Claude Managed Agents Explained

Claude Managed Agents let you deploy persistent AI agents that Anthropic hosts, runs, and sandboxes for you. No server management. No container orchestration. Just a REST API call to create an agent and fire sessions.

This guide explains what Managed Agents are, how they differ from Claude Code and the Tool Runner, and when each option makes sense. If you are evaluating whether to build agent infrastructure yourself or let Anthropic handle it, this is the decision guide.

We cover the core concepts: agent configs, sessions, per-session containers, vaults for secrets, memory stores, scheduled deployments, and SSE streaming. Each section explains the concept and when it matters for your business.

What Are Claude Managed Agents?

Claude Managed Agents are server-hosted AI agents that Anthropic runs on your behalf. You define the agent's behavior, tools, and instructions via a REST API. Anthropic handles the execution loop, sandboxing, and infrastructure.

The key idea is full managed hosting. With Claude Code, you run the agent locally on your machine. With the Claude API and Tool Runner, you run the orchestration loop in your own infrastructure. With Managed Agents, Anthropic runs both the reasoning loop and the execution environment.

Each Managed Agent is a versioned configuration. When you update the instructions or tools, a new version is created. Running sessions are pinned to their version, so updates never break in-flight work.

• Managed Agents are a beta REST API at api.anthropic.com.
• Create an agent with POST /v1/agents, specifying name, model, instructions, and tools.
• Each agent is versioned. Updates create new versions without disrupting active sessions.
• Supports all Claude models including Opus 5, Sonnet 5, and Fable 5.
• The agent runs in Anthropic infrastructure. You do not manage servers, containers, or orchestration.

Sessions and Per-Session Containers

A session is a single conversation or task run against a Managed Agent. Each session gets its own isolated Linux container with bash, Python, Node.js, a file system, and optional internet access.

This isolation is the main advantage over self-hosted agents. When a session runs code, installs packages, or writes files, those changes are contained. A buggy session cannot corrupt another session's state or your production environment.

Create a session with POST /v1/agents/{id}/sessions. The session runs until the agent completes the task, hits a timeout, or you stop it. You can have many sessions running in parallel against the same agent.

• Each session gets a fresh, isolated Linux container.
• Containers include bash, Python, Node.js, and a writable file system.
• Internet access is configurable per agent. You can disable it for sensitive workloads.
• Sessions are stateful: the agent remembers context across turns within a session.
• Parallel sessions are supported. Run hundreds of tasks simultaneously against one agent config.

Vaults: Secure Credential Storage

Vaults solve the credential problem for agent systems. Your agent needs API keys, database passwords, and service tokens, but you never want those visible in prompts, logs, or the sandbox environment.

Store credentials with POST /v1/agents/{id}/vaults/{name}/credentials. Each credential has a type: environment_variable injects it as an env var in the container, and custom_tool_header injects it into HTTP headers for tool calls.

The critical security property is that secrets are never visible inside the sandbox. They are substituted at the network egress boundary. Even if the agent tries to print or log a secret, the raw value is not exposed.

• Two credential types: environment_variable and custom_tool_header.
• Secrets are injected at egress, never visible inside the container or in logs.
• Store database passwords, API keys, OAuth tokens, and webhook secrets.
• Each vault is scoped to an agent. Different agents can have different credentials.
• Credentials can be rotated without redeploying the agent. Update the vault and new sessions use the new value.

Memory Stores: Persistent State Across Sessions

Memory stores give Managed Agents persistent key-value storage that survives across sessions. A session can read what previous sessions learned, store results for future sessions, and build up knowledge over time.

Create a memory store with POST /v1/agents/{id}/memory_stores. Sessions read and write to it through built-in tools. The store persists until you delete it.

This is what makes Managed Agents useful for ongoing work rather than one-shot tasks. A customer support agent can remember past interactions. A data pipeline agent can track which files it has already processed. A monitoring agent can compare today's results to yesterday's.

• Key-value storage that persists across sessions.
• Sessions read and write through built-in memory tools.
• Use cases: conversation history, processing checkpoints, accumulated knowledge.
• Multiple memory stores per agent for different data domains.
• Memory stores are separate from session state. Deleting a session does not delete memory.

Scheduled Deployments and Cron Triggers

Scheduled deployments turn Managed Agents into automated workers that fire on a cron schedule. Define a deployment with a cron expression, an environment, and optional config overrides. Anthropic fires sessions automatically at each interval.

Create a deployment with POST /v1/agents/{id}/deployments. Specify the schedule in standard cron format. Each trigger creates a new session with the agent's current config, runs it to completion, and stores the result.

This is the feature that makes Managed Agents competitive with custom cron jobs, Airflow DAGs, and Lambda functions for AI-powered workflows. You get the scheduling infrastructure without building or maintaining it.

