Dirty Static // The Verdict
The strongest private route to Claude agents yet, for firms that need history, credentials and sandboxes inside their own walls and can run the platform themselves. Ask for beta access if that control is the blocker. Wait if you need the model itself on site, a published price, or the hosted features that have not moved over.
Best forRegulated firms and large engineering teams that want Claude agents on internal code, with session history and credentials kept in their own environment
What works
- The whole control plane moves home, server, database, sandboxes, credentials and session history, not only the sandbox alone
- Model choice stays open across Anthropic, Amazon Bedrock, Google Agent Platform, Microsoft Foundry and a gateway you run yourself
- Security design is built in, with the brain split from the hands, credentials held outside the sandbox, network allow lists and a full session record
- You keep the same core APIs as the hosted service, so work built for hosted agents has a familiar path in house
What does not
- Claude itself never moves home, so each prompt and tool result still leaves for a model provider you choose
- Private beta only, through an account team, with no published server price and no date for a wider release
- Nothing migrates from the hosted service, and seven hosted features are missing, among them webhooks, scheduled runs and the Files tool set
- You take on patching, securing and updating the server, with licence duties that include a safety rollback inside eight hours
Research review: based on published testing, specifications, and documentation, not hands on testing.
Private beta is the honest label for this product, and private is also the point. Anthropic opened self hosted Claude Managed Agents on November 12, 2026, for eligible firms that want agents working on internal code without sending the control plane to a vendor. The server, the database and the workers run inside your walls. Claude itself does not. Facts checked November 13, 2026.
That split decides who should care. If your security team blocked agents because a vendor held the session record and the credentials, this beta answers that block in full. If your rules say no prompt may leave the building at all, this beta answers nothing, because each model call still goes out. Our news report on the launch, Anthropic Opens Self Hosted Claude Managed Agents Beta, covered the announcement. This review weighs whether the trade is worth running.
What It Is
Managed Agents is Anthropic suite for agents that work for hours on their own, fixing broken builds, testing releases, triaging alerts and clearing bug backlogs. You define an agent with a model, a prompt, tools and skills, and the service runs the loop, calls tools in a sandbox and keeps a record of each step.
Until May 2026, you had two choices. Use the fully hosted service and let Anthropic run all of it, or use self hosted sandboxes, where tool work ran at home while Anthropic still ran the loop and held the record. The new beta is the third choice. You run the whole service at home and keep the same core tools and APIs that the hosted service offers, per Anthropic launch post.
Three parts sit on your side. The server, named cma-server in the docs coverage, serves the API, runs the agent loop and stores agents and sessions. A PostgreSQL database holds the history. The workers run shell and file tools inside your sandboxes, and the server itself never runs those tools, per Anthropic and docs summaries published on launch day.
Features and Specifications
The border of this beta is plain. You gain control of the harness and the record. You lose a set of hosted extras, you take on the upkeep, and you get no public price to put in a budget.
Specifications, from Anthropic launch post and docs coverage as reported November 12 and 13, 2026
- Product
- Self hosted Claude Managed Agents
- Maker
- Anthropic
- Status
- Private beta from November 12, 2026
- Access
- Eligible firms only, through an Anthropic account team
- You run
- The cma-server, its database, and the workers for shell and file tools
- Database
- PostgreSQL 16 or later for a setup that survives a restart
- Without a database
- Data stays in memory and a restart erases it, per docs coverage
- Model routes
- Anthropic directly, Amazon Bedrock, Google Agent Platform, Microsoft Foundry, or your own gateway
- Console
- A web console at the server address, with sign in through your identity provider, per docs coverage
- Server price
- Not published
- Wider release
- No date given
Pricing needs two lines kept apart. The first is the server. Anthropic published no price for it in the launch post or the docs pages read by launch coverage, and the licence text calls its grant royalty free while leaving model pricing under your existing deal alone. The second is the model. Each call still bills under the terms for the provider you choose. For scale, the hosted Managed Agents price is public and is not the self hosted price. Hosted use bills at normal token rates plus $0.08 for each hour a session runs, with web search inside a session at $10 per 1,000 searches, per Anthropic pricing coverage checked in November 2026. Ask your account team for the self hosted terms in writing before you plan around either figure.
