{
 "features_resolved": {
  "snapshot_any": true,
  "snapshot_mem": false,
  "fork": false,
  "pause_resume": true,
  "persistent_disk": true,
  "whole_disk": true,
  "persist_scope": null,
  "volumes": true,
  "auto_stop_idle": true,
  "long_sessions": true,
  "custom_image": true,
  "image_snapshot": true,
  "image_oci": true,
  "vm_isolation": false,
  "docker_inside": null,
  "nested_virt": false,
  "root": null,
  "systemd": null,
  "browser": true,
  "desktop": false,
  "computer_use": false,
  "code_interpreter": false,
  "browser_control": null,
  "desktop_control": null,
  "browser_and_desktop": false,
  "anti_bot": false,
  "captcha_solving": false,
  "residential_ip": false,
  "agent_harnesses": true,
  "ssh": false,
  "public_ipv4": false,
  "inbound_https": false,
  "custom_domain": false,
  "raw_tcp_inbound": false,
  "egress_allowlist": true,
  "open_internet": true,
  "static_egress_ip": false,
  "private_network": null,
  "self_host": true,
  "byoc": true,
  "open_source": false,
  "soc2": true,
  "hipaa": false,
  "sso": true,
  "gpu": false,
  "arm64": false,
  "windows": false,
  "macos": false,
  "lang_python": true,
  "lang_node": true,
  "lang_go": true,
  "lang_rust": true,
  "lang_java": true,
  "gpu_desktop": false,
  "credential_injection": true,
  "egress_http_rules": false,
  "wake_on_request": true,
  "live_resize": false,
  "fork_running": false,
  "memory_snapshot_fork": false,
  "webhooks": true,
  "scheduled_wakeups": true,
  "audit_logs": null,
  "eu_data_residency": false,
  "zero_data_retention": false,
  "scoped_api_keys": null,
  "spend_limits": true,
  "mcp_server": true,
  "usage_api": true,
  "snapshot_auto": true,
  "snapshot_on_demand": false,
  "harness_api": true,
  "own_agent_api": false,
  "fast_boot": null,
  "strong_isolation": false,
  "ingress_rules": false,
  "guest_firewall": false,
  "secret_proxy": true,
  "secret_proxy_any": true,
  "volume_attach": true,
  "volume_shared": true,
  "sidecar": null,
  "fuse": null,
  "kernel_features": null,
  "burst": null
 },
 "company": {
  "id": "claude-managed-agents",
  "checked": "2026-09-30",
  "company": "Anthropic, PBC",
  "ownership": {
   "value": "independent",
   "parent": null,
   "source": "https://en.wikipedia.org/wiki/Anthropic",
   "quote": "Anthropic, PBC ... is an American artificial intelligence (AI) public benefit corporation headquartered in San Francisco, California. ... The company is privately held but reportedly plans an initial public offering in 2026."
  },
  "stage": {
   "value": "series-d+",
   "source": "https://en.wikipedia.org/wiki/Anthropic",
   "quote": "In May 2026, Anthropic announced it had raised $65 billion of investment from multiple investors, including Altimeter Capital, Dragoneer Investment Group, and Sequoia Capital. The investment round valued the company at $965 billion.",
   "confidence": "high",
   "note": "Anthropic is well past a lettered 'series' framework (Series B->E->F->G, plus large strategic rounds from Amazon/Google and a May 2026 $65B round at $965B valuation, reported by Reuters as a 'Series H'). Mapped to series-d+ as the closest bucket for a company this far along; a public IPO is reportedly planned for 2026 but had not occurred as of the checked date."
  },
  "accelerators": [],
  "total_funding_usd": {
   "value": 121700000000,
   "status": "estimated",
   "basis": "Sum of publicly reported rounds/investments per Wikipedia (sourced to TechCrunch/CNBC/Reuters/Anthropic press releases): $124M seed (2021) + $580M incl. FTX (Apr 2022) + $1.25B Amazon (Sep 2023) + $500M Google (Oct 2023) + $2.75B Amazon (Mar 2024) + $4B Amazon (Nov 2024) + $1B Google (Mar 2025) + $3.5B Series E (Mar 2025) + $13B Series F (Sep 2025) + $30B Series G (Feb 2026) + $65B (May 2026) ≈ $121.7B. No single aggregator total was found confirming this exact sum, so it is an estimate computed by this researcher from confirmed individual rounds, not a press-stated cumulative figure.",
   "source": "https://en.wikipedia.org/wiki/Anthropic",
   "quote": "In May 2026, Anthropic announced it had raised $65 billion of investment from multiple investors ... The investment round valued the company at $965 billion."
  },
  "last_round": {
   "type": "growth / strategic (reported by Reuters as \"Series H\")",
   "amount_usd": 65000000000,
   "date": "2026-05",
   "leads": [
    "Altimeter Capital",
    "Dragoneer Investment Group",
    "Sequoia Capital"
   ],
   "status": "confirmed",
   "source": "https://en.wikipedia.org/wiki/Anthropic",
   "quote": "In May 2026, Anthropic announced it had raised $65 billion of investment from multiple investors, including Altimeter Capital, Dragoneer Investment Group, and Sequoia Capital. The investment round valued the company at $965 billion."
  },
  "investors": [
   "Amazon",
   "Google",
   "Lightspeed Venture Partners",
   "Iconiq Capital",
   "Fidelity Management & Research",
   "Qatar Investment Authority",
   "Coatue",
   "GIC",
   "Sequoia Capital",
   "Altimeter Capital",
   "Dragoneer Investment Group",
   "Spark Capital",
   "FTX (Sam Bankman-Fried, 2022, since collapsed)"
  ],
  "portfolio_listings": [],
  "revenue": {
   "value_usd": 4500000000,
   "kind": "annual revenue",
   "as_of": "2025",
   "status": "confirmed",
   "basis": "Wikipedia infobox, citing company/press reporting of full-year 2025 revenue.",
   "source": "https://en.wikipedia.org/wiki/Anthropic",
   "quote": "Revenue US$4.5 billion (2025)"
  },
  "employees": {
   "value": 2500,
   "source": "https://en.wikipedia.org/wiki/Anthropic"
  },
  "note": "Anthropic is the company behind Claude / Claude Managed Agents (the sandbox/runtime product this card describes), not a standalone sandbox startup. It is a private, VC- and strategic-backed AI foundation-model company (major investors/strategic partners include Amazon and Google, both also its primary cloud infra providers) reportedly worth $965B post-money as of May 2026, with a widely reported plan to IPO in 2026 (not yet public as of the 2026-09-30 check date). Revenue and funding figures reflect the whole company, not the Managed Agents / sandbox product specifically, which is a beta feature (since 2026-04-08) inside the Claude platform rather than a separately monetized business line."
 },
 "id": "claude-managed-agents",
 "name": "Claude Managed Agents",
 "url": "https://platform.claude.com/docs/en/about-claude/pricing#claude-managed-agents-pricing",
 "category": "agent-sandbox",
 "isolation": "container",
 "modes": [
  {
   "key": "on-demand",
   "label": "Cloud sandbox session runtime ($0.08 per running session-hour, flat)",
   "flags": [
    "alt"
   ],
   "os": [
    "linux"
   ],
   "regions": null,
   "gpu_only": false,
   "features": {
    "isolation": "container"
   },
   "pricing": "sizes",
   "vcpu_h": null,
   "ram_gib_h": null,
   "cpu_basis": "alloc",
   "ram_basis": "alloc",
   "active_floor": 0,
   "ram_per_vcpu": [
    null,
    null
   ],
   "ram_fixed_per_vcpu": null,
   "vcpu_options": null,
   "min_vcpu": null,
   "max_vcpu": null,
   "max_ram_gib": 8,
   "sizes": [
    {
     "name": "cloud sandbox (fixed)",
     "vcpu": null,
     "ram_gib": 8,
     "disk_gib": 10,
     "hour": 0.08,
     "month_cap": null
    }
   ],
   "pool_tiers": null,
   "requires_always_on": false,
   "always_on_month_per_instance": null,
   "commit_note": null,
   "min_billed_seconds": 0,
   "granularity_s": 0.001,
   "start_fee": 0,
   "boot_overhead_s": null,
   "multiplier": 1,
   "windows_vcpu_h": null,
   "gpu": null,
   "note": "One flat SKU regardless of resources: $0.08 per session-hour, metered to the ms only while session status = running (agent working, incl. time waiting on model inference). idle (waiting for user/tool confirmation), rescheduling, terminated = $0, and an idle session keeps its sandbox. Sandbox = Ubuntu 24.04 container, up to 8 GB RAM / 10 GB disk, vCPU unpublished (vcpu null). Model tokens billed on top at API list rates (not modeled here).",
   "product_class": "agent-platform"
  },
  {
   "key": "self-hosted",
   "label": "Self-hosted sandbox environment (your infra, Anthropic orchestration)",
   "flags": [
    "alt"
   ],
   "os": [
    "linux"
   ],
   "regions": null,
   "gpu_only": false,
   "features": {
    "self_host": true,
    "byoc": true,
    "isolation": null,
    "image_oci": null
   },
   "pricing": "sizes",
   "vcpu_h": null,
   "ram_gib_h": null,
   "cpu_basis": "alloc",
   "ram_basis": "alloc",
   "active_floor": 0,
   "ram_per_vcpu": [
    null,
    null
   ],
   "ram_fixed_per_vcpu": null,
   "vcpu_options": null,
   "min_vcpu": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes": [
    {
     "name": "self-hosted worker",
     "vcpu": null,
     "ram_gib": null,
     "disk_gib": null,
     "hour": null,
     "month_cap": null
    }
   ],
   "pool_tiers": null,
   "requires_always_on": false,
   "always_on_month_per_instance": null,
   "commit_note": null,
   "min_billed_seconds": 0,
   "granularity_s": 0.001,
   "start_fee": 0,
   "boot_overhead_s": null,
   "multiplier": 1,
   "windows_vcpu_h": null,
   "gpu": null,
