# I don't think you need Claude's harness > Vlad Cealicu on Anthropic's self-hosted Claude Managed Agents. A company that hosts it already runs the server, the database and the workers, so he thinks it should get Claude to design a harness from its own spec and run its own code, and someone working alone can use Claude Code's cloud sessions. - Canonical: https://www.anchorterminal.com/blog/another-harness-for-business - Markdown: https://www.anchorterminal.com/blog/another-harness-for-business.md (~2,300 tokens) - Slim: https://www.anchorterminal.com/blog/another-harness-for-business.min.md (~1,230 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/blog/another-harness-for-business.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-13 By Vlad Cealicu*, 13 November 2026. 908 words, about 4 min to read. * With the editing help of Claude Opus or Claude Fable. Oh yay, another harness. Anthropic's post of 12 November is about running Claude Managed Agents inside a company's own security perimeter [[1]](#ref-1), and I don't think you need Claude's harness. I think you get Claude to design one for your business, based on your own spec, and you run it yourself. Your own code and your own harness, and I think that matters even more at company level. ## What Anthropic shipped Managed Agents is Anthropic's set of APIs for building and deploying agents. Until now a company that needed its code to stay in its own environment could host only the sandbox, the place where the agent runs its shell and file tools. Now it can run the whole service in its own cloud or on its own machines [[1]](#ref-1). It's in private beta, and the way in is to contact your Anthropic account team [[1]](#ref-1), which is something a company has and a person doesn't. Who runs each part 1. **The loop that calls Claude** (the vendor's code). The harness, which is Anthropic's and which the article calls the brain [[1]](#ref-1) 2. **The server and its database** (you run it). Session history is an event log in your own database [[1]](#ref-1) 3. **The workers and sandboxes** (you run it). Where the agent's shell and file tools run, which the article calls the hands [[1]](#ref-1) 4. **Credentials** (you run it). They can sit in your own secrets manager, kept out of the sandbox [[1]](#ref-1) 5. **Network limits** (you run it). A list of allowed hosts, set in your own firewall [[1]](#ref-1) 6. **The record of every step** (you run it). Exported over OpenTelemetry to the monitoring you already have [[1]](#ref-1) 7. **Requests to Claude** (you pick the route). Anthropic, Amazon Bedrock, Google's Agent Platform, Microsoft Foundry or your own gateway [[1]](#ref-1) So the company already operates all of it, the server, the database and the workers [[1]](#ref-1), and what comes from Anthropic is the code of the harness. I think that's the one part a company should want to be its own. ## A harness isn't a secret That list is most of a spec already. A loop that calls the model, a sandbox for the commands, the session kept as a log outside the sandbox, credentials the agent's code never sees, a list of hosts it may reach and a record of every step. None of that is hidden, since we list 56 of them in [agent harnesses](/categories/agent-harnesses) on Anchor Terminal, 25 of them free, and more than half publish their source under MIT or Apache 2.0 [[2]](#ref-2). One of them, [mini-swe-agent](/tools/mini-swe-agent) from the team behind SWE-bench, has an agent class of about 190 lines [[3]](#ref-3). ## Why your own A harness is where your rules live, which systems an agent may touch, what it has to ask a person before doing, where the log goes and what leaves your machines. We grade harnesses on four things, what they ask before acting, what the sandbox and the network allow by default, whether a run with nobody watching stops on its own, and what gets sent back to the vendor [[2]](#ref-2). Write your own answers to those four, add how your company works (your repositories, who approves what, who gets paged), and you have a spec. Give it to Claude, have it design the harness and write the code, and what you run is your own code, built around your rules. I think that matters more at company level, because a company has more rules, and because a harness you own only changes when you change it. On 7 October the hosted Managed Agents changed which pages its web fetch tool would fetch, and requests for other pages started coming back as errors [[4]](#ref-4). (It's labelled beta and says its behaviour may change between releases, which is fair, and it still wasn't your decision.) ## What you take on You take on the hard part, which is security. The