Run the agent, keep the data: self-hosted sandboxes and MCP tunnels, explained for small teams

The thing blocking your agent from production usually isn't the model — it's that the data can't leave the building. Anthropic's May 19 release splits the agent loop from tool execution and reaches private systems through an outbound-only tunnel. Here's what each piece actually is, whether you need it, and what to do if you don't have an enterprise contract.