Claude Managed Agents Gets Self-Hosted Sandboxes and MCP Tunnels: What the Split-Plane Architecture Means for Operators

The most consequential constraint in enterprise AI adoption is not model quality — it is data residency. When an AI agent needs to read internal files, call a private API, or execute code against sensitive repositories, security teams ask a simple question: where does execution actually happen?

Anthropic's answer, shipped on May 19 at Code with Claude London, redraws that boundary for Claude Managed Agents. Self-hosted sandboxes move tool execution inside the customer's own perimeter. MCP tunnels connect agents to private-network MCP servers without exposing them to the internet. Together they define what Anthropic calls a split-plane architecture: orchestration stays on Anthropic's infrastructure; tool execution runs where you tell it to.

What changed

Self-hosted sandboxes (public beta) let organizations designate their own compute environment as the execution target for Claude Managed Agents. Files, repositories, and packages never leave the customer's network. Existing security controls — network policies, audit logging, EDR tooling — apply by default because execution lands inside the same infrastructure they already govern.

Teams that do not want to provision their own compute can use managed sandbox providers that have integrated with the API: Cloudflare Workers Sandbox, Daytona, Modal, and Vercel Sandbox. Those providers act as a vetted intermediary between Anthropic's orchestration layer and a sandboxed execution environment — closer to the customer's perimeter than Anthropic's default hosted execution.

MCP tunnels (research preview, access by request) solve the private-network connectivity problem. A lightweight gateway process opens a single outbound, end-to-end encrypted connection from the customer's network to Anthropic's Managed Agent platform. No inbound firewall rules, no public endpoints, no VPN reconfiguration. The agent can invoke MCP servers that sit behind internal firewalls — databases, ticketing systems, internal APIs — without those services being reachable from the public internet.

Why it matters for AI engineering teams

The conventional model for agentic pipelines has a dependency problem: if the orchestration engine needs to call your internal tools, either your tools become public-facing, or you build a custom bridge. Neither is operationally clean.

This launch breaks that tradeoff into two independent decisions teams can now make separately:

1. Where does the agent loop run? Answer: still Anthropic. Context management, error recovery, and the reasoning steps remain hosted, meaning you get model and orchestration updates automatically.

2. Where does tool execution run? Answer: your perimeter, or a managed provider you trust. This is what compliance teams have been asking for — code execution that never leaves the boundary they audit.

For teams using Claude Code in enterprise settings, self-hosted sandboxes enable the same coding-agent workflow they use locally, but with the execution environment staying behind corporate firewalls. For teams building internal automation — reading from private databases, writing to internal ticketing systems — MCP tunnels eliminate the need to expose internal services to reach them from a hosted agent.

The router/operator angle

The split-plane architecture introduces a useful mental model for gateway operators: not all agent activity is equally sensitive. The reasoning and orchestration layer (which model, which context, which tool to invoke next) can be cloud-hosted. The execution layer (file I/O, API calls, code running) is where residency requirements live.

If you route through a gateway like TheRouter, this creates a clear separation of concerns:

• Model routing and fallback operates at the orchestration level — which provider, which model tier, latency vs. cost tradeoffs — and is unaffected by where tool execution runs.
• Request logging and observability must be designed with the split plane in mind. Requests from Anthropic's orchestration to your sandbox appear on your network; the agent reasoning steps appear in Anthropic's API logs. A complete audit trail requires correlating both.
• Compliance attestation becomes easier: you can point a compliance reviewer at your sandbox environment's audit logs, your existing EDR tools, and your network policies — without arguing that Anthropic's hosted environment satisfies your controls.

For teams selecting a sandbox provider, the gateway implication matters: Cloudflare's integration means execution runs inside Cloudflare Workers, with Cloudflare's observability. Modal's integration runs on Modal's serverless infra. The choice of execution provider is a separate routing decision from which model you use.

MCP tunnels are currently a research preview requiring access request. If you're building internal tooling against private data, this is worth evaluating now, because the tunnel approach avoids the most common workaround — giving the AI platform network access to your internal services — that tends to fail security review.

What TheRouter users should watch

The Managed Agents sandbox and tunnel features operate at the Claude platform layer, not at the OpenAI-compatible API layer. Teams routing through TheRouter to Claude API endpoints are not using Managed Agents — they're using the underlying model API. The split-plane execution model is specific to Anthropic's first-party agent platform.

What this release does signal for routing operators:

• MCP as a connectivity pattern is maturing. Anthropic now officially supports MCP tunnels for private-network access. If you're building MCP tooling, the tunnel pattern for private MCP servers is worth designing for now.
• Audit and observability gaps exist in hybrid agent deployments. Teams that mix hosted orchestration with self-run tool execution should plan their observability stack to correlate logs from both planes. Gateway-level request logs are one piece; sandbox execution logs are another.
• Compliance requirements are a routing signal. If certain requests involve sensitive internal data, routing them through a provider that supports self-hosted execution may be a future selection criterion — distinct from latency and cost signals you already route on.

Request access to MCP tunnels via the Claude Managed Agents form. Self-hosted sandbox documentation is at platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes.