Anthropic now runs the harness so you don't have to. Claude Managed Agents ships the sandbox, session state, tool execution, and event stream as a hosted service. You describe the agent. Anthropic runs it — secure containers, long-lived sessions, built-in code execution, streaming events.
They solve different problems. Pick based on how much control you actually need.
Learn these four and the rest follows.
Managed Agents is in open beta. All endpoints require the `managed-agents-2026-04-01` header (the SDK adds it automatically). Outcomes, Multiagent, and Memory are separate research previews — request them individually.
# CLI brew install anthropics/tap/ant # SDK pip install anthropic # Python npm install @anthropic-ai/sdk # TypeScript export ANTHROPIC_API_KEY="your-api-key-here"
from anthropic import Anthropic
client = Anthropic()
agent = client.beta.agents.create(
name="Coding Assistant",
model="claude-sonnet-4-6",
system="You are a helpful coding assistant.",
tools=[{"type": "agent_toolset_20260401"}],
)
`agent_toolset_20260401` bundles bash, read, write, edit, glob, grep, web_fetch, and web_search. One line, full toolbox.
env = client.beta.environments.create(
name="dev-env",
config={"type": "cloud", "networking": {"type": "unrestricted"}},
)
session = client.beta.sessions.create(
agent=agent.id,
environment_id=env.id,
title="My first session",
)
with client.beta.sessions.events.stream(session.id) as stream:
client.beta.sessions.events.send(
session.id,
events=[{
"type": "user.message",
"content": [{"type": "text",
"text": "Generate the first 20 Fibonacci "
"numbers and save to fibonacci.txt"}],
}],
)
for event in stream:
if event.type == "session.status_idle":
break
Under the hood: a container spins up, Claude picks tools, calls execute in the sandbox, results stream back. No Docker config, no tool dispatcher, no recovery logic on your side.
The toolset gives you eight capabilities by default. You'll usually want to narrow it down for production agents.
{
"type": "agent_toolset_20260401",
"default_config": {"enabled": false},
"configs": [
{"name": "bash", "enabled": true},
{"name": "read", "enabled": true},
{"name": "write", "enabled": true}
]
}
Custom tools slot in alongside the built-ins. Four rules that matter most:
A common production shape: reads and web_search auto, bash gated. This is one of the things that makes Managed Agents more production-ready than LangGraph, CrewAI, or AutoGen — none of them ship permissions out of the box.
Keep agent templates as YAML in git. Apply them with the CLI from your deploy pipeline. Run sessions with the SDK at runtime. Config lives in version control; runtime stays lightweight.
Outcomes (research preview) promote a session from chat to job. You supply a rubric. The system spins up a separate grader in its own context — unbiased by the main agent's decisions — and scores each iteration. The agent keeps working until it passes or hits max_iterations.
Rubric rule: concrete and checkable wins. Good: 'CSV contains a price column with numeric values.' Bad: 'Data looks good.'
client.beta.sessions.events.send(
session_id=session.id,
events=[{
"type": "user.define_outcome",
"description": "Build a DCF model for Costco in .xlsx",
"rubric": {"type": "text", "content": RUBRIC},
"max_iterations": 5,
}],
)
A coordinator agent can call other agents listed in its callable_agents. Each runs in its own thread with isolated context, but they share one container and filesystem. Useful for code review with read-only tools, test generation in a sandboxed agent, or research agents with web access.
One limit: delegation is one level deep. The coordinator calls sub-agents; sub-agents can't chain further. Design accordingly.
Anthropic split the system into three replaceable pieces: the brain (Claude plus harness), the hands (sandboxes and tools), and the session (an event log). A failure in one doesn't kill the system, execution is isolated from context, and you can plug in new harnesses as they evolve. Prompt caching, compaction, and automatic recovery are all built in.
Standard API token rates plus $0.08 per active session hour. A ten-minute coding session costs a few cents in compute on top of tokens. API rate limits: 60 writes/min for resource creation, 600 reads/min for gets, lists, and streaming.
Managed Agents is the shortest path from 'we want an agent' to 'it's running in production.' If your infrastructure is the blocker, switch. If you need a custom harness and total control, stay on Messages. Either way, the cost of hand-building a sandbox and event log just went to zero as a default choice.