ai-agents · claude-tag · architecture · agent-sdk · xpr

Claude tag or your own hosted agent: how to choose

Anthropic's Claude tag puts an agent in your Slack with no setup. A self-hosted Agent SDK deployment takes real work. This post helps you decide which one is the right fit for you

Midway through writing this series, Anthropic launched Claude tag - tag @Claude in a Slack channel, and an agent picks up the task, works through it, and reports back in the thread. This is exactly like the Shikau agent this series describes - in a product form.

So the obvious question: should you still build your own? This post is meant to help you decide if you should build your own agent or use Claude Tag.

What Claude tag gets right

It is worth saying first that Claude tag validates most of the architecture this series argues for. It lives in Slack threads. Access is scoped per channel, with separate identities per use case. Admins set spend limits per organization and per channel, and get activity logs. That is the same as our setup - channel as the access boundary, thread as the workspace, spend tracked centrally. If you adopt Claude tag, most of this series still applies; you will be making the same scoping and approval-gate decisions, just in a console instead of a config file.

It also removes real time consuming work - no EC2 instance, no nginx, no systemd, no Slack app registration, no webhook signature code. For step one - a capable general assistant in your team's channels - it is genuinely zero setup.

Where a self-hosted agent still wins

It can act inside your environment. This is the big one. Our agent restarts services on the box it runs on, pulls logs from our Elastic Beanstalk environments with an IAM role, reads a local checkout of our source code, and calls internal tools that are not reachable from the internet. A cloud-hosted agent can only reach what you expose to the cloud. For anything behind your VPC boundary - internal databases, private services, the machines themselves - a hosted agent either cannot do it or requires you to open a path you would rather keep closed.

The data controls. With Claude tag, the connectors you attach - your code, your tickets, your docs - flow through Anthropic's hosted environment. That is fine for plenty of teams and workloads. It was not fine for us for production logs, source code etc. On our own instance, the credentials sit on our box, egress is limited by our security group, and every prompt and tool call lands in our own logs.

You choose the parts. Our image tools call specific fal.ai models; our debugging agent is forced through a curated error-pattern file before it may access source code. That level of harness design - which model for which job, which steps are deterministic, what the agent must check first - is easier to set up with your own custom agent. Claude tag will let you connect tools, but the deeper the workflow, the more you are building that harness anyway.

Plans and billing. Claude tag is in beta for Team and Enterprise plans, billed by usage against admin-set limits. You are billed at API pricing. A self-hosted Agent SDK deployment runs from plans a small company is more likely to already have. Anthropic does have plans to move the Agent SDK usage to API pricing but for now, it is included in your subscription plan which makes this way cheaper.

Where Claude tag wins

  • You don't need to have or maintain your own EC2 box.
  • You don't have a need for the agent to work with your cloud infra or inside your cloud environment.
  • You want the ambient behavior - Claude tag can watch a channel and follow up on unresolved tasks on its own, which our reactive-plus-cron setup only approximates.
  • You want to trial the whole idea this week. In fact, this is the right first step for most teams now: run Claude tag in one channel, learn what your team actually asks an agent to do, and decide from evidence whether you need the self-hosted version.

The short version

Claude tagSelf-hosted (Agent SDK)
SetupMinutesDays
Runs inAnthropic's environmentYour AWS account
Can act on your infraOnly what you exposeYes, behind your VPC
Credentials liveIn connectorsOn your box
Audit logsAdmin consoleYour CloudWatch, your format
PlansTeam / Enterprise betaAll plans
BillingUsage billed at API pricing, against admin-set spend limitsIncluded in the subscription plan (a move to API pricing was announced, then paused)
Custom tools and modelsConnectorsAnything you can code, any vendor
MaintenanceNoneA real, small amount

The choice really hinges on whether your agent's job stops at reading and writing SaaS data, or extends into acting on systems only you can reach. You can always start with Claude tag and keep this series around for the harness decisions - those are still applicable for both scenarios.