permission and sandbox layer is where harnesses break, the good ones included. GitHub's database has 29 published advisories for Claude Code, all fixed [[5]](#ref-5), and mini-swe-agent's experimental sandbox passes the host's API keys through, in a CVE that was still open when we last read it [[3]](#ref-3). So the spec has to say how the sandbox, the credentials and the list of allowed hosts get tested, and I'd have a second agent that hasn't seen the code try to break it before it goes near anything real. You also own the upkeep, so when the model's API changes it's your harness that has to follow. ## If you're solo If you're solo, just use Claude's own harness on the web. It's the same Claude Code you'd run in a sandbox yourself, except that each session runs in its own VM that Anthropic manages, you can have several going at once, and it clones your repositories from GitHub [[6]](#ref-6), so you can give it access to "your code" (in quotes, because if you started in the last year it was probably all generated anyway). It comes with the Pro, Max and Team plans, with no separate charge for the VM [[6]](#ref-6). ## The other half The other half is the tools the harness calls. That's what Anchor Terminal grades, with a source for every score, and [letme](/letme/) picks the top-graded tool for a job by a published rule. If you run a team, write down what an agent may touch, what it has to ask a person and where the log goes, give that to Claude as the spec, and run what comes back on your own machines. --- More in [Opinion](https://www.anchorterminal.com/blog/opinion/index.md) - Older: [What's hyped now, what already peaked, and which company you're in](https://www.anchorterminal.com/blog/what-is-hyped-now.md) - Newer: [A machine that proves Fermat in 29 hours, and the behemoth that's back](https://www.anchorterminal.com/blog/a-machine-that-proves-fermat.md) - All posts: https://www.anchorterminal.com/blog/index.md Anchor Terminal grades the tools AI agents run on, with a source for every score. [The top tools](https://www.anchorterminal.com/top/index.md) · [Categories](https://www.anchorterminal.com/categories/index.md) · [Compare two tools](https://www.anchorterminal.com/compare/index.md) · [Prices](https://www.anchorterminal.com/prices/index.md) · [Sunsets](https://www.anchorterminal.com/sunsets/index.md) · [API, MCP server and CLI](https://www.anchorterminal.com/agents/index.md) ## References Read on 13 November 2026. [1] Anthropic, "Operate Claude Managed Agents inside your security perimeter", 12 November 2026. Source for what Managed Agents is, the earlier self-hosted sandbox, the server, database and workers the customer operates, the harness as the brain and the sandbox as the hands, session history in the customer's database, credentials in the customer's secrets manager, the list of allowed hosts set in the customer's firewall, the record of every step exported over OpenTelemetry, where the requests to Claude can go, the private beta and how access is requested. https://claude.com/resources/articles/self-hosted-claude-managed-agents [2] Anchor Terminal, the agent harnesses category, counted on 13 November 2026. Source for the 56 listings, the 25 that are free, the 36 whose licence is MIT or Apache 2.0 in whole or in part, and the four things the category compares harnesses on. https://www.anchorterminal.com/categories/agent-harnesses [3] Anchor Terminal, the mini-swe-agent listing, checked on 4 November 2026. Source for the agent class of about 190 lines and for CVE-2026-108592 in its experimental bubblewrap sandbox, unfixed at that check. https://www.anchorterminal.com/tools/mini-swe-agent [4] Anchor Terminal, the Claude API listing, which records Anthropic's release note of 7 October 2026. Source for Managed Agents' web fetch tool fetching only URLs already seen in the session from that day, other URLs returning an error, and the beta label. https://www.anchorterminal.com/tools/anthropic-api [5] Anchor Terminal, the Claude Code listing, checked on 4 November 2026. Source for the 29 advisories for the Claude Code package in GitHub's reviewed database, all fixed and published. https://www.anchorterminal.com/tools/claude-code [6] Anthropic, "Use Claude Code in the cloud", Claude Code documentation. Source for a cloud session being a Claude Code session that runs on infrastructure Anthropic manages, each session in an isolated VM, several sessions running at the same time, cloning from GitHub, the plans that include it and there being no separate charge for the VM. https://code.claude.com/docs/en/claude-code-on-the-web --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp