Jonathon's AI Wiki

Claude Managed Agents

21 min read

Source: Anthropic official announcement — Apr 8 2026 + earlier ai-research (web research, 2026-04-11) + raw/How_AI_Now_Does_My_Stock_Research_-_Claude_s_New_Finance_Agents_Full_Install.md (Ralph community walkthrough, 2026-05-22) + July-2026 update: raw/x-bookmarks-recent-digest-2026-07-02.md (@ClaudeDevs) + raw/anthropic-watch-anthropic-cookbook-commit-d146098… & -942b0718… (roadtrip_planner cookbook) + raw/anthropic-watch-skills-commit-9d2f1ae… (claude-api skill) Type: Product Launch Product: Claude Managed Agents Date: 2026-04-08

Blog claims now cited directly from Anthropic: +10 percentage points on structured file generation vs. standard prompting loops (internal testing); customer examples include Notion (parallel workspace tasks), Rakuten (cross-department enterprise agents), Asana (AI Teammates), Sentry (bug detection + patch writing), plus Vibecode, Atlassian, legal tech, and meeting prep applications.

Anthropic’s hosted agent service, launched April 8, 2026 in beta. Managed Agents eliminates 3-6 months of infrastructure work by providing sandboxed code execution, checkpointing, credential management, scoped permissions, and end-to-end tracing out of the box. You define agents in natural language or YAML; Anthropic handles the runtime.

What it does

  • Runs long-horizon agents on Anthropic’s infrastructure — no need to build your own sandbox, checkpointing, or credential store
  • Build and manage agents via the Console, Claude Code, or the new CLI
  • Agent definitions can be natural language or YAML
  • Built-in OAuth support: token exchange, refresh, and consent flows are handled automatically
  • All endpoints require the managed-agents-2026-04-01 beta header

Pricing

  • Runtime: $0.08 per runtime hour
  • Tokens: Standard Claude model usage pricing on top
  • Estimate: ~$58/month for a 24/7 always-on agent (before token costs)

Advanced features (limited preview)

These are not generally available yet — access is gated:

  • Memory tooling — agents persist context across runs
  • Multi-agent orchestration — coordinate multiple managed agents
  • Self-evaluation — agents assess their own output quality

Scheduled deployments + vault credentials (2026-06-09)

The W25 release wave made Managed Agents deployable on a schedule, across the SDK, cookbook, and the claude-api skill:

  • Deployments API + scheduled runs. The Python/TS SDKs (v0.109.0 / sdk-v0.104.0) added Managed Agents deployments support; the claude-api skill documents scheduled deployments — cron schedules, deployment runs, and pause / auto-pause. An agent can be provisioned once and run unattended on a schedule. See SDK releases.
  • Vault environment-variable credentials. Secrets are substituted at egress with networking allowlists, so a deployed agent gets its credentials without them living in the prompt or the codebase.
  • Worked example — Sentry-triage scheduled agent (cookbook): provisions a Managed Agent with a sentry-cli vault credential, schedules it via the deployments API, and writes a triage report each run (requires anthropic>=0.109.0).
  • Worked example — async multi-agent orchestration (cookbook): two Messages-API patterns — a fixed N-agent team with peer messaging through a shared hub, and a lead agent that spawns / monitors / dismisses async subagents. See Agent Teams.

Tokyo update — secret-injection mechanism + dreaming (2026-06-09)

[Code with Claude Tokyo 2026 — Jess Yen & Michael Cohen, MTS Managed Agents] The Tokyo managed-agents breakout (see the event digest) largely re-ran the London “production” talk — same agent / environment / session model and the user / agent / session / span event taxonomy already captured in How to get to production faster with Managed Agents. Two mechanism details beyond that coverage:

  • Vault secret-injection mechanism (concrete). An opaque placeholder token sits in the container; the real secret is injected only at network-request time, so Claude never sees the actual key — the mechanism behind the “substituted at egress” line above.
  • Dreaming. Built on memory: between runs the agent reflects on its past trajectories and codifies the lessons into curated memories. Rakuten (Yusuke Kaji, fireside) reported memory + dreaming addressed ~90% of its agents’ initial mistakes and cut latency/cost. ^[inferred — customer metric stated in-talk, auto-caption-sourced, not independently verified]

