Sandboxes, MCP Tunnels, Stainless: How Anthropic Is Pulling Ahead in Agentic AI

Forty-eight hours. Three announcements. One clear signal: Anthropic is no longer just trying to build the best model. The Code with Claude London conference on May 19, 2026, preceded the day before by the Stainless acquisition announcement, confirmed a broader ambition: assembling the complete agentic stack. Self-hosted sandboxes, MCP Tunnels, and the Stainless acquisition: three pieces of the same puzzle that concretely change how enterprises will deploy agents in production.

Self-hosted sandboxes: execution leaves Anthropic’s infrastructure

Until now, running a Claude agent with tools (file reading, code execution, network calls) meant letting that execution happen inside Anthropic’s infrastructure. For many enterprises with compliance requirements, that was a hard blocker.

Self-hosted sandboxes change the equation. The principle is straightforward once you separate two distinct layers. The agent loop — context management, reasoning, orchestration of successive calls — stays on Anthropic’s side. But the actual execution of tools, the files the agent reads, the code it runs, the network requests it makes, happens inside the client’s own infrastructure. Code execution, the filesystem, and network egress stay within your perimeter; only the tool inputs and outputs the model needs to see flow to Anthropic.

For teams that don’t want to manage this execution layer themselves, Anthropic offers managed providers in public beta: four at launch (Cloudflare, Daytona, Modal, and Vercel), around ten today (E2B, AWS Lambda, GKE Agent Sandbox, Blaxel…). Each handles isolation and scalability without requiring you to maintain the plumbing.

A few limitations worth noting for the current version: self-hosted sandboxes are not yet available on Claude Platform on AWS, and the Memory module is not yet supported in this mode.

The practical implication for builders is direct. Entire sectors — banking, healthcare, defense, government — could not seriously consider running sensitive data through a third-party cloud environment. With this clean separation between orchestration and execution, that barrier disappears. Agents become deployable wherever compliance requires it, without sacrificing model capabilities.

The use cases that become realistic for regulated enterprises are numerous. A pharmaceutical company can deploy a clinical data analysis agent without that data leaving its servers — something previously incompatible with GDPR requirements and sector-specific regulations like HIPAA. A law firm can have Claude analyze confidential contracts without violating attorney-client privilege. An industrial company can run agents on its formulas, manufacturing plans, or pending patents — assets where any leak represents a major strategic loss. A hospital can finally consider automating workflows around patient records without going through a lengthy exception process with its security team.

What changes structurally is the conversation in enterprise sales. Until now, convincing a CTO or data protection officer to adopt Claude agents consistently ran into the question of data perimeter. That question now has a verifiable technical answer, not just a contractual one.

MCP Tunnels: your private systems become agent tools

The MCP protocol (Model Context Protocol) allows agents to connect to external data sources and tools. The problem until now: for a cloud agent to reach your MCP server, that server had to be accessible on the internet. For an internal database, a private API, or a ticketing system behind a firewall, the only options were either exposing the infrastructure or giving up on the integration.

MCP Tunnels, announced in research preview, solves this problem without workarounds. The mechanism relies on a lightweight gateway deployed on the client side, inside your private network. This gateway establishes an outbound encrypted connection to Anthropic. Traffic flows through this tunnel: the cloud agent can query your internal systems, and your firewall never allows an unauthorized inbound connection.

Use cases that become immediately realistic: an agent querying an internal PostgreSQL database to generate reports, an agent connected to your Jira or Linear instance without an exposed proxy, calls to internal billing or CRM APIs that were never meant to be public-facing.

The feature is currently available on request. Research preview access involves case-by-case selection — this is not yet a general rollout.

The bottom line: the dilemma of “either you expose it or you don’t integrate it” disappears. Teams that had ruled out Claude agents because their critical data lives behind a firewall now have an integration path that does not compromise their security posture. That is a massive unblock for enterprise use cases, which represent the bulk of the real value at stake.

Stainless: the strategic move that weakens competitors

Of the three announcements, the most discussed is also the most strategically interesting. Anthropic acquired Stainless for more than $300 million according to The Information (the amount was never officially confirmed), announced on May 18.

Stainless is a New York startup founded in 2022 by Alex Rattray, formerly of Stripe. Its product: automating the generation and maintenance of SDKs from OpenAPI specifications. In practice, if you have a well-documented API, Stainless produces client libraries in multiple languages, keeps them updated with every API change, and guarantees a consistency that human teams struggle to maintain over time.

What makes this acquisition particularly significant: Stainless’s current clients include OpenAI, Google, and Cloudflare. These companies were using Stainless to generate and maintain their own SDKs. Anthropic is shutting down the hosted service. Existing customers keep their SDKs with full rights, but the machine that produced and automatically evolved them is no longer available.

This is a dual-effect move. Anthropic gains a technology that will let it industrialize its own SDKs, accelerate their maintenance, and guarantee a consistent developer experience across all surfaces of its API. At the same time, OpenAI and Google lose access to the tool they were using to do exactly the same thing.

The technical challenge for competitors is not trivial. Internalizing this capability means hiring rare profiles who can both understand OpenAPI specifications in depth and generate idiomatic code in a dozen languages. Forking the existing Stainless code is not straightforward either: the value of the product lies in the proprietary tooling that synchronizes the API with the SDKs, not just the SDKs themselves. Finding a credible external alternative at Stainless’s level of maturity is difficult in the short term. In practice, OpenAI and Google will likely absorb the cost of more manual maintenance for several quarters, with a real risk of consistency drift between languages — particularly Python, TypeScript, Go, and Java. That kind of technical debt is invisible to end users at first, then painful as the API evolves.

This is not a defensive acquisition. Anthropic is not buying Stainless to prevent a competitor from acquiring it. It is an offensive move that creates a durable operational advantage while weakening the developer experience at its main rivals.

For a developer using Anthropic SDKs today, the change is concrete. The speed at which the official Anthropic Python and TypeScript SDKs align with new API features will accelerate. Consistency across languages will improve: fewer slightly different behaviors between the Python and TypeScript clients on features like streaming or error handling. And above all, MCP integration in the SDKs is likely to be treated as a top-tier priority, with the same rigor as core features. In short, choosing Anthropic SDKs in the coming months means choosing the platform whose developer tooling will improve the fastest.

The through line: Anthropic is assembling the complete stack

Taken separately, each of these three moves is significant. Together, they reveal a clear architecture.

Anthropic is now building three distinct layers. The brain: the LLM — Claude Opus, Sonnet, Haiku — the core of reasoning. The hands: self-hosted sandboxes, tool execution inside the client’s infrastructure. The senses: MCP and MCP Tunnels, the connection to private systems and real data. And now the developer tooling: Stainless, ensuring the SDKs that expose all of this are rock-solid.

The gap with OpenAI is no longer just about model benchmarks. It is widening across the complete agentic infrastructure. Deploying Claude agents in production in an enterprise context — with compliance constraints, internal systems, and reliability requirements — is becoming meaningfully simpler than with the competition.

For builders shipping AI products today, this is the signal to take seriously: choosing your agentic platform means choosing a stack, not just a model.