Claude Agents Move Into Company Infrastructure — Two London Reveals

#anthropic #claude #managedagents #mcp

Claude Agents Move Into Company Infrastructure — Two London Reveals

Anthropic held its London keynote yesterday, and two features landed on Managed Agents. You can now run Claude agents without ever sending your code and files outside the corporate network. This release lifts part of the adoption wall that had blocked fintech and enterprise teams.

Self-hosted Sandbox — Public Beta
MCP Tunnels — Research Preview
Enterprise, announced 5/19

01 · What Changed: Tool execution moved from Anthropic to your own infrastructure

Until now, Managed Agents ran everything — tool execution and file handling — on Anthropic's infrastructure. Your company code had to be pushed to an external network at least once. This release splits off that execution layer.

	Before	After (5/19 London)
Where it runs	Anthropic net (orchestration + tool execution + files)	Your infra (tool execution + files stay inside the customer network)
Code exposure	Required	None
Internal DB / MCP access	Impossible	Internal MCP server connection possible
Fintech adoption	Blocked	Orchestration stays on Anthropic

02 · Self-hosted Sandbox: Tools run inside your network — Public Beta

This option places the sandbox where the agent's code execution and file work happen inside the customer's own infrastructure. Sensitive files, packages, and services never leave the network. If running it yourself is a burden, you can use one of four Anthropic-certified managed providers.

Managed sandbox providers (Public Beta):

Cloudflare — sandbox hosted on Workers plus its own container runtime. Global edge network, low latency.
Daytona — isolated workspaces purpose-built for dev environments. Strong at per-repo isolation.
Modal — Python serverless with automatic GPU/CPU scaling. Fits data and ML workloads.
Vercel — frontend/full-stack build context. Smooth for teams already on Vercel.

Between self-hosting and the four managed options, even teams with strict internal security reviews now have a path. Since it's Public Beta, larger policy changes are still possible.

03 · MCP Tunnels: Connect internal MCP servers with zero external exposure

The second feature is MCP Tunnels. It lets Claude agents call MCP servers sitting inside your internal network without any inbound firewall rules. A gateway opens just a single outbound connection, and an end-to-end encrypted tunnel runs over it.

The old problem (pre-5/19):

"To attach an internal DB or issue-tracker MCP to Claude, you needed a public endpoint."

Root cause: calling an MCP server from outside required opening an inbound port plus an auth gate. The security team blocking it was the correct behavior. A workaround was, in the end, still a workaround.

How MCP Tunnels change the math:

1 outbound connection — single one-way
0 inbound firewall rules — no new openings
E2E encryption — end-to-end encrypted
Research Preview — apply via form

Access is by form application — not instantly available, which is the difference from the Public Beta Sandbox. For teams whose biggest hurdle was convincing the security team, it's one more architecture card to play.

04 · Position: Not everything is unblocked — orchestration is still external

The agent loop, context management, and error handling still run on Anthropic's network. A fully air-gapped on-prem deployment is not part of this release.

Inside customer network	Inside Anthropic network
Tool execution · files · MCP server calls	Agent loop · prompts · model inference

Some financial institutions have policies that forbid "the prompt itself being sent to an external model." This release doesn't move that policy line. The structure is still "the code doesn't leave, but the instructions do" — so some teams have to wait one more release.