July 2026 API update — five new Session/Agent capabilities (2026-07-01)

[@ClaudeDevs, 2026-07-01] A batch of Managed Agents API additions, corroborated the same day by a new cookbook and a claude-api skill update:

  • Streaming session event deltas (event_deltas) — incremental deltas on the session event stream rather than whole-event polling. ^[inferred: mechanism gloss]
  • Per-session agent overrides (agent_with_overrides) — a single session overrides the base agent’s config (model / tools / prompt) without defining a new agent.
  • New webhook event types — additional event types on the webhook surface.
  • Reverse pagination — reverse-order listing of session events.
  • Credential-injection scoping (injection_location) — controls where vault-injected credentials are applied; refines the “secret injected only at network-request time” mechanism above.

Worked example — roadtrip_planner cookbook (anthropics/anthropic-cookbook, PR #750, merged 2026-06-30): a Next.js chat built directly on a Managed Agent session, exercising event_deltas (event-stream previews), vault credential injection_location, per-session agent_with_overrides, and a multiagent coordinator roster with an Opus reviewer — calling the National Park Service and Windy APIs with keys it never holds. The claude-api skill was updated the same day (anthropics/skills #1373) documenting the July updates alongside Claude Sonnet 5.

July launch wave — five more features + four documented corrections (2026-07-22)

Source: raw/anthropic-watch-skills-commit-1f630fdf9259cec4a14913127dfd7c3b69ef72eb.md (anthropics/skills PR #1463, author rlancemartin, 2026-07-22 — “Update claude-api skill: Managed Agents July launch wave, partner pricing, tool-runner corrections”), corroborated the same day by raw/anthropic-watch-anthropic-sdk-python-tag-v0-118-0.md + raw/anthropic-watch-anthropic-sdk-typescript-tag-sdk-v0-113-0.md (both: “add support for Managed Agents model effort, initial session events, and threads delta streaming”) and raw/anthropic-watch-anthropic-cookbook-commit-c39be3a2e64d2cff678045233d7c56065b94f93e.md + raw/anthropic-watch-anthropic-cookbook-commit-995c3c880a6e0cf7a2e137ac6a373d53c87a9c8a.md (cookbook PR #792).

Four independent sources — skill docs, both SDKs, and a new cookbook — converge on the same five additions. This is the second July batch, distinct from the 2026-07-01 wave above.

The five features:

  • effort on the agent’s model object — a level string, or {"type": "<level>"}. Agent-configuration only: setting it in a per-session model override is silently ignored. This is the trap worth knowing — the per-session override path in the 2026-07-01 wave (agent_with_overrides) does not extend to effort, and it fails quietly rather than erroring.
  • Optional version on agent update — optimistic concurrency. Pass the version you read to reject an update that would clobber someone else’s write; omit it for last-write-wins (the prior, unchanged default).
  • initial_events on session create — collapses “create session” plus “send first message” into one call. Validation is all-or-nothing, and only user.message and user.define_outcome events are accepted.
  • Environment and memory-store webhooks — four environment.* events and three memory_store.* events added to the webhook surface. (The individual event names are not enumerated in the source — see Open Questions.)
  • Event deltas on per-thread streams — deltas now available on per-thread event streams, not just the session-level stream. Previews are thread-scoped: a child thread’s previews never reach the session-level stream. Anyone who built a session-level watcher expecting to see subagent previews there needs a per-thread subscription instead.

A sixth item, from the first-party announcement thread (added 2026-07-25, source raw/x-account-claudedevs-2080009523952263295.md): up to 500 skills per session, across all Managed Agents. The five features above were compiled from the skill commit, both SDKs, and the cookbook — none of which stated a skills ceiling. The @ClaudeDevs launch thread does. It also states the initial_events cap as 50 events (user_message + define_outcome), a number the commit-derived entry above left unquantified.^[the 500-skill and 50-event figures come from a first-party announcement thread as relayed by x_search, not from a fetched primary artifact — confirm against the release notes before treating either as exact]

Four corrections to previously-documented behavior. The same commit explicitly corrects behavior the claude-api skill had already documented — these supersede earlier wiki coverage (see the contradiction callouts in Week 22 digest and Week 25 digest):

  • Tool-output offload triggers at 100,000 characters (~25k tokens), not 100K tokens — and it covers built-in tools, not MCP alone. Roughly a 4× lower threshold than previously documented, on a wider tool surface.
  • system.message works on four models (not one), checks only the primary model, appends system context rather than replacing the prompt, and is accepted during a requires_action idle when it trails a tool result in the same request.
  • Vault-to-MCP credential matching is normalized, not byte-exact: scheme and host are lowercased, default ports and trailing slashes stripped. A credential that previously looked like it “should” match but didn’t may now match.
  • A fourth correction line beginning “Multiage…” is truncated at the source feed — see Open Questions.

Worked example — subagent live-streaming cookbook (anthropics/claude-cookbooks, commit c39be3a2, merged as PR #792 cj-ant/watch-subagents-live in 995c3c88, 2026-07-22, author cj-ant): a new notebook that streams a coordinator and its subagents in real time, exercising four of the five features at once — per-thread event deltas, initial_events on session create, per-agent model effort, and versionless agent updates. Ships with a registry entry, authors entry, and README row. This is the reference implementation for anyone building a live multi-agent UI on Managed Agents.

SDK floor: Python v0.118.0 / TypeScript sdk-v0.113.0 (both 2026-07-22, version-locked as usual). See Anthropic SDK Releases.

August launch wave — budgets, advisor, repo skills, geo pinning (2026-08-05)

Source: raw/anthropic-watch-skills-commit-f17010c9bb483898c1d9c9f42dde2b3a98889434.md (anthropics/skills PR #1532 — “Update claude-api skill: Managed Agents August launch wave”, captured 2026-08-07), corroborated by raw/anthropic-watch-anthropic-cookbook-commit-215d95722a18105cdcee2026f840eeae93f1330d.md + -f65eb122… (cookbook PR #811, four new notebooks) and raw/anthropic-watch-anthropic-sdk-python-tag-v0-121-0.md + raw/anthropic-watch-anthropic-sdk-typescript-tag-sdk-v0-116-0.md (both: “add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub”).

The same four-source convergence pattern as the July waves — skill docs, cookbook, both SDKs — for an August 5 launch wave. The headline is spend control: Managed Agents now has a hard, enforced budget ceiling at both the session and deployment level.

Session budgets. A budget object at session create, denominated as a minor-unit cents string. When the ceiling is reached the session pauses (budget_reached) rather than failing or silently continuing — and it resumes when you change or remove the budget. A session.usage event streams consumption, and a settle-event allowlist governs which events settle against the budget. For multiagent sessions the cap is shared across the roster, not per-agent.

This is the missing primitive for unattended agents. The token economics primer records a yes/no question that routed to deep research and cost 4M+ tokens; a budget ceiling is the structural answer to that class of incident, and pause-not-kill semantics mean the run is recoverable rather than lost. Note the interesting design symmetry with the community-built Cairn multisig spend gate — both make the money boundary a hard external constraint the agent cannot argue its way past, rather than an instruction in a prompt.

Deployment budgets. The same budget object attaches to deployments, and is copied onto each session the deployment fires. Clearable and re-addable. This is the one that matters for the scheduled/cron deployments added in W25 — a runaway scheduled agent previously had no ceiling.

Inference geo pinning. inference_geo on the agent’s model object, with a per-session override. Two constraints stated: roster uniformity (a multiagent roster must agree on geography) and never grandfathered — an existing agent does not inherit a pin retroactively. For data-residency-constrained buyers this is the setting that makes Managed Agents usable; compare the Bedrock path documented above, which achieved residency by changing provider rather than by pinning.

Skills from a GitHub repository. Root .claude/skills discovery at session start, cloud sandboxes only, and the skill docs ship an explicit trust-boundary warning with it. Read that warning as load-bearing: auto-loading executable skill definitions from a repo at session start means the repo is now part of the agent’s trust boundary. This is the hosted-side analogue of the archive-plugin-source supply-chain question raised in Week 32, and the same posture from Agent Skills Overview applies.

Advisor as a first-class roster entry. A {type: "advisor", model} entry in the multiagent roster, with a reserved anthropic.advisor thread and a choice of plaintext vs redacted delivery. The advisor tool gains max_uses, max_tokens, and caching options, plus an error result variant. This promotes the pattern documented in The Advisor Strategy from a server-side tool you call into a named member of the agent roster.

