Anthropic opened a private beta on November 12 for self-hosted Claude Managed Agents — the first time enterprises can run the full agent control plane on their own infrastructure, not just the sandboxes. The pitch is data sovereignty: your agent sessions, credentials, and tool execution all stay behind your perimeter. That matters for regulated industries. But there are real gaps in this beta, and one specific gotcha that most coverage is glossing over.
What You’re Actually Running
The self-hosted deployment has three components. First, cma-server — this is the core: it serves the Managed Agents API, runs the agent loop, and stores agents, sessions, and session history. Second, a PostgreSQL 16+ database for persistence. Skip the database and the server defaults to in-memory storage, which means a restart wipes your session history. Don’t skip the database. Third, workers — separate processes that run your agent’s shell and file tools inside your own sandboxes. Critically, the server itself never executes tools; that’s the workers’ job.
Deployment options are Docker Compose for simpler setups or Kubernetes for production scale. Kubernetes deployment docs are already up.
The Gotcha Nobody Is Talking About
Here’s what most coverage is omitting: self-hosting the service does not mean self-hosting the model. The default inference.provider setting is anthropic — which means model requests still go to Anthropic’s API. Your agent loop runs on your server, your session history lives in your database, but every Claude inference call leaves your network.
To actually keep everything in your perimeter, you need to configure a non-Anthropic inference provider. The inference.provider setting accepts five values: anthropic (default), bedrock, vertex, foundry, or gateway (bring your own). If you’re in a regulated environment and your threat model includes model inference traffic, set this explicitly. The New Stack covered this as the key architectural nuance worth understanding before you request access.
What This Beta Does Not Do Yet
Four gaps worth knowing before you go to your account team:
- No scheduled runs. Webhooks are absent from the self-hosted server, so any worker logic triggered by webhooks won’t fire. Use your own cron or scheduler.
- No OAuth credentials. The
mcp_oauthcredential type is not accepted — the OAuth renewal flow is missing from this beta. - No migration from the hosted service. Nothing copies over. Agents, skills, vault credentials, and memory stores all need to be recreated on the new server from scratch.
- No automatic updates. You own the release cycle now. Anthropic ships a binary; you install it.
The workarounds exist — cron instead of scheduled runs, polling instead of webhooks — but if your team depends on OAuth credentials, that’s a real blocker for now. Developers Digest has a thorough breakdown of the full feature delta between hosted and self-hosted.
The Security Obligations That Come With It
Self-hosting means Anthropic is no longer responsible for securing your agent infrastructure. You are. That includes the server, the database, and the sandboxes — and it comes with specific contractual timelines baked into the license:
- Roll back a flagged version within 8 hours of a safety notice
- Deploy a safety update within 1 business day
- Report a confirmed agent incident to Anthropic within 48 hours
- Report unauthorized access to the codebase within 72 hours
The cma-server binary is Apache 2.0 — free to run. Anthropic caps its total liability for the self-hosted binary at $100,000, and your model usage costs remain unchanged under your existing Claude API, Bedrock, or Vertex agreement.
Who Should Request Access
The honest answer: regulated industries. Finance, healthcare, legal, and government organizations that face data handling requirements their vendor agreements currently violate. If you’re running agents against private code, internal documents, or sensitive customer data — and your compliance team won’t approve Anthropic-hosted session storage — this is what you’ve been waiting for.
If you’re not in a regulated vertical, the hosted Managed Agents service is simpler to operate, has more features, and Anthropic handles the security burden. The self-hosted beta makes sense when data sovereignty is non-negotiable, not just preferable. Anthropic’s official overview has the access request details. It’s private beta — access goes through your Anthropic account team, not a sign-up form. No general availability date has been announced.
