Anthropic ships self-hosted sandboxes + MCP tunnels at Code with Claude London — agent execution inside the customer perimeter

What was shipped

The reporting from The New Stack, the-decoder, InfoQ, Phemex, and the Anthropic Code with Claude London event itself confirms two features launched May 19, 2026:

Self-hosted sandboxes (public beta)

• What it is: tool execution for Claude Managed Agents runs on customer-controlled infrastructure, not Anthropic’s
• Where it can run: customer’s own infrastructure, or one of the named managed-sandbox providers — Cloudflare, Daytona, Modal, Vercel
• Split of responsibilities:
  • Anthropic owns: orchestration, context handling, recovery logic, agent loop management
  • Customer owns: tool execution environment, file system, shell, network access, sensitive data
• Public beta: available now to all Claude API customers

MCP tunnels (research preview)

• What it is: secure path from Anthropic infrastructure to a customer’s private MCP server
• How it works: customer deploys a lightweight gateway that establishes an outbound encrypted connection to Anthropic infrastructure
• Why it matters: no inbound firewall rules required — eliminates the security-review blocker that breaks most enterprise agent deployments
• What it enables: Claude can reach internal documentation systems, internal databases, internal APIs without those systems being exposed to the public internet
• Research preview: available to select customers; broader rollout TBD

Why this is the enterprise-credibility move that mattered

The single biggest procurement blocker for AI-agent deployments in regulated industries through 2025-2026 wasn’t model capability. It was the architectural question: “where does execution happen, and which network reads the data?”

For banks, insurers, healthcare systems, defense contractors, and government agencies, the standard answer for any third-party SaaS has been “execution and data stay inside our perimeter.” But until May 19, every major AI-agent system required either:

• Sending data out: customer files uploaded to the AI vendor’s cloud for execution, OR
• Self-hosting everything: customer takes on full operational responsibility for the agent loop, model serving, orchestration

Anthropic’s split is the third option: orchestration stays managed, execution stays self-hosted. This is the architecture enterprise security teams actually want — Anthropic operates the hard parts (agent reasoning, recovery, retries) while the customer operates the parts that touch sensitive data (file reads, shell, API calls).

For KPMG and the Pentagon-exclusion context, this is the architecture that lets Anthropic compete for the next tier of enterprise deals — the ones where execution-perimeter requirements were previously disqualifying.

The MCP tunnel architectural pattern

The MCP tunnel design is structurally interesting. Most “private API access” patterns require one of:

1. VPN: complex, expensive, requires identity management
2. Reverse proxy: requires inbound firewall rules, security team review
3. Public exposure with auth: high attack surface

Anthropic’s tunnel approach uses a fourth pattern: outbound-only persistent connection. The customer’s lightweight gateway dials out to Anthropic infrastructure, establishes an encrypted persistent channel, and Anthropic routes MCP traffic through that channel back to the customer’s private server. No inbound rules. No reverse proxy. No VPN.

This is the same pattern used by Cloudflare Tunnel, Tailscale Funnel, and several enterprise zero-trust products. Applying it to MCP server connectivity is the right architectural call.

For Claude Code and Managed Agent users specifically, this means MCP servers that previously required public exposure (and the corresponding security review) can now stay private. Cuts procurement cycle time materially.

How this connects to the Stainless acquisition

The Stainless acquisition (May 18) gave Anthropic ownership of the SDK + MCP server factory that produces the connectors AI agents need. Today’s MCP tunnels release closes the loop: Anthropic now owns both the production pipeline for MCP servers AND the secure delivery mechanism for accessing them privately.

For developers building MCP servers, the implication is concrete: write the server once, deploy it inside your network, expose it via MCP tunnel — Anthropic-orchestrated Claude agents can reach it without your security team blocking the deal.

What it means for Claude and Claude Code users

Individual developers: no immediate change. Self-hosted sandboxes and MCP tunnels are enterprise-tier features; Claude Pro and Max subscribers can ignore them.

Enterprise teams: the architecture for “Claude agents on regulated workloads” is now usable. Before May 19, the answer was either “no” or “yes, but you build your own runtime.” Now the answer is “yes, here’s the supported pattern.”

MCP server developers: writing MCP servers for private deployment just got substantially easier. The deployment story can now be “build server, run inside perimeter, expose via MCP tunnel” rather than “build server, figure out auth + public exposure + DDoS protection + SLA.”

Claude Code users on enterprise networks: tunnels make internal-tool MCP integration (Jira, Confluence, internal APIs) operationally simpler. Expect more enterprise Claude Code rollouts to surface in Q3 2026 procurement cycles.

The honest caveats

Two caveats worth surfacing:

MCP tunnels are research preview, not general availability. Production-scale deployment isn’t yet supported across all Claude API customers. Self-hosted sandboxes are public beta — production-grade but newer than the deeply-stable Anthropic-managed sandbox option.

The split architecture doesn’t eliminate all data exposure. Orchestration context (prompts, model responses, tool invocation metadata) still passes through Anthropic infrastructure. Customers in the most-stringent compliance regimes will still want to review what Anthropic logs and retains during orchestration. The new features substantially reduce data exposure; they don’t eliminate it.

What it changes for Pick Right readers tomorrow

If you’re a Claude Pro or Max subscriber, nothing changes. If you’re a Claude Code user on a corporate network, the MCP tunnel research preview is worth tracking — expect general availability through Q3 2026 to make internal-system integration substantially easier.

For broader context, see the Claude review, the Claude Code review, the AI Harnesses category, the Stainless acquisition coverage, the KPMG alliance article, the Project Glasswing 10K-vulns milestone, and the Series H + Opus 4.8 article for the broader Anthropic-positioning thread.

Questions or corrections? Email Pick Right. Want the full list? See all news.