Multiagent guidance — an explicit ladder. The skill now carries when-to-use guidance: start with self, add cheaper workers, then dedicated specialists. That is a cost-shaped escalation ladder, and it is the first time the first-party docs state the ordering rather than leaving roster design to the reader. Delegation tools documented alongside it; docs URL renamed.

Six corrections to previously-documented behavior:

  • Agent versions are sequential integers (relevant to the optimistic-concurrency version field added in July).
  • Files API uploads take a purpose param.
  • stop_details refusal categories are an open set — do not exhaustively switch on them.
  • Sonnet 5 added to the prefill-removed list — see Claude Sonnet 5.
  • vault_ids is create-only on sessions — it cannot be changed after session creation.
  • Deployments gain an update endpoint (previously create/delete only).

Worked examples — four new cookbook notebooks (anthropics/claude-cookbooks, PR #811, merged 2026-08-07): cap session spend with budgets; consult an advisor mid-session; use skills from a mounted GitHub repo; pin inference geography. The existing metering and coordination notebooks were updated to build on the same features, plus registry and README entries.

SDK floor: Python v0.121.0 / TypeScript sdk-v0.116.0 (both 2026-08-07). Two notes from the same releases, outside the Managed Agents surface: the mid-conversation-tool-changes-2026-07-01 beta landed in both SDKs (the Platform beta announced alongside Opus 5 — swap available tools mid-conversation without invalidating the prompt cache), and retired Claude Opus 4.1 models were removed from both SDKs.

Key Takeaways

  • Managed Agents is the hosted, turnkey option for running Claude agents — you skip the infrastructure entirely
  • Natural language or YAML definitions mean non-engineers can define agent behavior
  • OAuth is built in, which removes one of the hardest parts of agent-to-service integrations
  • At 58-100+/month depending on token volume — compare with self-hosted agents on Railway/Fly/similar platforms at ~$5/month
  • Advanced features (memory, multi-agent, self-eval) are in limited preview — expect these to expand
  • Requires the managed-agents-2026-04-01 beta header on all API calls

[YouTube field-test signal — Nate Herk 2026-04-27] Hands-on test of the Managed Agents Console (raw/I_Tested_Claude_s_New_Managed_Agents..._What_You_Need_To_Know.md) surfaced operator-perspective findings the docs don’t lead with: (1) No Claude subscription required — a $5 minimum top-up on an API key is the only entry barrier (lower than Claude Code’s Pro/Max subscription), explicitly positioned as the path for chat-only users who never touched Code or Cowork. (2) Five-step Console flow: agent → environment → MCP server connections → credential vault → test run — credentials live in vaults that can be shared across team members, OAuth flow auto-handled. (3) Guided Edit caveat: describing context inside the agent chat doesn’t always update the actual system prompt (version history shows two versions identical despite chat-prompted change); the explicit “Guided Edit” button is the reliable way to mutate prompts. (4) Same toolset as Claude Code under the hood — bash / read / web search / fetch — author’s framing: “essentially the Agent SDK with a nicer wrapper.” (5) Author verdict — disappointed: “If you’re already in Claude Code this isn’t much. If you’re chat-only and never used Code or Cowork, this is a huge value-add.” Operator decision rule = chat-only users → Managed Agents; existing Code users → stick with Code/Cowork unless you need cloud sandbox + team-shared credential vaults.

  • Notion-as-managed-agent-host pattern noted: teams drag Notion tasks to a different status column, the connected Claude agent picks them up and processes — turns Notion into a queue surface, no agent UI required.

