Anthropic releases MCP Tunnels and self-hosted sandboxes for private network deployments

Anthropic added two enterprise-oriented features on May 19, 2026: MCP Tunnels as a Research Preview, enabling connections to Model Context Protocol servers running inside private networks, and self-hosted sandboxes for Claude Managed Agents as a generally available alternative to Anthropic's managed execution infrastructure.

What's new

MCP Tunnels (Research Preview):

• Connect Claude to MCP servers running in private networks behind firewalls or VPNs
• Available now; API surface may change as Research Preview status implies
• Addresses the gap where MCP only worked with publicly-accessible servers

Self-hosted sandboxes for Claude Managed Agents (GA):

• Run tool execution in your own infrastructure rather than Anthropic's
• Gives operators control over the network, compute, and data environment for code execution
• Alternative to the default Anthropic-hosted execution environment

Additional Managed Agents updates (same release):

• Update an agent's MCP server and tool configurations during active sessions without restarting
• Large tool outputs exceeding 100K tokens automatically spill to a file; the model receives a truncated preview and file path, and can read the full content on demand

Context

The Model Context Protocol, standardized by Anthropic in late 2024, enables Claude to communicate with external tools and data sources through a structured protocol. Before MCP Tunnels, teams with internal data sources behind security boundaries could not use MCP with those systems without exposing them to the public internet — a non-starter for most enterprise security postures.

Self-hosted sandboxes address a parallel concern: Claude Managed Agents can execute code as part of agentic workflows, and until this release, that code ran in Anthropic's infrastructure. For organizations with data residency requirements, regulated environments, or policies prohibiting third-party execution of code in their context, this was a deployment blocker.

Why it matters

Together, MCP Tunnels and self-hosted sandboxes address the two most common security objections to running Claude in enterprise agentic pipelines: data egress through MCP connections, and untrusted code execution environments. Both are now solvable without leaving the Anthropic API surface.

MCP Tunnels specifically unlock use cases that were previously out of reach: an agent that can query an internal database, call a private REST API, or interact with tools that are not Internet-exposed. For enterprise teams with compliance constraints on where data can travel, this is a prerequisite for putting Claude into production agentic workflows rather than sandboxed pilots. The Research Preview designation means the API surface could change — teams should track Anthropic's API changelog before building production dependencies on tunnel-specific interfaces.