How to check Managed Agents security settings with /claude-api managed-agents-secure in Claude Code

Claude Code 2.1.304 (October 19) added /claude-api managed-agents-secure. It compares a Claude Managed Agents agent's settings with Anthropic's published security guide. It doesn't change anything, so it's safe to run against an agent already in production.

1. Check that Claude Code is 2.1.304 or later.

claude --version

1. Type the command at the Claude Code prompt.

/claude-api managed-agents-secure

1. Read the result against the security guide. These are the settings it lists, most important first.

• Use a cloud environment unless your tools must run on infrastructure you control.
• Set the environment's networking.type to limited and list only the hosts the agent needs in allowed_hosts. A create request that omits networking might get unrestricted, so set it in every request.
• Keep credentials in vaults and inject them into request headers only.
• Put an allowed_domains list on each of web_fetch and web_search.
• Set permission_policy to always_ask on tools whose changes you can't undo.
• Set default_config.enabled to false on the toolset, then enable only the tools the agent needs.
• Put a budget sized to the expected cost on each session and deployment.

Apply any fixes yourself. To build a new agent from scratch, use /claude-api managed-agents-onboard from the same skill.