[Reddit signal — r/ClaudeCode 2026-05-10] Adjacent shipment — Anthropic financial-services reference repo. github.com/anthropics/financial-services (raw/reddit-1t9p3ho.md, 315 score / 50 comments) ships 10 prebuilt workflow agents that run either via the Claude Cowork plugin or the Managed Agents API — same agent definitions, two execution surfaces. Concretizes the “Managed Agents as the substrate for vertical-domain reference repos” thesis. The 10 agents cover the major financial verticals (investment banking, equity research, private equity, asset management):

  • Pitch Agent — fully branded pitch decks from comps, precedent transactions, LBO analysis
  • Meeting Prep Agent — pre-meeting briefing packs
  • Market Researcher — sector/theme → industry overview + competitive landscape + peer comparison + idea short list
  • Earnings Reviewer — updates models from earnings calls + filings, drafts research note outlines
  • Model Builder — works directly in Excel (DCF / LBO / three-statement / comps) in real time
  • Valuation Reviewer — aggregates GP packages, runs valuation templates for LP reporting staging
  • GL Reconciler — identifies breaks, traces root causes, routes for approval
  • Month-End Closer — accruals, rollforwards, variance commentary
  • Statement Auditor — validates LP financial statements pre-distribution
  • KYC Screener — parses onboarding documents, runs rules-based checks, flags inconsistencies Sister to the cookbook coverage of multiagent + outcomes — both ship May 2026 on the same Managed Agents API surface; cookbook is generic patterns, financial-services is the first vertical-specific reference repo from Anthropic.

[Community walkthrough signal — Ralph (chartered accountant, ex-private-equity London), 2026-05-22] Third-party YouTube walkthrough (raw/How_AI_Now_Does_My_Stock_Research_-_Claude_s_New_Finance_Agents_Full_Install.md) reframes the financial-services repo as a retail-investor surface: install path is Cowork → Customize → Browse Plugins → Personal → Add marketplace from GitHub (anthropics/financial-services repo URL), then install Financial Analysis, Equity Research, Earnings Reviewer, and Market Researcher individually. Two demoed slash-commands: /morning note on Apple (earnings reviewer pulls filings + transcripts + news into a structured brief) and /screen healthcare Europe stocks (equity research returns top names with reasoning). Load-bearing clarification for retail users: the plugins do not require paid FactSet, Bloomberg, or CapIQ connectors — Claude retrieves the underlying data from official 10-K filings directly. Paid data-connector subscriptions are only needed for self-updating reports keyed off live API price feeds.

[Anthropic announcement — 2026-05-11] Claude Platform on AWS GA. Managed Agents now distributable on AWS infrastructure with AWS authentication, billing, and commitment retirement (raw/reddit-1ta7p4n.md, ClaudeOfficial 104 score). Same-day SDK support shipped via `anthropic-sdk-python` v0.101.0 + `anthropic-sdk-typescript` aws-sdk v0.3.0. Operates as a separate distribution from Amazon Bedrock — Anthropic operates the AWS service directly, ships features same-day as native API. Bedrock remains available for teams needing AWS-as-data-processor (strict regional residency, AWS-only processing). See W20 release digest for full context.

[Anthropic skills doc fix — 2026-05-17] Managed-Agents API reference: model shape correction. Commit 6a5bb06 in anthropics/skills (PR #1145, author rlancemartin) corrects the documented shape of the model field on agent create: it accepts {id, speed}, not {type: "model_config", id, speed}. The corrected shape aligns with what’s documented elsewhere in managed-agents-core.md and the request-body table. If you wired a Managed Agent create request from a draft of the reference that included the type: "model_config" wrapper, drop the wrapper.

[Anthropic cookbook — 2026-05-13] CMA Sessions API as MCP server + Linear stateless webhook bridge. Two new cookbook templates ship the off-the-shelf integration shapes for driving Managed Agents from external surfaces: (1) a thin MCP server (stdio + Streamable HTTP + bearer auth) wrapping the Sessions API so Claude Desktop / claude.ai can drive hosted CMA agents via tool calls — DIY bridge until “publish agent to claude.ai” is first-class; authoring/destructive/secret endpoints deliberately excluded so the MCP surface is read + drive only. (2) A minimal TS/Bun bridge connecting Linear’s Agent Platform to Managed Agents via CMA outbound webhooks — fully stateless (no held SSE streams, no session-map DB; session.metadata carries linear_session_id + org_id). Both proven e2e by author rlancemartin. Combined with TS sdk-v0.96.0 BetaManagedAgentsSearchResultBlock types shipped the same week, the Managed Agents production surface is now hard-wired into both the MCP ecosystem and webhook-driven third-party agent platforms. Pattern likely repeats with similar bridge templates for Slack, GitHub, Notion agents in coming weeks. See W21 Release Digest for full release-storm context and the cookbook article for implementation detail.