   "note": "You pay your own compute. Whether the $0.08/session-hour runtime SKU also applies to self-hosted sessions is not documented (pricing table does not distinguish; self-hosted docs silent) -> hour null.",
   "product_class": "byoc"
  },
  {
   "key": "code-execution-tool",
   "label": "Messages API code execution tool container (not Managed Agents)",
   "flags": [],
   "os": [
    "linux"
   ],
   "regions": null,
   "gpu_only": false,
   "features": {
    "code_interpreter": true,
    "pause_resume": true,
    "snapshot": "fs",
    "browser": false,
    "agent_harnesses": false,
    "isolation": "container"
   },
   "pricing": "sizes",
   "vcpu_h": null,
   "ram_gib_h": null,
   "cpu_basis": "alloc",
   "ram_basis": "alloc",
   "active_floor": 0,
   "ram_per_vcpu": [
    null,
    null
   ],
   "ram_fixed_per_vcpu": null,
   "vcpu_options": [
    1
   ],
   "min_vcpu": 1,
   "max_vcpu": 1,
   "max_ram_gib": 5,
   "sizes": [
    {
     "name": "code execution container",
     "vcpu": 1,
     "ram_gib": 5,
     "disk_gib": 5,
     "hour": 0.05,
     "month_cap": null
    }
   ],
   "pool_tiers": null,
   "requires_always_on": false,
   "always_on_month_per_instance": null,
   "commit_note": "Docs: 1,550 free container-hours per org per month; claude.com/pricing states the same allowance as 50 free hours DAILY per org. If it is a daily bucket, unused hours do not roll over within the month and bursty use (e.g. 500 h in one day) pays $0.05/h above 50 h that day. Then $0.05/h per container.",
   "min_billed_seconds": 300,
   "granularity_s": null,
   "start_fee": 0,
   "boot_overhead_s": null,
   "multiplier": 1,
   "windows_vcpu_h": null,
   "gpu": null,
   "note": "1 CPU / 5 GiB RAM / 5 GiB disk, NO internet access, pre-installed libraries only; containers checkpoint after ~5 min inactivity and expire 30 days after creation. 5-minute minimum per execution; billed even if the tool is not called when files are attached. FREE (no execution-time charge) when the request includes web_search_20260209+ or web_fetch_20260209+. Replaced by session runtime inside Managed Agents (no double billing). 1,550 free container-hours/org/month encoded as plan included_usd $77.50 scoped to this mode.",
   "product_class": "code-interpreter"
  }
 ],
 "storage": {
  "included_disk_gib": 10,
  "disk_gib_month": null,
  "disk_billed_when_stopped": false,
  "snapshot_gib_month": 0,
  "paused_ram_billed": false
 },
 "network": {
  "egress_free_gib": null,
  "egress_gib": null,
  "ipv4_month": null,
  "ipv4_available": false,
  "internet": {
   "default": "configurable",
   "evidence": [
    {
     "quote": "Full outbound network access, except for a general safety blocklist. This is the default.",
     "url": "https://platform.claude.com/docs/en/managed-agents/environments"
    },
    {
     "quote": "Restricts sandbox network access to the hosts in `allowed_hosts`. Set `allow_package_managers` and `allow_mcp_servers` to `true` to allow additional access.",
     "url": "https://platform.claude.com/docs/en/managed-agents/environments"
    }
   ]
  }
 },
 "plans": [
  {
   "name": "Claude API (pay-as-you-go, usage tiers)",
   "fee": 0,
   "flags": [
    "beta"
   ],
   "fee_is_credit": false,
   "included_usd": 77.5,
   "per_seat": 0,
   "concurrency": null,
   "max_session_h": null,
   "max_vcpu": null,
   "max_ram_gib": 8,
   "sizes_allowed": null,
   "note": "No plan fee; enabled by default for all API accounts (beta). Org rate limits: 300 creates/min, 1,200 reads/min. HARD monthly spend caps per usage tier (tokens + runtime + tools combined): Start $500, Build $1,000, Scale $200,000, Custom none (sales); new orgs may start in a lower 'Evaluation' tier. At the cap all API usage (incl. sessions) pauses until 00:00 UTC on the 1st of next month unless a higher limit is requested. Tier rises automatically with usage history, or via 'Request rate limit increase' in Console. No published concurrent-session cap.",
   "included_applies_to_modes": [
    "code-execution-tool"
   ]
  },
  {
   "name": "Enterprise / volume (negotiated)",
   "fee": null,
   "flags": [
    "sales"
   ],
   "fee_is_credit": null,
   "included_usd": null,
   "per_seat": null,
   "concurrency": null,
   "max_session_h": null,
   "max_vcpu": null,
   "max_ram_gib": null,
   "sizes_allowed": null,
   "note": "Custom rate limits, volume discounts, invoicing. Discounts unpublished. Session budgets still enforce at LIST cost."
