MCP Tunnels Ship: Your Agent Can Now Reach Internal Systems Without a Public Endpoint
Anthropic just shipped MCP tunnels and self-hosted sandboxes for Claude Managed Agents. For the first time, an agent can reach your internal Postgres, private APIs, and ticketing systems through a single encrypted outbound connection — no inbound firewall rules, no data leaving your perimeter.
NeuroX AI · May 22, 2026
Worldwide AI spending is forecast at $2.59 trillion in 2026 — a 47% year-on-year increase — and the majority of that budget is still stuck in pilot. The model isn't the bottleneck. Data sovereignty is.
Anthropic shipped two features this week that gut both common objections. MCP tunnels (limited research preview) let a Claude Managed Agent reach internal databases, private APIs, and ticketing systems through a single outbound connection with end-to-end encryption — no inbound firewall rules, no public endpoint exposed. Self-hosted sandboxes (public beta) push tool execution entirely into your own infrastructure; Cloudflare, Daytona, Modal, and Vercel are all supported. Agent orchestration stays on Anthropic's side. Sensitive files never leave your perimeter.
The London developer event Anthropic ran this week made the direction explicit. Boris Cherny described hand-written code becoming craft — "like buying your veggies at a farmer's market." The default is flipping. Agents run the loops. Engineers scope the work, wire the evals, review the output.
That handoff only works if the agent can actually see your data. MCP tunnels close that gap without the six-month security review that a VPN or public API gateway would require. The teams that move in the next 30 days will have working pipelines while the teams still debating architecture are writing their first RFC.