Managed Agent Control MCP

What modus-agendi/managed-agent-control-mcp MCP server does

The modus-agendi/managed-agent-control-mcp MCP server provides an MCP control layer for Claude Managed Agents hosted on Anthropic's platform. It does not define the agents themselves; instead, it lets an MCP client find existing agent definitions and related resources, create sessions, follow their activity, and interact with them during execution.

The server is intended for clients such as Claude.ai, Claude Code, Cursor, or custom MCP implementations. A client can use it to launch an agent with an initial instruction, inspect session state and token usage, retrieve activity events, continue a conversation, respond to approval requests, interrupt execution, and finish by archiving or deleting the session.

How it works

The modus-agendi/managed-agent-control-mcp MCP server sits between an MCP client and Anthropic's Managed Agents API. Outbound requests to Anthropic use the operator's ANTHROPIC_API_KEY. For HTTP deployments, clients can be required to authenticate separately using a static bearer token, an OIDC provider, or the Cognito authentication preset.

The interaction model is request-based rather than a live event stream. A typical workflow is to discover an agent, start a session, call session_get for status, and poll session_events for output or activity. The client can then send another message, interrupt the agent, or approve or deny a tool request with the appropriate session operation. This polling design matters when choosing a client or building an orchestration loop because new agent activity is not pushed directly into the chat.

Setup and configuration

Local operation requires Python support through the repository's documented uv workflow and an Anthropic API key with Managed Agents access. The repository also documents a PyPI-based uvx managed-agent-control-mcp invocation once the package is available there. The local server runs over stdio; container deployments expose HTTP, and an included Terraform module supports AWS Lambda deployment.

ANTHROPIC_BASE_URL can override the API endpoint for gateways or testing. HTTP deployments can set MCP_AUTH_MODE to bearer, oidc, or cognito, with additional variables for tokens and OIDC verification. Optional guardrails include an agent allowlist using MCP_ALLOWLIST_AGENTS_ACTIVE and MCP_ALLOWED_AGENT_IDS, plus MCP_ALLOW_DESTRUCTIVE to disable archive and delete operations.

Tools and capabilities

Resource discovery tools include agent_list, agent_get, environment_list, environment_get, vault_list, vault_get, memory_store_list, and memory_store_get. These help the client select an agent, sandbox environment, credential vault, or persistent memory store before starting a session.

Session operations cover the full control loop:

• session_start creates a session and may send its first instruction.
• session_get returns status and token usage.
• session_list lists sessions.
• session_events polls activity with cursor and type-filter options.
• session_message sends a message or continues a turn.
• session_interrupt stops or redirects a running agent.
• session_respond approves or denies a requested tool action.
• session_archive preserves history while ending active use, while session_delete removes a session.

Limitations and notes

The project is a community-maintained implementation and is not endorsed or maintained by Anthropic. The Managed Agents API is identified as beta in the repository. The Anthropic API key must have access to Managed Agents, and the server acts with the permissions of that key.

HTTP deployments should not be exposed without inbound authentication. Bearer, OIDC, or Cognito authentication protects access to the server, but it is separate from the outbound Anthropic credential. The polling model also means clients must repeatedly request session state or events instead of receiving a continuous stream.

The destructive archive and delete operations can be disabled with configuration, and agent launching can be restricted to an explicit allowlist. These controls are relevant when the server is shared by multiple MCP clients or deployed as an HTTP service.