  }
 ],
 "extras": [
  {
   "item": "Model tokens (dominant cost)",
   "price": "API list rates, e.g. Opus 5.5 $4/$20 per MTok in/out (cache read 0.05x), Opus 5 $5/$25, Sonnet 5.5 $2/$10, Haiku 4.5 $1/$5, Fable 5.1 $10/$50; prompt caching multipliers apply; Batch discount does NOT apply; not available via Bedrock/Vertex/Foundry-style partner cloud pricing; fast mode premium applies if model.speed=fast"
  },
  {
   "item": "US-only inference (model.inference_geo = us)",
   "price": "1.1x on tokens (runtime unaffected)"
  },
  {
   "item": "Web search inside a session",
   "price": "$10 per 1,000 searches; web fetch free"
  },
  {
   "item": "Claude Platform on AWS",
   "price": "Same rates converted to CCUs ($0.01/CCU) on AWS Marketplace"
  }
 ],
 "free": {
  "monthly_credit": 0,
  "one_time_credit": null
 },
 "features": {
  "linux": true,
  "windows": false,
  "macos": false,
  "arm64": false,
  "gpu": false,
  "gpu_types": [],
  "snapshot": "fs",
  "pause_resume": true,
  "fork": false,
  "persistent_disk": true,
  "volumes": true,
  "auto_stop_idle": true,
  "max_session_h": null,
  "custom_image": true,
  "docker_inside": null,
  "nested_virt": false,
  "root": null,
  "systemd": null,
  "browser": true,
  "desktop": false,
  "computer_use": false,
  "code_interpreter": false,
  "agent_harnesses": true,
  "ssh": false,
  "public_ipv4": false,
  "inbound_https": false,
  "custom_domain": false,
  "raw_tcp_inbound": false,
  "egress_allowlist": true,
  "static_egress_ip": false,
  "private_network": null,
  "self_host": true,
  "byoc": true,
  "open_source": false,
  "regions": [
   "us"
  ],
  "soc2": true,
  "hipaa": false,
  "sso": true,
  "lang_python": true,
  "lang_node": true,
  "lang_go": true,
  "lang_rust": true,
  "lang_java": true,
  "gpu_desktop": false,
  "credential_injection": true,
  "egress_http_rules": false,
  "wake_on_request": true,
  "live_resize": false,
  "fork_running": false,
  "memory_snapshot_fork": false,
  "webhooks": true,
  "scheduled_wakeups": true,
  "audit_logs": null,
  "eu_data_residency": false,
  "zero_data_retention": false,
  "scoped_api_keys": null,
  "spend_limits": true,
  "mcp_server": true,
  "isolation": "container",
  "image_oci": true,
  "snapshot_auto": true,
  "snapshot_on_demand": false,
  "harness_api": true,
  "egress_allowlist_level": "domain",
  "ingress_rules": false,
  "secret_proxy": "any-http",
  "volume_attach": true,
  "volume_shared": true,
  "anti_bot": false,
  "captcha_solving": false,
  "egress_ip_type": "datacenter",
  "own_agent_api": false,
  "guest_firewall": false,
  "open_internet": true,
  "usage_api": true
 },
 "perf": {
  "cpu_runs_s": null,
  "cold_start_ms": null,
  "burst_tti_ms": null,
  "dax_s": null
 },
 "perf_source": "No benchmark row: provider is not in ComputeSDK results or the HPC run (as of 2026-09-28). See research/perf-map.json.",
 "knobs": [
  {
   "id": "running_share",
   "label": "Share of session wall-clock the agent is 'running' (not idle waiting for you)",
   "kind": "slider",
   "min": 0.05,
   "max": 1,
   "step": 0.05,
   "default": 1,
   "unit": "%",
   "options": null,
   "effect": "hours_factor",
   "modes": [
    "on-demand"
   ],
   "why": "Runtime accrues only in status=running; time idle waiting for user messages or tool confirmations is free and the sandbox is kept."
  }
 ],
 "caveats": [
  "Managed Agents session runtime (on-demand) is flagged alt / product_class agent-platform: it only exists inside a Claude agent session and LLM tokens are billed on top (not modeled). Sandbox vCPU unpublished -> shown as unsized.",
  "Code execution tool containers have NO outbound network access (pre-installed libraries only).",
  "Not a general-purpose sandbox: the runtime only exists inside a Claude agent session, and model tokens (not modeled by this card) usually dominate the bill. In Anthropic's own example a 1 h Opus 5 session costs $0.625 in tokens vs $0.08 runtime.",
  "Flat $0.08/h regardless of resources; the sandbox vCPU count is unpublished (size vcpu null), memory 'up to 8 GB', disk 'up to 10 GB'. Workloads needing >8 GiB RAM are infeasible.",
  "'running' includes time the agent spends waiting on model inference, not only CPU activity; cpu util does not reduce cost.",
  "Idle sessions retain their sandbox free of charge; retention limit for idle sessions/sandboxes is unpublished. Deleting a session deletes its sandbox and session-produced files.",
  "Self-hosted environment runtime billing not documented (mode hour null, flagged alt).",
  "Code execution tool (Messages API) is a separate SKU: $0.05/container-hour after 1,550 free hours/org/month, 5-min minimum, 1 CPU/5 GiB, no internet; free when used with web_search/web_fetch 20260209+. The 1,550 free hours ($77.50) are encoded as included_usd on the API plan, scoped to the code-execution-tool mode.",
  "Egress/IPv4 not priced or offered (no inbound ports). Region: sandbox code execution and data at rest follow the workspace geo, and \"us\" is the only workspace geo available (US, no state/city published); model inference can still run \"global\" unless inference_geo = us (1.1x tokens).",
  "Beta since 2026-04-08; runtime price unchanged at $0.08 since launch. Some third-party blogs quote $0.25/session-hour — not supported by the official pricing page.",
  "Not eligible for HIPAA BAA or ZDR. No concurrency cap published; creates limited to 300/min per org.",
  "No benchmark data in benchmarks.json.",
  "Docker inside the cloud sandbox is listed as 'limited availability' (keep features.docker_inside null).",
  "Other limits: max 1,000 scheduled deployments per org (support can raise); max 500 files per session; max 8 memory stores per session; memory versions retained 30 days. Dreams and advisor consultations are billed at token rates only.",
  "Multiagent sessions: up to 25 concurrent threads (coordinator + subagents) share ONE sandbox and filesystem, and runtime is metered per session status, so parallel subagents do not multiply the $0.08/h runtime (they do multiply tokens)."
 ],
 "sources": [
  "https://platform.claude.com/docs/en/about-claude/pricing",
  "https://platform.claude.com/docs/en/managed-agents/overview",
  "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
  "https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool",
  "https://platform.claude.com/docs/en/managed-agents/environments",
  "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
  "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes",
  "https://platform.claude.com/docs/en/managed-agents/session-operations",
  "https://platform.claude.com/docs/en/managed-agents/reference",
  "https://platform.claude.com/docs/en/managed-agents/budgets",
  "https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws",
  "https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool",
  "https://platform.claude.com/docs/en/manage-claude/data-residency"
 ],
 "fleet": {
  "default_max_instances": null,
  "default_max_vcpu": null,
  "default_max_gpus": null,
  "raise": "automatic",
  "raise_time_days": null,
  "verification": "Standard API paid billing accepts major credit cards; Enterprise invoicing available. Sandbox-specific identity requirements not established.",
  "tiers": "Evaluation (below standard, new orgs) -> Start ($500/mo spend cap) -> Build ($1,000) -> Scale ($200,000) -> Custom (no cap, account team). Managed Agents create endpoints 300/min, reads 1,200/min per org at all tiers.",
  "notes": "Managed cloud sandboxes belong to agent sessions, not standalone machine rentals. Reference publishes org request rates (300/min write, 1,200/min reads) plus model usage-tier/spend limits, but not concurrent sandbox count. API rate and token tiers cannot be treated as VM fleet quota. No quota-specific raise timeline or sandbox KYC found.",
  "sources": [
   "https://platform.claude.com/docs/en/managed-agents/reference",
   "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "https://platform.claude.com/docs/en/about-claude/pricing"
  ],
  "researched": "2026-09-28"
 },
 "audit_2026_09_29": {
  "applied": 5,
  "source": "checked against the provider's live pricing and docs pages",
  "reviewed": 5
 },
 "feature_evidence": {
  "snapshot_auto": {
   "value": true,
   "source": "https://platform.claude.com/docs/en/managed-agents/events-and-streaming",
   "quote": "When a session goes idle, its sandbox is checkpointed, preserving the full sandbox state, including the filesystem, installed packages, and any files the agent created.",
   "note": "Trigger: session goes idle (agent finished its turn / waiting for input or tool confirmation). Resumes on next user.message. Memory/running processes not stated (docs list filesystem, packages, files only). Sandbox state kept only 30 days after sandbox creation ('Activity does not extend this window'), then a resumed session starts from a fresh sandbox. Idle time is not billed.",
   "checked": "2026-09-29"
  },
  "snapshot_on_demand": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/events-and-streaming",
   "quote": "When a session goes idle, its sandbox is checkpointed, preserving the full sandbox state, including the filesystem, installed packages, and any files the agent created.",
   "note": "Not a contradiction: snapshot=\"fs\" describes the TYPE of state saved (filesystem/packages/files), which happens only automatically on session-idle (snapshot_auto=true). No API/CLI endpoint exists to trigger a checkpoint on demand; the beta API surface (sessions, events, threads, environments, vaults) has no snapshot/checkpoint-create endpoint.",
   "checked": "2026-09-30"
  },
  "harness_api": {
   "value": true,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Send user messages as events. Claude autonomously runs tools and streams back results through server-sent events (SSE). Event history is persisted server-side and can be fetched in full.",
   "note": "The product IS a harness API for Anthropic's own agent harness (Claude Managed Agents harness, Claude models only): create session with prompt (initial_events), stream SSE events (incl. token deltas), send follow-ups, interrupt, list/resume sessions and threads, multiagent threads, webhooks. Not Claude Code/Codex/other CLIs.",
   "checked": "2026-09-29"
  },
  "egress_allowlist": {
   "value": true,
   "source": "https://platform.claude.com/docs/en/managed-agents/environments",
   "quote": "`allowed_hosts` specifies domains the sandbox can reach. Specify bare hostnames or wildcard patterns (such as `*.example.com`). Do not include a URL scheme, port, or path.",
   "note": "Per-environment networking: `unrestricted` (default for API; safety blocklist) or `limited` ('Restricts sandbox network access to the hosts in `allowed_hosts`') with optional allow_package_managers / allow_mcp_servers. Enforced outside the container. No IP/CIDR rules.",
   "checked": "2026-09-29",
   "level": "domain"
  },
  "egress_http_rules": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/environments",
   "quote": "Network access is granted per host, not per operation. The sandbox can send any request to an allowed host, including uploads such as `git push` and package publishing, with any credential the command supplies.",
   "note": "No method/path rules. (Vault credential injection_location header/body scopes where secrets are substituted, not which requests are allowed.)",
   "checked": "2026-09-29"
  },
  "ingress_rules": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/environments",
   "quote": "The networking field controls the sandbox's outbound network access.",
   "note": "Cloud-sandboxes-reference and environments docs document only outbound (egress) network controls (unrestricted/limited + allowed_hosts); no inbound ports, preview URLs, IP allowlists, or security groups for reaching the sandbox are documented anywhere. Nothing to control since there is no ingress at all.",
   "checked": "2026-09-30"
  },
  "secret_proxy": {
   "value": "any-http",
   "source": "https://platform.claude.com/docs/en/managed-agents/vaults",
   "quote": "each credential is keyed by a `secret_name` (the environment variable name) and stored in the sandbox as an opaque placeholder. When the agent initiates an outbound request, the opaque placeholder is substituted with the real secret at egress. The agent never sees the secret value.",
   "note": "Vault `environment_variable` credentials: per-credential networking.allowed_hosts (which hosts get the secret) and injection_location {header, body}. 'The substitution happens at egress, not inside the sandbox.' Works only for clients that send the secret verbatim (breaks SigV4-style signing); tokens returned by exchange flows arrive unredacted. HTTP(S) only (header/body); no DB/SSH coverage documented. Also MCP credentials (mcp_oauth/static_bearer, with auto-refresh) injected by Anthropic's MCP connector. Not yet supported on self-hosted sandboxes. Max 20 credentials per vault.",
   "checked": "2026-09-29"
  },
  "volume_attach": {
   "value": true,
   "source": "https://platform.claude.com/docs/en/managed-agents/memory",
   "quote": "A **memory store** is a workspace-scoped collection of text documents optimized for Claude. When you attach a store to a session, it is mounted as a directory inside the session's sandbox.",
   "note": "Only memory stores: up to 8 per session, mounted under /mnt/memory/<slug>/, each memory capped at 100 kB, max 10,000 memories per store (text docs, versioned). No general block/network volumes. Also GitHub repo and file resources are copied in at session start (not volumes).",
   "checked": "2026-09-29"
  },
  "volume_shared": {
   "value": true,
   "source": "https://platform.claude.com/docs/en/managed-agents/memory",
   "quote": "**Shared reference material:** one read-only store attached to many sessions (standards, conventions, domain knowledge), kept separate from each session's own read-write store.",
   "note": "A memory store can be attached to many sessions; access read_write (default) or read_only, 'enforced at the filesystem level'; concurrent writes guarded by content_sha256 preconditions on the API. Small text-doc store, not a general shared FS. Multiagent threads in one session share one sandbox filesystem.",
   "checked": "2026-09-29"
  },
  "nested_virt": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure.",
   "note": "not offered: outside the product's scope. Sandboxes are shared-kernel Linux containers (isolation: container), and even the in-container docker tool is only 'limited availability'; no /dev/kvm or nested-virtualization capability is documented.",
   "checked": "2026-09-30"
  },
  "computer_use": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Claude Managed Agents gives Claude access to a set of built-in tools: Bash ... File operations ... Web search and fetch ... MCP servers",
   "note": "not offered: outside the product's scope. The documented built-in toolset is bash/files/web-search-fetch/MCP; there is no screenshot+click desktop-driving 'computer use' tool for Managed Agents sandboxes (no desktop/VNC surface either, features.desktop=false).",
   "checked": "2026-09-30"
  },
  "anti_bot": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Playwright (Python and Node.js) - Browser automation library; Chromium (/opt/pw-browsers/chromium) - Browser used by Playwright",
   "note": "not offered: outside the product's scope. The sandbox ships plain Playwright/Chromium for browser automation/testing; no stealth or anti-fingerprinting feature against bot detection is documented.",
   "checked": "2026-09-30"
  },
  "captcha_solving": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Pre-built, configurable agent harness that runs in managed infrastructure. Best for long-running tasks and asynchronous work.",
   "note": "not offered: outside the product's scope. Managed Agents is a general coding/task-agent harness (bash, files, web search/fetch, MCP); no CAPTCHA-solving tool or service is documented.",
   "checked": "2026-09-30"
  },
  "egress_ip_type": {
   "value": "datacenter",
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure.",
   "note": "derived: sandboxes are shared containers on Anthropic's own cloud infrastructure with domain-based egress allowlisting (environments.networking); no residential/mobile IP product is offered or implied anywhere in the docs.",
   "checked": "2026-09-30"
  },
  "wake_on_request": {
   "value": true,
   "source": "https://platform.claude.com/docs/en/managed-agents/events-and-streaming",
   "quote": "When a session goes idle, its sandbox is checkpointed, preserving the full sandbox state, including the filesystem, installed packages, and any files the agent created. This allows you to resume cleanly from inactivity.",
   "note": "An idle session's checkpointed sandbox resumes automatically (no separate 'start' API call) the next time a user.message event arrives, as long as it's within the 30-day sandbox-state retention window; functionally equivalent to wake-on-request for a sleeping machine.",
   "checked": "2026-09-30"
  },
  "live_resize": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Memory: Up to 8 GB; Disk space: Up to 10 GB",
   "note": "not offered: outside the product's scope. Sandbox size is a fixed, unpublished spec ('up to 8 GB/10 GB') set by the flat $0.08/session-hour SKU; there is no API or config field to change CPU/RAM of a running sandbox.",
   "checked": "2026-09-30"
  },
  "own_agent_api": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Claude Managed Agents provides the harness and infrastructure for running Claude as an autonomous agent.",
   "note": "not offered: outside the product's scope as defined. This IS a first-party API for Anthropic's own agent, but it drives a general coding/task harness (already captured by harness_api=true) rather than a distinct browser/computer-use/research task-agent product; Anthropic documents no separate own-agent API of that kind for Managed Agents.",
   "checked": "2026-09-30"
  },
