—code executed in Anthropic's sandbox, files read into Anthropic's memory, build artifacts stored on Anthropic's disk. That worked for individual developers but was a nightmare for enterprises. If your codebase cannot leave the corporate network, or if your database requires audit for any data egress, the old approach was a non-starter.
Self-hosted sandboxes split the responsibilities:
- Anthropic handles: orchestration, context management, error recovery, and the agent loop itself
- You handle: CPU, memory, runtime images, network policies, and audit logs
Files and repositories always remain in the customer environment, according to the company.
Anthropic also named four hosting partners:
- Cloudflare: microVMs
- Daytona: stateful environments
- Modal: GPU/CPU compute
- Vercel: VPC peering
You can set up your own infrastructure or choose one of these four partners for managed hosting.
Key limitation: orchestration still runs on Anthropic's servers. This is not a fully on-premises deployment—the agent's brain remains in the cloud, only its hands come home.
MCP tunnels: feed private systems to agents without opening firewalls
The second piece is more subtle. MCP (Model Context Protocol) has become an industry standard interface over the past year, but the truly valuable enterprise resources live behind firewalls—internal OA systems, ticketing systems, data warehouses, knowledge bases, and private APIs. To let Claude Agent access these, the traditional approach required opening a public endpoint and then adding extensive allowlists and authentication.
Anthropic flipped the model:
Instead of Anthropic connecting in from outside, your MCP server initiates an outbound encrypted connection to Anthropic.
Specifically, enterprises deploy a lightweight gateway that establishes an end-to-end encrypted outbound tunnel to Anthropic's infrastructure. Claude Managed Agents and the Messages API access internal MCP services through this tunnel, without opening any inbound firewall rules or exposing any public ports.
Databases, APIs, knowledge bases, ticketing systems—internal systems that previously could not be integrated into AI workflows—can now become tools directly callable by agents.
Who this matters to
InfoQ quoted industry observer Daksh Trehan:
"The compliance team is the real bottleneck for production agents, not the model."
In plain terms, the barrier to enterprise AI adoption is not model capability but compliance teams refusing to let data leave the premises. Over the past six months, large deals like Claude Cowork, Claude for Excel, PwC's 30,000-employee deployment, and NEC's 30,000-employee deployment were only possible because Anthropic kept moving toward "enterprise controllability." Self-hosted sandboxes return execution control to customers, and MCP tunnels expand internal network access into Claude—both steps package model capabilities into a form that compliance audits can approve.
Last week, OpenAI announced its DeployCo + Tomoro enterprise combination, and Google's Antigravity 2.0 also touted an "Enterprise Agent Platform." All three see the same truth: even doubling consumer ChatGPT subscriptions yields only a few billion dollars, while enterprise IT budgets are in the trillions. Whoever first solves the "agent + compliance" equation will capture the next wave.
Sources: CocoLoop, Anthropic adds self-hosted sandboxes and MCP tunnels to Claude Managed Agents (The Decoder), Anthropic Introduces MCP Tunnels for Private Agent Access to Internal Systems (InfoQ), Anthropic debuts MCP tunnels and self-hosted sandboxes to lock down AI agent infrastructure (The New Stack)