Anthropic: MCP Tunnels and self-hosted sandboxes for Claude Managed Agents
Anthropic presented MCP Tunnels in Research Preview on 19 May 2026 — a feature enabling Claude agents to connect to Model Context Protocol servers on a user's private network — and self-hosted sandboxes as an alternative to Anthropic's own infrastructure for tool execution. Updates also include dynamic MCP configuration changes within active sessions and automatic overflow of outputs larger than 100K tokens into a sandbox file.
This article was generated using artificial intelligence from primary sources.
Anthropic announced two significant updates to Claude Managed Agents infrastructure on 19 May 2026 through its Platform release notes channel: MCP Tunnels as a new Research Preview feature, and self-hosted sandboxes as an alternative to Anthropic’s own infrastructure for code execution.
What problem do MCP Tunnels solve?
Model Context Protocol (MCP) is Anthropic’s open standard for connecting AI models to external tools and data sources — from file search to knowledge bases. The primary obstacle to enterprise adoption was the fact that MCP servers typically live on a company’s private network, whereas Claude agents as SaaS require a publicly exposed endpoint.
MCP Tunnels resolves this without a VPN or port forwarding: a tunnelling component authenticates the Claude agent against the local MCP server through Anthropic’s authentication platform, while traffic remains encrypted. The feature is in Research Preview status, meaning it is available to selected users without production SLA guarantees.
What are self-hosted sandboxes?
The second parallel release is the self-hosted sandbox option for Claude Managed Agents. Previously, agents executed code (Python, Bash, file operations) within Anthropic’s sandbox infrastructure. Organisations can now run their own sandbox runtime within their cloud environment or on-premises datacentre.
The use case is clear for sectors with regulatory constraints: financial institutions under the DORA regulation, healthcare organisations under HIPAA, public bodies under the EU AI Act. A self-hosted sandbox ensures that sensitive data does not leave the organisation’s perimeter, and combined with MCP Tunnels it enables an end-to-end air-gapped agent workflow.
What else has changed?
Anthropic has also added dynamic MCP configuration changes within an active agent session — previously any change required a restart. Large tool outputs (over 100,000 tokens) are automatically spilled to a file in the sandbox, preventing the context window from filling up. The web search tool has received richer SEC filing data aimed at financial agents analysing 10-K and 10-Q reports.
This combination positions Anthropic as the primary enterprise-ready AI provider for regulated industries where data residency, air-gapping, and audit trails are critical requirements.
Frequently Asked Questions
- What are MCP Tunnels?
- MCP Tunnels is a new Anthropic Research Preview feature that lets Claude agents securely connect to MCP servers running on a user's private network without exposing those servers to the public internet. The tunnelling layer uses Anthropic's authentication to authorise the agent against the local server.
- When does a self-hosted sandbox make more sense than Anthropic's infrastructure?
- Self-hosted sandboxes are useful when an organisation has regulatory or compliance requirements to execute code within its own infrastructure (e.g. finance, healthcare, public sector), when latency to local data is critical, or when existing tooling investments require integration.
- What changes with large tool outputs?
- Tool outputs larger than 100,000 tokens are automatically spilled into a file within the sandbox instead of filling the model's context. This keeps the agent within the context window, and the agent can later reference the file through the file tool or pass it to subsequent steps.