  "guest_firewall": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure.",
   "note": "derived: the field's medium-confidence heuristic (VM/microVM with root=true) does not apply here; isolation is a shared-kernel Linux container, not a VM/microVM, and root access is undocumented/null, so nftables/iptables working as expected inside cannot be assumed.",
   "checked": "2026-09-30"
  },
  "static_egress_ip": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/environments",
   "quote": "allowed_hosts specifies domains the sandbox can reach. Specify bare hostnames or wildcard patterns (such as *.example.com).",
   "note": "not offered: egress control in the docs is entirely domain/host-based (allowed_hosts, allow_package_managers, allow_mcp_servers); no fixed/dedicated outbound IP address or IP-based egress feature is documented for cloud sandboxes.",
   "checked": "2026-09-30"
  },
  "sso": {
   "value": true,
   "source": "https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso",
   "quote": "Single sign-on is available for Team plans, Enterprise plans, and Console organizations.",
   "note": "Console organizations (platform.claude.com) are the org type Managed Agents API accounts belong to; SSO is configured via SAML with providers such as Okta, Entra ID, Google, OneLogin, JumpCloud, Duo, and can be required org-wide.",
   "checked": "2026-09-30"
  },
  "volumes": {
   "value": true,
   "corrected_from": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/memory",
   "quote": "When you attach a store to a session, it is mounted as a directory inside the session's sandbox. ... one read-only store attached to many sessions ... kept separate from each session's own read-write store.",
   "note": "Direct contradiction in the card itself: features.volumes=false while features.volume_attach=true and features.volume_shared=true, both backed by evidence (memory stores: attachable, up to 8/session, and one store can be shared read-only across many sessions). Correct volumes to true (memory-store-style volumes, not generic block storage).",
   "checked": "2026-09-30"
  },
  "fork": {
   "value": false,
   "source": "https://platform.claude.com/llms.txt",
   "quote": null,
   "note": "No fork/clone/duplicate-session endpoint anywhere in the Managed Agents API surface (sessions, events, threads, environments, reference, session-operations, budgets docs all reviewed); sessions/sandboxes are created fresh or resumed from their own idle checkpoint only. No evidence of machine cloning.",
   "checked": "2026-09-30"
  },
  "fork_running": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/session-operations",
   "quote": null,
   "note": "Session operations documented are create, resume, interrupt, delete, and budget updates — no operation clones a live/running sandbox. Follows from fork=false (no cloning capability exists at all, running or not).",
   "checked": "2026-09-30"
  },
  "memory_snapshot_fork": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": null,
   "note": "No fork feature exists (see fork/fork_running), so a memory-including fork variant does not exist either. Checkpointing itself explicitly covers only filesystem/packages/files, not running processes or memory state.",
   "checked": "2026-09-30"
  },
  "ssh": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Send user messages as events. Claude autonomously runs tools and streams back results through server-sent events (SSE).",
   "note": "The sandbox is reachable only via the sessions/events API driving the agent's own bash tool; no SSH/remote-shell access for the human operator is documented anywhere in the Managed Agents docs (overview, cloud-sandboxes-reference, self-hosted-sandboxes).",
   "checked": "2026-09-30"
  },
  "desktop": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure. They come pre-installed with a comprehensive set of programming languages, databases, and utilities.",
   "note": "Product is a headless container sandbox (no VNC/RDP/GUI streaming documented); features.browser=true refers to a managed headless browser tool, not a graphical desktop. Outside the product's scope.",
   "checked": "2026-09-30"
  },
  "custom_image": {
   "value": true,
   "corrected_from": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes",
   "quote": "Build an image with ant installed and ant beta:worker run as the entrypoint. The base image must provide /bin/bash; curl is only used at build time. ... FROM your-base-image",
   "note": "For self-hosted sandboxes (a documented, first-party mode of this same product) you build your own Docker image (FROM your-base-image) as the sandbox environment. The default Anthropic-managed cloud sandbox is a fixed Ubuntu 24.04 image with no custom-image option, but the product as a whole does offer custom images via self-hosting.",
   "checked": "2026-09-30"
  },
  "image_oci": {
   "value": true,
   "corrected_from": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes",
   "quote": "FROM your-base-image ARG ANT_VERSION=1.36.0 ARG TARGETARCH RUN ARCH=$([ \"$TARGETARCH\" = \"arm64\" ] && echo arm64 || echo amd64) && curl -fsSL \"https://github.com/anthropics/anthropic-cli/releases/download/...\"",
   "note": "Same evidence as custom_image: self-hosted worker sandboxes are started from a Docker/OCI image you build yourself (any base image + the ant worker binary as entrypoint). Managed cloud sandboxes remain a fixed image; self-hosted sandboxes are OCI-image-based.",
   "checked": "2026-09-30"
  },
  "inbound_https": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Cloud sandboxes run as isolated Linux containers on Anthropic-managed infrastructure.",
   "note": "No HTTPS/URL exposure mechanism for sandbox ports is documented; the sandbox environments/networking docs cover outbound access only, and the sandbox is reachable exclusively through the sessions API, never via a public URL.",
   "checked": "2026-09-30"
  },
  "public_ipv4": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/environments",