• Standard cron expressions for scheduling (e.g., every hour, every day at 9am).
• Each trigger creates a fresh session with its own container.
• Config overrides let the same agent behave differently on different schedules.
• Environments (dev/staging/prod) keep scheduled runs isolated from testing.
• Failed sessions are logged and can trigger alerts through SSE events.

Real-Time Progress with SSE Streaming

SSE event streaming gives you real-time visibility into what a Managed Agent session is doing. Connect to GET /v1/agents/{id}/sessions/{sid}/events and receive a stream of events as the agent thinks, runs tools, and produces output.

This is critical for production use cases where you need to show progress to end users. A customer support bot can stream responses in real time. A data pipeline can report progress through each stage. A code generation agent can show files as they are created.

The event stream includes reasoning steps, tool calls, tool results, and final outputs. You choose what to surface to your end users and what to log for debugging.

• Server-Sent Events (SSE) protocol for real-time streaming.
• Events include reasoning, tool calls, tool results, and final output.
• Build real-time UIs that show agent progress as it happens.
• Use for debugging by logging the full event stream for failed sessions.
• Compatible with standard SSE client libraries in every major language.

Managed Agents vs Claude Code vs Tool Runner

The choice between Managed Agents, Claude Code, and the Tool Runner depends on who manages the infrastructure and who controls the execution environment.

Claude Code runs on your local machine. You control everything: the files, the tools, the network access, the permissions. This is best for development work, one-off tasks, and human-in-the-loop workflows where a developer reviews output in real time.

The Tool Runner is an SDK helper that runs the agentic loop in your own infrastructure. You provide the tools, manage the servers, and control the sandbox. This is best when you need custom tool logic and full infrastructure control.

Managed Agents let Anthropic run both the loop and the sandbox. You define the agent via API and consume results. This is best for production autonomous agents, scheduled tasks, and use cases where you do not want to manage containers.

• Claude Code: you run it locally. Best for development and interactive work.
• Tool Runner: you run the loop on your servers. Best for custom tool integrations.
• Managed Agents: Anthropic runs everything. Best for production autonomous agents.
• Managed Agents handle scaling, container lifecycle, and sandbox isolation for you.
• All three use the same Claude models. The difference is where the code runs.

When to Use Claude Managed Agents

Managed Agents are the right choice when you need agents that run without human supervision, on a schedule or in response to events, with secure credential access and persistent state.

Customer support bots are a natural fit: the agent needs credentials for your CRM and helpdesk, memory of past interactions, and the ability to run tools like ticket creation and knowledge base search. Managed Agents provide all of this without custom infrastructure.

Data pipeline agents that run nightly, pull data from APIs, transform it, and push results to a database are another strong use case. Scheduled deployments handle the trigger, vaults store the credentials, and memory stores track processing state.

• Customer support: bots with CRM access, conversation memory, and ticket management.
• Data pipelines: scheduled ETL agents that pull, transform, and load data automatically.
• Report generation: agents that create and distribute reports on a daily or weekly schedule.
• CI/CD agents: code review, test generation, and deployment validation in your build pipeline.
• Monitoring agents: check system health, compare to historical baselines, and alert on anomalies.
• Content generation: scheduled content creation with brand guidelines and publishing tool access.

Claude Managed Agents Pricing

Managed Agents pricing has two components. You pay the standard Claude API token cost for every input and output token the agent uses. On top of that, you pay for the managed infrastructure that runs the agent's container, tools, and storage.

Token costs follow the same rates as the regular Claude API. If the agent uses Opus 5, you pay $5 per million input tokens and $25 per million output tokens. Sonnet 5 costs $3/$15. Haiku 4.5 costs $0.25/$1.25. The model choice in your agent config determines the per-token rate.

Infrastructure costs cover the container runtime, vault storage, memory stores, and scheduling. Anthropic has not published a fixed infrastructure price list during the beta. Current users report that infrastructure overhead is small relative to token spend for most workloads.

For a typical workload, estimate your monthly token budget first. A customer support agent handling 1,000 conversations per month on Sonnet 5 might use 50 million input and 10 million output tokens. That costs about $300 in tokens alone. Infrastructure adds a fraction on top. A data pipeline agent running nightly on Opus 5 with 2 million output tokens per run costs roughly $1,500 per month in tokens.

• Token pricing: same as standard Claude API rates for the model you choose
• Opus 5: $5 input / $25 output per million tokens
• Sonnet 5: $3 input / $15 output per million tokens
• Haiku 4.5: $0.25 input / $1.25 output per million tokens
• Infrastructure: container runtime, vaults, memory stores, scheduling (beta pricing)
• Prompt caching and Batch API available to reduce token costs