Self-Hosted Claude Managed Agents: Beta, Limits, License

§ 01What was announced#

• The post. Anthropic’s developer account announced it on X at 17:57 UTC on November 12. The post had about 142,100 views when we read it at 19:04 UTC.
• The pitch. The post says: “You can host the agent harness, sandboxes, and session history, in your own cloud or on-premises, and choose where requests to Claude are sent.”
• The work it is for. A reply under it names agents that need “access to your code and internal systems, like fixing broken builds or triaging alerts”.
• Who gets it. The same reply says the beta “is only available to eligible orgs”. Anthropic’s article says to contact your Anthropic account team. None of the pages we read says what makes an organization eligible.
• No price. The article and the four docs pages state no price for the server software. The license calls its grant royalty-free. It also says “nothing in this Agreement changes the pricing, usage policies, or data terms under that agreement”, meaning the agreement that already covers a customer’s model access.

§ 02What you host#

Managed Agents now comes in three forms. The newest moves the whole service to you, by Anthropic’s overview page.

• The server. A program named cma-server serves the API, runs the agent loop and stores agents, sessions and each session’s history. The docs say it never runs an agent’s shell or file tools.
• The database. PostgreSQL 16 or later. Without one, the server keeps its data in memory and a restart erases it.
• The workers. Programs that take work from the server and run the agent’s shell and file tools in your sandboxes.
• A console. A web page at the server’s address, where people sign in through your identity provider.
• The upkeep. The overview says you run and secure all of it, and “you install each release yourself”.
• The shell. The docs warn that the agent’s bash tool “is a real shell with the worker process’s permissions and network access”, and that the worker does not isolate it. Isolation comes from the container or virtual machine you run the worker in.
• One deployment per trust level. The data page says: “Each deployment serves one tenant at one trust level.”

§ 03Where model calls go#

• Five destinations. By default the server calls the Claude API. The inference provider page lists four alternatives: Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry, and a model gateway that you run.
• What a call carries. The data and access page says: “Each model call carries the conversation so far, including prompts, tool inputs, and tool results.”
• Three ID headers. When the Claude API is the provider, each call also carries up to three headers holding the IDs of the session, its agent and its environment. The page says Anthropic can use them to attribute usage, and adds: “No setting turns them off.”
• A software label. Calls to the Claude API, to Microsoft Foundry and to gateways that take Claude API requests can carry the label cma-server, so that Anthropic can count use of the self-hosted server. The page says calls to Amazon Bedrock and to Google Cloud never carry it.
• No way in. The same page says: “Anthropic has no remote access to the server or its log.”
• Retention. Session history sits in your database until you delete it. The page says a zero data retention arrangement with Anthropic covers these model calls in the same way as other Messages API calls.
• Tools differ by provider. The web search tool works with the Claude API, Google Cloud and Microsoft Foundry. The web fetch tool works with the Claude API and Microsoft Foundry only. Both are off until you turn them on.

§ 04What the self-hosted server does not do#

Anthropic’s differences page sorts the gaps into groups. This is our count of the rows in its tables.

The seven that are not available:

• Cloud environments. Only self-hosted environments exist.
• The rest of the Claude API. The server does not serve the Messages API or the Models API.
• Files. File session resources and the Files API.
• OAuth credentials for MCP servers. The server rejects them, the page says, “because it has no OAuth flow to refresh a token”.
• Prebuilt document skills. The docx, pdf, pptx and xlsx skills. You can upload their sources as custom skills.
• Scheduled deployments and dreams. You start sessions from your own scheduler. The page adds: “Dreams have no replacement.”
• Webhooks. The server sends none.

Other lines on that page that a team moving over would want to know:

• Nothing moves with you. The page says: “Nothing is copied from the hosted service, session history included.”
• Subagents. An agent can delegate only to subagents that you list.
• Allow lists. The server connects only to the MCP hosts you list, and rejects Git repositories until you list their hosts.
• Force pushes. The page says: “The server doesn’t refuse force pushes, so an agent can overwrite any branch that you list.”
• What only your server has. A choice of inference provider, single sign-on, your own secret manager, and signed agent identity tokens for MCP calls.