Try It

  1. Open the Anthropic Console and look for Managed Agents in the beta section
  2. Define a simple agent in natural language (e.g., “Monitor this GitHub repo and summarize new issues daily”)
  3. Set up OAuth credentials for any services the agent needs to access
  4. Deploy and monitor via the Console dashboard or CLI
  5. Compare the cost against self-hosted alternatives — the break-even is roughly when infrastructure maintenance exceeds $58/month
  6. AWS path: if your org has AWS commitments, install Python SDK 0.101.0 (or TS aws-sdk@0.3.0), authenticate via AWS, and target Claude Platform on AWS as the runtime — same Managed Agents surface, AWS billing.
  7. MCP bridge path (W21): install the CMA Sessions API MCP server from the cookbook to drive hosted Managed Agents from Claude Desktop or claude.ai via tool calls. Useful for teams that want operators to interact with hosted agents conversationally rather than via the Console.
  8. Linear-style webhook bridge (W21): if you run a third-party agent platform (Linear, Slack, GitHub, Notion), adapt the cookbook’s Linear template to your platform’s webhook surface. Pattern is stateless (session.metadata carries platform-specific IDs) so no session-map DB required.
  9. Put a budget on every scheduled deployment (August wave). Deployment budgets copy onto each fired session, so one setting caps every unattended run. On Python v0.121.0 / TS sdk-v0.116.0 or newer. Pause-on-reach means you lose nothing but the overrun — change or remove the budget to resume.
  10. If you have data-residency obligations, try inference_geo before reaching for Bedrock. Pinning is cheaper than changing provider. Two gotchas: the whole multiagent roster must agree, and existing agents are never grandfathered into a pin — set it explicitly.
  11. Before mounting a GitHub repo for skills auto-loading, treat the repo as part of the agent’s trust boundary. Discovery is at session start from root .claude/skills, cloud sandboxes only. Anyone with commit access to that repo can change what the agent will execute.

Open Questions

  • What are the compute limits per agent (CPU, memory, network)?
  • How does checkpointing work — can you resume a failed agent mid-task?
  • What’s the SLA for uptime on managed agent infrastructure?
  • When will memory tooling and multi-agent orchestration move to general availability?
  • Which four models accept system.message? The 2026-07-22 skills commit says “four models” without naming them. The prior wiki claim was Opus 4.8 only; that is now known wrong, but the correct roster is unconfirmed.
  • Which environment.* / memory_store.* webhook events shipped? The commit gives counts (four and three) but no event names.
  • What are the valid effort levels on a Managed Agent’s model object? The commit states the shape ("<level>" or {"type": "<level>"}) but not the enum. Claude Code’s ladder is low / medium / high / xhigh / max — whether Managed Agents uses the same set is unverified.
  • The fourth correction in the July skills commit is truncated at the source. The anthropic-ecosystem-watch feed cuts off mid-word at ”- Multiage…” — almost certainly a multiagent-related correction, but the claim itself is unrecoverable from that raw file. Now re-fetchable: the 1,500-char cap that caused this truncation was fixed on 2026-07-25 (cap raised to 20,000, cuts land on word boundaries with a […truncated] marker), and the August commit captured in full confirms the fix is working. Re-fetch PR #1463’s body to close this. Do not assume the August wave’s “Multiagent: new when-to-use guidance” line is the missing July text — they are different commits.
  • Partner pricing. The July commit title names “partner pricing” as a third change area alongside the Managed Agents wave and tool-runner corrections; the truncated body never reaches it. Unknown what changed. Same re-fetch closes it.
  • What currency are session budgets denominated in? The skill says “minor-unit cents string” — presumably USD, but the unit is not named, and inference_geo pinning implies non-US deployments.
  • What are the valid inference_geo values? The field is documented but the enum of supported geographies is not given.
  • Does the session budget count cached-token reads at the discounted rate? The settle-event allowlist implies not every event settles against the budget, but the allowlist contents are not enumerated — which matters for estimating how close a run is to its ceiling.
  • Is the “start with self, add cheaper workers, then dedicated specialists” ladder backed by measured data? It is stated as guidance in the skill docs with no cited benchmark.

Graph View

Backlinks