SoftTech AI Registry
Anthropic · Claude Managed Agents

MCP tool execution

A Claude Managed Agent calls tools on remote MCP servers declared in its configuration (Managed Agent -> MCP toolset -> remote MCP server -> MCP tool). The Managed Agents runtime executes MCP calls server-side rather than returning them to the customer's application. Excludes the built-in agent toolset, client-executed custom tools, the Messages API MCP connector, Claude Code and MCP tunnels (research preview).

Recorded characteristics

Function
Anthropic provides the agent loop: "Claude autonomously runs tools and streams back results." An agent is created with an mcp_servers array (type, unique name, url) and a matching mcp_toolset entry; MCP calls appear as agent.mcp_tool_use events generated during the session. MCP toolsets are server-executed by the Managed Agents runtime. By contrast, custom tools are executed by the customer's application: the session emits agent.custom_tool_use and waits for user.custom_tool_result; custom tools are not evidence for this capability. Anthropic's GitHub MCP examples configure add_issue_comment (allowlist) and delete_repository (used as a denylist example, not a recommendation), establishing that the mechanism may expose state-changing and destructive external tools. Not every MCP tool changes state.
Data access
Determined by the tools the configured remote MCP servers expose and by the credentials attached to the session. No data scope beyond configured servers is attributed.
Actions
Can take actions
External actions
Yes
Human confirmation
Conditional
Permission basis
Separate permissions
Administrative control
Tool enablement: all tools exposed by an attached MCP server are enabled by default; default_config sets toolset-wide behaviour and configs entries (name, enabled, permission_policy) override individual tools; an allowlist sets default_config.enabled to false and enables selected tools; a denylist disables selected tools. Under the default enablement model a newly exposed tool may become available unless configuration restricts it. Permission policies: always_allow (executes automatically without confirmation), always_ask (the session pauses and waits for approval before executing), auto (the server evaluates each call and runs it, denies it, or pauses for approval). MCP toolsets default to always_ask, which Anthropic says ensures new tools added to an MCP server do not execute without approval; policies can be set for the toolset and overridden per tool. Approval flow: each agent.mcp_tool_use event carries evaluated_permission (allow, ask or deny); a call needing approval produces session.status_idle with stop_reason requires_action listing the blocking event IDs; the session waits; the application sends user.tool_confirmation with result allow or deny and an optional deny_message; allow lets the call proceed, deny prevents it. Calls denied by the server under auto cannot be overridden. Anthropic says: if a person must review a tool's calls before they run, configure always_ask; auto is not a human checkpoint.
Default state
Conditional
Availability
External MCP execution requires a Managed Agent with a supported Claude model, a declared remote MCP server and matching MCP toolset, an enabled tool, an environment and session, a matching vault credential where the server requires authentication, a permission policy, and approval where always_ask applies. Default tool enablement within an attached server does not give a new agent external authority. Anthropic's lifecycle term is Beta (all endpoints require the managed-agents-2026-04-01 beta header); mapped to the Registry value preview. Access is enabled by default for all API accounts. MCP tunnels are in a narrower research preview and are not required for ordinary remote MCP servers. No GA date.
Licensing
Claude API account and key required; no separate plan terms are recorded.
External model or provider
Anthropic. The agent creator selects a supported Claude model (Claude 4.5 and later); no single fixed model.
Limitations and uncertainty
Permission basis is recorded as separate_permissions: MCP tools execute using credentials stored in Anthropic vaults and attached to sessions through vault references. Anthropic describes vaults as associated with end users, but vaults are workspace-scoped and the Registry cannot establish from current evidence whose real-world authority every stored credential represents. Vault credentials may represent different real-world principals; the Registry classifies the documented authority mechanism (separately configured stored credentials) at the level current evidence supports, without establishing runtime binding to the currently invoking human. Established mechanism: session -> vault_ids -> stored credential (static_bearer or mcp_oauth) keyed to the MCP server URL -> injected automatically on connection; credential values are sensitive, write-only and never returned; Anthropic can refresh mcp_oauth tokens. Not user_permissions (per-end-user vaults are a convention; any workspace-authorised API key can reference a vault; approval is a separate dimension from execution identity); not dedicated_agent_identity (the agent does not own the credential); not mixed (no documented alternative identity modes). Human confirmation caveat: approvals are submitted through the API by the customer's application; Anthropic does not establish that every always_ask approval originates from a human, so conditional describes the supported human-review configuration, not an enforcement guarantee. Unresolved: real-world authority behind vault credentials; internal decision process for auto; explicit presentation of tool arguments to a reviewer (tool input is in the event; UI not verified); no direct Managed Agents statement that tool descriptions guide tool choice (not imported from the Messages API connector); server/tool limits not established; live GitHub MCP tool catalogue not independently confirmed; Beta end date; workspace credential-sharing implications. Excluded: built-in agent_toolset_20260401 (bash, read, write, edit, glob, grep, web fetch/search in Anthropic's sandbox); custom tools; Messages API MCP connector (possible future candidate: Anthropic -> Claude API -> MCP connector tool execution); Claude Code.

Evidence