Anthropic Shipped Self-Hosted Claude Agent Sandboxes. Here's When That Actually Matters for a Solo Builder.

On May 19, at its Code with Claude London event, Anthropic shipped two new features for Claude Managed Agents: self-hosted sandboxes, now in public beta, and MCP tunnels, in research preview. The announcement is framed around infrastructure control and data privacy: you run agent tool execution inside your own environment instead of on Anthropic's infrastructure.

Before you start migrating your agent setup, it's worth being precise about what's actually being offered here and who it's actually for.

What the split actually is

Self-hosted sandboxes do not mean you're running the agent. The split is specific: tool execution (the part where the agent runs code, reads files, calls APIs) moves into your infrastructure or into a managed sandbox provider you choose. The agent loop itself (orchestration, context management, deciding what to do next, error recovery) stays on Anthropic's infrastructure.

In practice, this means your data never leaves your environment during tool execution. If your agent is reading from a proprietary database, processing HIPAA-covered records, or working with source code that can't leave your environment, the tool calls happen in a sandbox you control. The model still handles the reasoning, but the sensitive operations stay local.

The supported managed sandbox providers at launch are Cloudflare, Daytona, Modal, and Vercel. If you're already using Modal for compute or Vercel for deployment, the integration path is straightforward. If you're running on bare metal or a less common provider, you're in "bring your own sandbox" territory, which is public beta with all the friction that implies.

MCP tunnels: the part that's actually useful for indie builders

MCP tunnels are the more interesting feature for solo operators who aren't dealing with compliance requirements.

The setup: you have an MCP server running on a private network: an internal database, a private API, a ticketing system you don't want to expose to the public internet. Previously, connecting a Claude agent to that server meant either opening a public endpoint (security risk), setting up a VPN (operational complexity), or keeping everything in Anthropic's managed infrastructure (fine until your data is sensitive).

MCP tunnels create an end-to-end encrypted outbound-only connection from your private network to Anthropic's agent infrastructure. No inbound firewall rules. No public endpoint. One outbound connection, and your private MCP server is accessible to your agents.

If you're building agents that need to reach internal tools (a private GitHub Actions runner, an internal Notion workspace, a database that can't be publicly accessible), MCP tunnels solve a real problem without the operational overhead of running a VPN or opening firewall rules.

The honest take on who this is actually for

Self-hosted sandboxes exist because Anthropic is selling to enterprises that have data residency requirements, compliance audits, and procurement teams that will not sign a contract where sensitive data flows through a third-party's managed infrastructure. Banks, hospitals, defense contractors, government agencies: these are the customers who asked for this feature.

If your business doesn't have a compliance requirement that explicitly governs where compute happens, self-hosted sandboxes add operational complexity for no user-facing benefit. Anthropic's managed sandbox infrastructure is fast, reliable, and already handles the isolation you need for most agent workloads. Running your own sandbox means you now own the failure modes of that sandbox.

I want to be direct about this: a lot of solo operators will read this announcement, feel like they're missing out if they don't implement self-hosted sandboxes, and spend a week setting up Modal integration for a workload that didn't need it. That's a bad use of a week.

When it does matter for a solo builder

There are legitimate cases where self-hosted sandboxes are worth the complexity, even at solo scale.

If you're building B2B products for regulated industries (a legal tech tool that processes client documents, a health tech product that touches PHI, a fintech tool that handles transaction data), your customers will ask about data residency. Having a clear answer ("agent execution happens in your environment, your data never leaves") is a sales advantage. Worth the setup cost.

If you're building agents that access genuinely proprietary internal systems (your own codebase, a private database with trade secrets, client systems you've been given access to), the self-hosted model gives you a defensible position if something goes wrong. The audit trail is yours.

If your agent workloads are large enough that the compute cost of running your own Modal sandbox is meaningfully cheaper than Anthropic's managed infrastructure pricing, the economics might work. This is probably a $5,000+/month inference spend threshold before it matters.

What I'd do

Start with Anthropic's managed infrastructure. Build your product. If you hit a compliance requirement from a customer, MCP tunnels are the first thing to evaluate: they solve the private network problem without requiring you to manage a sandbox. Self-hosted sandboxes are the next step if you have explicit data residency requirements.

Don't pre-optimize for infrastructure control you don't need. The most common mistake I see solo operators make with AI infrastructure is building for a compliance story they don't have customers requiring yet, at the cost of shipping speed. Get the product in front of people first.

Author

Lukas

@lukcombinator

Sources

• New in Claude Managed Agents: self-hosted sandboxes and MCP tunnels (Anthropic)
• Anthropic adds self-hosted sandboxes and MCP tunnels to Claude Managed Agents (The Decoder)
• Anthropic debuts MCP tunnels and self-hosted sandboxes (The New Stack)
• Anthropic Introduces MCP Tunnels for Private Agent Access to Internal Systems (InfoQ)