Skip to content

Can I run Claude Managed Agents on Vercel?

Content Engineer
Articles

Yes. You can run Claude Managed Agents on Vercel in two ways: build a chat interface on top of a fully Anthropic-hosted agent using Chat SDK, or run the agent's tools in your own infrastructure using Vercel Sandbox. The first option gets you a working agent chat in minutes. The second gives you full control over where tool calls execute, with credential brokering and network isolation built in.

This article explains both approaches and how it all works.

Copy link to headingWhat are Claude Managed Agents?

Claude Managed Agents are agents that Anthropic runs for you. Anthropic hosts the agent harness, session state, tool-calling loop, and execution environment. Your application creates sessions through the Managed Agents API, sends messages, and consumes an event stream of replies, tool calls, and status updates.

Because Anthropic holds the conversation state server-side, your app doesn't need its own conversation database. Every chat maps to a session, and the sessions API backs the full transcript, follow-up context, and replay.

That covers the agent itself. The remaining question is where your users interact with it and where its tools run. Both are places where Vercel fits in.

Copy link to headingOption 1: Give the agent a chat surface with Chat SDK

The fastest path is the Anthropic quickstart that pairs Claude Managed Agents with Chat SDK. Chat SDK provides the chat surface through a single type-safe handler, with adapters for the web, Slack, Teams, Discord, Telegram, and WhatsApp.

In this setup, the agent runs entirely on Anthropic's side. The tool loop, sandboxed web research, session state, compaction, and prompt caching all happen inside the session. Your Vercel-hosted app handles the interface:

  • Starting a new chat creates a session, and useChat uses the returned session ID as its thread ID

  • The conversation sidebar comes from sessions.list()

  • Transcripts replay from sessions.events.list()

  • Follow-up questions work because the session holds the research context server-side

Replies stream token by token on the open HTTP response, while tool calls and thinking indicators stream on a separate activity feed. Restarting your server loses nothing, since the sessions API is the entire conversation store.

The quickstart builds a research analyst in a browser chat. To get started, clone the repository, run npm run setup once to provision the agent and its environment, and start the dev server. From there, you can swap the web adapter for Slack or another platform by adding an adapter in src/bot.ts.

Before deploying, replace the demo getUser function with real authentication and raise proxy idle timeouts, since research turns can hold a response open for minutes. The full guide covers both, plus troubleshooting.

Copy link to headingOption 2: Run the agent's tools in Vercel Sandbox

Managed Agents also supports self-hosted environments, where Anthropic hosts the brain and you supply the hands. When Claude calls a tool, something on your side has to run it and post the result back. The Vercel Sandbox guide shows how to make Vercel that something, split across two planes:

  • Control plane: a Vercel Function receives session.status_run_started webhooks from Anthropic and spawns one sandbox per session

  • Compute plane: a Vercel Sandbox microVM attaches to the session's event stream, executes tool calls like run_shell and read_file, posts results back, and exits when the session ends

Each session gets a fresh, isolated microVM. The security model is the standout feature: the Anthropic environment key never enters the VM. Vercel Sandbox's credential brokering injects it at the firewall on outbound requests, scoped to that session's paths only. Even if a prompt injection or compromised tool ran console.log(process.env) inside the sandbox, there would be no key to leak, and requests to other sessions or work/poll would be rejected.

Sandboxes boot from a prebuilt snapshot, so there's no dependency install on each spawn. The default network mode becomes deny-all once you set a policy, which gives you egress control when the runner processes private data.

Copy link to headingWhen to choose each approach

Use the Chat SDK approach when Anthropic's hosted execution environment covers your needs. The quickstart's research analyst relies on web search, web fetch, and file tools, all running on Anthropic's compute. You focus on the interface, authentication, and which platforms to support.

Use the Vercel Sandbox approach when:

  • Tools touch private infrastructure: your runner needs to reach internal databases, private APIs, or services Anthropic's compute can't access. Sandboxes have direct, low-latency egress to your AWS workloads.

  • You handle per-customer credentials: in a SaaS context, each user has their own API tokens. Credential brokering injects them at the firewall instead of exposing them as environment variables.

  • You need egress control: a domain allowlist with deny-all as the default prevents exfiltration when agents process sensitive data.

The two approaches also combine. You can serve a Chat SDK interface from the same Vercel project that runs your sandbox control plane, giving users a chat surface while tool calls execute in your own microVMs.

Copy link to headingFrequently asked questions

Does Vercel host the Claude model itself? No. Anthropic hosts Claude, the tool-calling loop, and session state. Vercel hosts your chat interface, your webhook control plane, and optionally the sandboxed compute where tool calls execute.

Do I need a database for conversation history? Not with Managed Agents. Sessions are the conversation store. The Chat SDK quickstart holds no state of its own, and every transcript comes back from the sessions API after a restart.

How do long-running agent responses work on Vercel? Research turns can keep a response open for minutes, so raise idle timeouts on any proxy in front of /api/chat. For durable polling, multi-turn conversations, and full event replay in production, pair the setup with Vercel Workflows, which polls session events and writes them to a durable stream.

Is the environment key safe inside a sandbox? The key never enters the sandbox. Credential brokering injects it at the firewall on outbound requests scoped to the current session and work item, so a compromised sandbox can't extract it or act on other sessions.

What do I need to get started? For Chat SDK: Node.js 22.9 or later, an Anthropic API key, and an organization with Managed Agents access. For Vercel Sandbox: a Vercel account with Sandbox access, an Anthropic account with environments access, Node.js 22+, and the Vercel CLI.

Copy link to headingNext steps

Ready to deploy?

Start deployingTalk to an expert