| Item | Where it stands |
|---|---|
| Server cost | Not published, ask the account team |
| Model cost | Your existing provider terms still apply |
| Hosted reference cost | Token rates plus $0.08 per running session hour |
| Who patches and secures | You, for the server, the database and the workers |
| Who installs each release | You |
| Named beta customers | None named in the sources checked |
Real World Experience
This is a research review. Dirty Static did not get beta access and did not run the server for this article. What follows draws on Anthropic launch post, Anthropic docs and licence pages as reported on November 12 and 13, and launch coverage that names those docs as its source. Treat vendor claims as claims where the text says so.
The daily gain is control you can point to in a security review. Session history lives in your database until you delete it. Credentials can sit in your own secrets manager. Anthropic says it has no remote access to the server or its logs, a claim your team can test in your own network in a way you cannot test a hosted control plane. For an agent that touches private code and internal systems while staff sleep, that record and that boundary are the product.
The setup cost is also plain, even without a hands on run. Docs coverage describes a Compose route for a first look and a Kubernetes route for production, with each session given a workspace volume. One sizing summary based on the docs put ten sessions at 100 GiB of workspace requests, before the database and retained history. That figure is a docs based estimate, not a measured result, and it shows the shape of the bill. Your cloud cost grows with each running session, not only with tokens.
The work of moving hurts more than the work of starting. Docs coverage of the differences page says nothing is copied from the hosted service. Agents, skills, vault credentials, memory stores and session history must all be built again on your server. A team with a year of hosted agents faces a rebuild, not a migration tool, and should budget staff time for that work before it asks for beta access.
What Works
The first strength is scope. Earlier private routes moved only the sandbox home and left the most sensitive parts, the loop, the credentials and the history, with the vendor. This beta moves all three. A security team that said no to the sandbox route for that reason has to judge this version on new grounds.
The second strength is model route choice. A firm on Amazon, Google or Microsoft can send calls through the cloud deal it already holds, with its own retention and billing terms, or through a gateway it runs itself. Anthropic says a zero data retention deal with Anthropic applies to these calls in the same way as any other Messages call. Choice does not make calls private by itself, but it lets a firm put calls under the contract it trusts most.
The third strength is the security shape Anthropic built before it moved the product home. The brain and the hands stay split, so agent code runs in the sandbox while the loop, the history and vault secrets stay outside it. A proxy outside the sandbox adds credentials to supported calls, so the agent never sees the key. Each environment can list allowed hosts and block all others. Each session leaves a full record that can flow out over OpenTelemetry, the open standard for sending traces and logs to monitoring tools. Those are design choices a buyer can verify, not slogans.
What Does Not
The model wall comes first. No weights move home, no local model runs this server, and the licence limits use with other models except where the docs allow it, per licence coverage. Firms that need a fully air gapped setup, with no call leaving the site, should stop here. This product is private control of the platform around Claude, not private Claude.
The missing features come next. Docs coverage counts seven hosted items as not available in the self hosted build. The list includes cloud environments, the Files tool set and its API, webhooks, scheduled deployments and the feature Anthropic calls dreams, plus the rest of the Claude API on this server and OAuth handling for some tool servers. Web search and web fetch also stay off until you turn them on, and they work only with some model routes. A team that leans on scheduled runs today would need its own scheduler tomorrow.
The licence is the third problem, and it is a staffing problem. Licence coverage gives a firm eight hours to roll back a version or disable a feature after a safety notice, one working day to apply a safety update, 48 hours to report an agent incident after confirming it, and 30 days for other updates. The eight hour clock does not pause for weekends in the text as reported. A small team with no on call rota for this server should read that duty before it celebrates the control it just gained.