§ 05The license#

Anthropic’s sitemap lists a Software License Agreement for the Claude Managed Agents Server, marked effective November 12, 2026. The article and the four docs pages we read do not mention it. We did not confirm that it is the agreement beta customers accept.

• What it covers. The license describes the software as “a server implementation of the Claude Managed Agents API and agent harness”, delivered as compiled code.
• Two uses. It allows an internal deployment, and it separately allows a licensee to run the server as a hosted service for its own customers. Anthropic can limit a licensee to one of the two by written notice.
• No changes. A licensee may not modify the code, reverse engineer it, or pass it to third parties other than its affiliates and contractors.
• Other models. A licensee may not use it with a model that is not Anthropic’s “except as the Documentation expressly permits”.
• Usage signals. The software may send signals to Anthropic, and a licensee “will not remove, block, alter, or falsify Usage Signals”.
• Model access. Anthropic “may determine, for safety reasons” that certain of its models are reached only through its hosted service, and the license says not every model may be offered through a self-hosted deployment.
• Support and liability. Anthropic “has no obligation to support any version of the Licensed Code”, and caps its total liability under the license at US$100,000.

The license counts the 8 hours from the notice and does not mention business hours. A team that runs this server would need a way to roll it back within 8 hours of a notice, whenever the notice arrives.

§ 06Other ways to run agents on your own servers#

We have covered two. When we wrote about them in October 2026, Cursor’s Agent SDK deployed agents on Cursor’s hosting or your own, and OpenClaw Enterprise was an MIT-licensed control plane that runs on your own infrastructure. We did not re-read either vendor’s pages for this post. Anthropic also runs Claude inside Google Cloud, which our explainer on that option covers.

§ 07What we did not check#

• The software. We have not seen or run the server. Nothing here is a test.
• The rest of the docs. We read four pages. We did not read the quickstart, the configuration reference, or the Kubernetes, console, upgrade and agent identity pages.
• The license’s role. We read the license once, in full. We did not confirm that beta customers accept this text, and nothing here is legal advice.
• Eligibility and price. We did not ask Anthropic who qualifies or what it will charge.
• The diagram. We did not study the architecture diagram attached to the X post.
• Other announcements. At 19:14 UTC on November 12, Anthropic’s sitemap listed no news post with self-hosted or managed agents in its address. We did not look further.
• Customers. We found no named beta customer in the pages we read, and did not look for one elsewhere.

§ 08Where CellCog sits#

Our conflict, declared: CellCog sells AI employees, and builds them on Anthropic’s Claude models (Claude Opus 5.5 on most tiers; Claude Fable 5.2 on Agent Max and Creative Max since November 11, 2026) with our own agent harness. Anthropic is our supplier, and Managed Agents is a different way to put agents to work than ours.

CellCog itself is a hosted service. An AI employee works on its own secure virtual machine and file system in our cloud, with its own email inbox and, on a paid account, its own browser identity and logins. It does not run inside your network.

§ 09What we are watching#

• General availability. When the beta opens beyond eligible organizations.
• Price. Whether Anthropic charges for the server, apart from model use.
• Eligibility. What Anthropic asks of an organization before it grants access.
• The license in practice. Whether beta customers accept this text, and how the 8-hour clock is applied.
• The missing features. Which of the seven reach the self-hosted server.

§ 10Sources#

• Anthropic’s announcement on X and the reply under it, November 12, 2026
• Anthropic: Operate Claude Managed Agents inside your security perimeter, November 12, 2026
• Anthropic docs: Self-hosted Claude Managed Agents, read November 12, 2026
• Anthropic docs: Differences from the hosted service, read November 12, 2026
• Anthropic docs: Inference provider and Data and access, read November 12, 2026
• Anthropic: Software License Agreement: Claude Managed Agents Server, effective November 12, 2026