   "quote": "allowed_hosts specifies domains the sandbox can reach.",
   "note": "Networking docs describe only which outbound hosts a sandbox may reach; no per-sandbox public/inbound IPv4 address is documented or assignable.",
   "checked": "2026-09-30"
  },
  "gpu": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Sandbox specifications: Operating system Ubuntu 24.04 LTS, Architecture x86_64 (amd64), Memory Up to 8 GB, Disk space Up to 10 GB",
   "note": "Full published sandbox spec table lists OS, architecture, memory, and disk only — no GPU row/option. Product is a lightweight coding-agent container sandbox, not a compute/GPU cloud.",
   "checked": "2026-09-30"
  },
  "windows": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Sandbox specifications: Operating system Ubuntu 24.04 LTS, Architecture x86_64 (amd64)",
   "note": "Cloud sandbox OS is fixed at Ubuntu 24.04 LTS. Additionally, self-hosted worker docs state explicitly: \"Windows hosts are not supported, because the worker requires O_NOFOLLOW when it opens memory files\" (https://platform.claude.com/docs/en/managed-agents/memory).",
   "checked": "2026-09-30"
  },
  "macos": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Sandbox specifications: Operating system Ubuntu 24.04 LTS",
   "note": "Cloud sandbox OS is fixed at Ubuntu Linux; no macOS sandbox option exists. (macOS appears in docs only as a developer install target for the ant CLI used to run a self-hosted worker, not as a sandbox OS.) Outside the product's scope.",
   "checked": "2026-09-30"
  },
  "arm64": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference",
   "quote": "Sandbox specifications: Architecture x86_64 (amd64)",
   "note": "Managed cloud sandbox architecture is explicitly fixed at x86_64/amd64. (arm64 only appears in self-hosted-worker install scripts, i.e. the architecture of infrastructure YOU supply, not an offered sandbox CPU architecture choice.)",
   "checked": "2026-09-30"
  },
  "self_host": {
   "value": true,
   "corrected_from": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes",
   "quote": "Self-hosted sandboxes keep the orchestration on Anthropic's side but move tool execution into infrastructure you control, so the agent's code, filesystem, and network egress never leave your environment. Tool execution stays on your host: the filesystem the agent reads and writes, the processes it spawns, and the network it can reach are all under your control.",
   "note": "Contradiction in the card: top-level features.self_host=false even though the card's own \"self-hosted\" mode sets features.self_host=true and self-hosted-sandboxes docs describe running the sandbox/worker entirely on infrastructure you control. Correct top-level self_host to true.",
   "checked": "2026-09-30"
  },
  "open_source": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Claude Managed Agents is a beta feature of the Claude Developer Platform for running long-lived, autonomous Claude agent sessions.",
   "note": "Managed Agents is a proprietary hosted Anthropic API product (beta feature of the paid Claude Developer Platform), not released under an OSI license. (The `ant` CLI/worker binary is a closed-source download, not published as open source.)",
   "checked": "2026-09-30"
  },
  "hipaa": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/overview",
   "quote": "Managed Agents is not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement (BAA) coverage.",
   "note": "Explicit statement of non-eligibility for HIPAA BAA.",
   "checked": "2026-09-30"
  },
  "eu_data_residency": {
   "value": false,
   "source": "https://platform.claude.com/docs/en/manage-claude/data-residency",
   "quote": "The inference_geo parameter controls where model inference runs for a specific API request. ... Value Description \"global\" Default. Inference may run in any available geography ... inference_geo = \"us\"",
   "note": "The only geographic pinning values documented for the Claude API / Managed Agents are \"global\" and \"us\" (allowed_inference_geos / default_inference_geo also only take these). No EU region/residency option is offered.",
   "checked": "2026-09-30"
  },
  "usage_api": {
   "value": true,
   "corrected_from": false,
   "source": "https://platform.claude.com/docs/en/managed-agents/budgets",
   "quote": "The session object carries its `budget` and a `usage` object with the tracked spend: `usage.list_cost` is the session's consumed list cost, and `usage.active_seconds` is the running time its runtime cost is priced on.",
   "note": "granularity: per-session (each session has its own sandbox); cost: yes, at list rates (tokens + web searches + $0.08/h running time), rounded to whole cents; negotiated discounts not reflected. Also streamed as the `session.usage` event (\"Snapshot of the session's cumulative usage and tracked list cost\", reference page), and threads carry their own usage. Org-wide history is in the separate Usage & Cost Admin API.",
   "confidence": "high",
   "checked": "2026-10-14"
  }
 },
 "locations": [
  {
   "country": "US",
   "state": null,
   "city": null,
   "provider_region": "us (workspace geo)",
   "self_serve": true,
   "choosable": false
  }
 ],
 "locations_source": "https://platform.claude.com/docs/en/manage-claude/data-residency",
 "locations_quote": "Workspace geo: Controls where data is stored at rest and where endpoint processing (such as image transcoding and code execution) happens. ... Currently, \"us\" is the only available workspace geo. ... Managed Agents also respects the Workspace geo configured in Console",
 "locations_checked": "2026-10-14",
 "locations_note": "Cloud sandboxes (code execution) and data at rest follow the workspace geo, and \"us\" is the only one offered, so the only location is the US; no state or city is published. Model inference is separate: inference_geo \"global\" (default, any geography) or \"us\" (1.1x tokens). Self-hosted sandboxes run wherever you host them."
}