Sign in

Blog · Opinion · 13 November 2026

I don't think you need Claude's harness

Anthropic now lets a company run Claude Managed Agents inside its own perimeter. I think a company should get Claude to design a harness for its own business and run that, and if you're solo the one on the web will do.

By Vlad Cealicu*908 words4 min read* With the editing help of Claude Opus or Claude Fable

Oh yay, another harness. Anthropic's post of 12 November is about running Claude Managed Agents inside a company's own security perimeter [1], and I don't think you need Claude's harness. I think you get Claude to design one for your business, based on your own spec, and you run it yourself. Your own code and your own harness, and I think that matters even more at company level.

What Anthropic shipped

Managed Agents is Anthropic's set of APIs for building and deploying agents. Until now a company that needed its code to stay in its own environment could host only the sandbox, the place where the agent runs its shell and file tools. Now it can run the whole service in its own cloud or on its own machines [1]. It's in private beta, and the way in is to contact your Anthropic account team [1], which is something a company has and a person doesn't.

Self-hosted Managed AgentsWho runs each part
  1. The loop that calls ClaudeThe vendor's code

    The harness, which is Anthropic's and which the article calls the brain [1]

  2. The server and its databaseYou run it

    Session history is an event log in your own database [1]

  3. The workers and sandboxesYou run it

    Where the agent's shell and file tools run, which the article calls the hands [1]

  4. CredentialsYou run it

    They can sit in your own secrets manager, kept out of the sandbox [1]

  5. Network limitsYou run it

    A list of allowed hosts, set in your own firewall [1]

  6. The record of every stepYou run it

    Exported over OpenTelemetry to the monitoring you already have [1]

  7. Requests to ClaudeYou pick the route

    Anthropic, Amazon Bedrock, Google's Agent Platform, Microsoft Foundry or your own gateway [1]

  • You pick the route
  • You run it
  • The vendor's code

So the company already operates all of it, the server, the database and the workers [1], and what comes from Anthropic is the code of the harness. I think that's the one part a company should want to be its own.

A harness isn't a secret

That list is most of a spec already. A loop that calls the model, a sandbox for the commands, the session kept as a log outside the sandbox, credentials the agent's code never sees, a list of hosts it may reach and a record of every step.

None of that is hidden, since we list 56 of them in agent harnesses on Anchor Terminal, 25 of them free, and more than half publish their source under MIT or Apache 2.0 [2]. One of them, mini-swe-agent from the team behind SWE-bench, has an agent class of about 190 lines [3].

Why your own

A harness is where your rules live, which systems an agent may touch, what it has to ask a person before doing, where the log goes and what leaves your machines. We grade harnesses on four things, what they ask before acting, what the sandbox and the network allow by default, whether a run with nobody watching stops on its own, and what gets sent back to the vendor [2]. Write your own answers to those four, add how your company works (your repositories, who approves what, who gets paged), and you have a spec. Give it to Claude, have it design the harness and write the code, and what you run is your own code, built around your rules.

I think that matters more at company level, because a company has more rules, and because a harness you own only changes when you change it. On 7 October the hosted Managed Agents changed which pages its web fetch tool would fetch, and requests for other pages started coming back as errors [4]. (It's labelled beta and says its behaviour may change between releases, which is fair, and it still wasn't your decision.)

What you take on

You take on the hard part, which is security. The permission and sandbox layer is where harnesses break, the good ones included. GitHub's database has 29 published advisories for Claude Code, all fixed [5], and mini-swe-agent's experimental sandbox passes the host's API keys through, in a CVE that was still open when we last read it [3]. So the spec has to say how the sandbox, the credentials and the list of allowed hosts get tested, and I'd have a second agent that hasn't seen the code try to break it before it goes near anything real.

You also own the upkeep, so when the model's API changes it's your harness that has to follow.

If you're solo

If you're solo, just use Claude's own harness on the web. It's the same Claude Code you'd run in a sandbox yourself, except that each session runs in its own VM that Anthropic manages, you can have several going at once, and it clones your repositories from GitHub [6], so you can give it access to "your code" (in quotes, because if you started in the last year it was probably all generated anyway). It comes with the Pro, Max and Team plans, with no separate charge for the VM [6].

The other half

The other half is the tools the harness calls. That's what Anchor Terminal grades, with a source for every score, and letme picks the top-graded tool for a job by a published rule.

If you run a team, write down what an agent may touch, what it has to ask a person and where the log goes, give that to Claude as the spec, and run what comes back on your own machines.

References

Read on 13 November 2026.

  1. [1]Anthropic, "Operate Claude Managed Agents inside your security perimeter", 12 November 2026. Source for what Managed Agents is, the earlier self-hosted sandbox, the server, database and workers the customer operates, the harness as the brain and the sandbox as the hands, session history in the customer's database, credentials in the customer's secrets manager, the list of allowed hosts set in the customer's firewall, the record of every step exported over OpenTelemetry, where the requests to Claude can go, the private beta and how access is requested. claude.com
  2. [2]Anchor Terminal, the agent harnesses category, counted on 13 November 2026. Source for the 56 listings, the 25 that are free, the 36 whose licence is MIT or Apache 2.0 in whole or in part, and the four things the category compares harnesses on. anchorterminal.com
  3. [3]Anchor Terminal, the mini-swe-agent listing, checked on 4 November 2026. Source for the agent class of about 190 lines and for CVE-2026-108592 in its experimental bubblewrap sandbox, unfixed at that check. anchorterminal.com
  4. [4]Anchor Terminal, the Claude API listing, which records Anthropic's release note of 7 October 2026. Source for Managed Agents' web fetch tool fetching only URLs already seen in the session from that day, other URLs returning an error, and the beta label. anchorterminal.com
  5. [5]Anchor Terminal, the Claude Code listing, checked on 4 November 2026. Source for the 29 advisories for the Claude Code package in GitHub's reviewed database, all fixed and published. anchorterminal.com
  6. [6]Anthropic, "Use Claude Code in the cloud", Claude Code documentation. Source for a cloud session being a Claude Code session that runs on infrastructure Anthropic manages, each session in an isolated VM, several sessions running at the same time, cloning from GitHub, the plans that include it and there being no separate charge for the VM. code.claude.com

Your experience matters

Used a tool in the Terminal?

Tell people and their agents what worked and what didn't. Write a review of a tool you've used and confirm it by email or wallet.

Write a reviewHow reviews work