Competition
Buyers have three real paths besides this beta, and each path trades control against upkeep in a different place. The table uses status and price facts as reported in November 2026 coverage checked against vendor posts.
| Route | Where the service runs | Where the model runs | Main contrast with this beta |
|---|---|---|---|
| Hosted Claude Managed Agents | Anthropic runs server, database and sandboxes | Anthropic or your chosen cloud route for Claude | No server upkeep and the full feature set, at token rates plus $0.08 per running session hour, but the record and credentials sit with the vendor |
| This beta, self hosted Claude | You run server, database and workers | A provider you pick, never on your own hardware | Full control of history and credentials, with a rebuild, missing features and patch duties as the price |
| Mistral Studio Managed Agents | Mistral cloud, your private cloud or your site, in public preview from November 5, 2026 | Mistral Large 4, an open weight model you can also run yourself | The open weight route. A firm that must run the model at home can do so there, which Claude does not offer in any form checked |
| Build your own harness | You build and run all of it | Any model you can call or run | No licence clock and no vendor feature gaps, but you own every bug, every guardrail and every hour of upkeep from day one |
Mistral is the rival to watch on this exact point, and we covered its move in Mistral Studio Managed Agents Go Public Preview. Its agents run in more places than Claude agents do, and its main model is open weight. Claude case rests on model quality and on the Managed Agents tools firms already use, not on deployment freedom. On deployment freedom alone, Mistral wins today.
The hosted Claude service is the closer rival for most teams. If your only block was where tool work runs, self hosted sandboxes already solved it in May with far less upkeep. This beta earns its extra work only when the block is the control plane itself, who holds the record, who holds the keys and who can read the logs. Be precise about which block you have before you choose the heaviest route.
Final Verdict
Ask for beta access if your firm wants Claude agents on internal code, your security review failed the hosted service on history or credentials, and you have a platform team that can run, patch and roll back a server at any hour. Run the pilot on one low risk job first, a build fix or alert triage flow with a tight allow list, and judge the session record your own tools receive. That record is what you are paying in staff time to own.
Wait if you need the model itself inside the building, if you rely on scheduled runs or webhooks, or if you need a server price before you commit. Wait also if your hosted agents would need a painful rebuild and the hosted service still passes your review. Private beta means Anthropic can change the gaps, the terms and the access rules while you build on it, and the company says as much by keeping the beta behind an account team with no wider date.
This beta gets the direction right. Agent vendors spent a year telling firms to bring sensitive work to the vendor cloud, and the firms with the most valuable work kept saying no. Anthropic now brings the platform to the firm instead, with the keys staying in the firm vault and the history staying in the firm database. The part that still leaves, the model call, is not a footnote. It is the line your security team should read first, and the line that will decide whether private beta feels private enough.
Sources
- Anthropic, Operate Claude Managed Agents inside your security perimeter, November 12, 2026: https://claude.com/resources/articles/self-hosted-claude-managed-agents
- Anthropic, Software License Agreement, Claude Managed Agents Server, effective November 12, 2026, as covered in launch reports below
- CellCog, Self Hosted Claude Managed Agents, Beta, Limits, License, November 12, 2026: https://cellcog.ai/blog/claude-managed-agents-self-hosted/
- Help Net Security, Self hosted Claude Managed Agents keeps agent credentials in your environment, November 12, 2026
- GeekByte, Anthropic opens a private beta for self hosting the whole Claude Managed Agents service, November 12, 2026
- Everpod, Claude Managed Agents, what it is, pricing and its limits, checked November 2026, for hosted token and runtime pricing
- Dirty Static, Anthropic Opens Self Hosted Claude Managed Agents Beta
- Dirty Static, Mistral Studio Managed Agents Go Public Preview
- Dirty Static, Claude Meetings In Google Meet Tested
- Images: Anthropic diagram from Anthropic, credited above. Hero and body illustrations are generated Dirty Static house style illustrations.
END OF TRANSMISSION
Stay curious. Question everything.
