Claude Code Web

Summary

Claude Code on the web runs coding tasks in fresh Anthropic-managed cloud virtual machines at claude.ai/code. A task can continue after the browser or laptop closes, be monitored from the web or Claude mobile app, and create a branch or pull request when finished.

• Provider: Anthropic
• Product: Claude Code on the web
• State: Research preview
• Availability: Pro, Max, and Team users; Enterprise users with eligible Claude Code seats
• Status checked: 2026-07-14

Unlike a general cloud sandbox, this is a complete Claude coding-agent workflow tied to Anthropic accounts, Claude models, and GitHub.

Problem

Local coding agents compete with the laptop for CPU, stop when it sleeps, and may access local files or credentials. Building a safe remote VM adds setup, networking, authentication, package caching, and Git integration work.

Claude Code on the web moves the agent into an isolated managed machine and handles the conversation, GitHub access, diffs, and pull requests. It is like hiring a contractor who works in the provider’s secured workshop and returns a reviewed change set instead of entering your house.

How It Works

• Fresh VM: Each session starts in a new Anthropic-managed virtual machine with a clone of the selected repository.
• Ubuntu base: Setup scripts run as root on Ubuntu 24.04.
• Tools included: Common Python, Node.js, Ruby, PHP, Java, Go, Rust, C/C++, Docker, PostgreSQL, Redis, Git, and terminal tools are preinstalled.
• Repository configuration: Project CLAUDE.md, repository-level settings, hooks, skills, agents, commands, plugins, and MCP declarations arrive through the clone.
• Cloud environment: A reusable environment defines network access, environment variables, and a setup script.
• Cached setup: Anthropic snapshots files produced by the setup script and reuses that image for later sessions. The cache rebuilds after configuration changes or roughly seven days.
• Session work: Claude edits files, installs packages, starts databases or Docker services, runs tests, and streams progress to the conversation.
• Review: The web interface shows the diff, accepts inline comments, and can create a pull request.
• Handoff: A cloud session can be pulled into the local Claude Code command-line tool with Teleport. New cloud tasks can also be launched from the terminal.
• Parallelism: Multiple web tasks run in separate sessions and consume the account’s shared Claude usage limits.
• Auto-fix: With the Claude GitHub App, Claude can monitor a pull request for CI failures and review comments and push clear fixes.

Security Boundary

• Separate VM: Each session is isolated from the user’s computer and other sessions through an Anthropic-managed virtual machine.
• Limited network by default: The default Trusted setting allows a documented set of development and package domains. Users can choose no outbound access, a custom domain allow-list, or full internet access.
• Anthropic channel remains: Even with network set to None, Claude Code still communicates with Anthropic’s API, so data can leave the VM through the model channel.
• Security proxy: HTTP/HTTPS traffic passes through an Anthropic proxy that provides filtering, rate limits, abuse controls, and a DNS-level hostname audit trail.
• Git credential proxy: Actual GitHub tokens and signing credentials remain outside the sandbox. Scoped credentials inside the guest are translated by the proxy, and push is restricted to the current working branch.
• Fresh clone: Local home files and locally installed tools do not automatically enter the session.
• Repository instructions are trusted input: Hooks, MCP declarations, plugins, and setup scripts committed to a repository can execute in the cloud environment. Review them before running an unfamiliar branch.
• Environment secrets: There is no dedicated secrets store yet. Environment variables and setup scripts are visible to anyone who can edit that environment and are readable inside the session.
• Sharing risk: Pro and Max sessions can be made public to any signed-in Claude user. Repository-access verification is not enabled by default for these public links; users must enable it and inspect the transcript for private code or credentials.
• Cloud custody: Code, conversation, cached environment files, and session output are processed and stored on Anthropic-managed infrastructure under the account’s data terms.

Platforms

• User access: Modern web browser, Claude mobile app for monitoring, Claude desktop, or the Claude Code command-line tool for handoff.
• Cloud guest: Managed Linux/Ubuntu environment only.
• Repository host: GitHub has the complete clone/push/pull-request path. GitHub Enterprise Server is supported for Team and Enterprise plans.
• Other Git hosts: A local Git repository can be bundled and uploaded, including tracked uncommitted changes, but non-GitHub sessions cannot push results back without GitHub authentication.
• Local command line: macOS, Linux, and Windows environments supported by Claude Code can create or receive cloud sessions when signed into the same Claude account.
• Not macOS: It does not provide a macOS guest, Xcode, or Simulator.

Setup

1. Use an eligible Claude account and open claude.ai/code.
2. Connect GitHub through the Claude GitHub App or sync an existing GitHub CLI token through Claude Code’s web setup.
3. Select a repository and submit a coding task.
4. Optionally create a cloud environment with a network level, allowed domains, setup script, and needed variables.
5. Review the live conversation and resulting diff.
6. Ask for tests, leave inline feedback, create a pull request, or move the session to a local terminal.

For a repository without GitHub access, the command-line tool can bundle and upload it. Bundles include Git history, branches, and tracked uncommitted changes; untracked files are omitted. A full bundle must fit under 100 MB before Claude falls back to reduced forms.

Network And Credentials

• Network modes: None, Trusted, Full, and Custom.
• Trusted mode: Allows Anthropic services, Git hosting, common container and language registries, major cloud SDK endpoints, development tools, and monitoring services.
• Custom mode: Accepts exact domains and wildcard subdomains, with an option to retain the default list.
• GitHub path: Git operations use a separate proxy regardless of the selected general network mode.
• GitHub scope warning: A cloud session can access every repository visible to the connected GitHub account, not only repositories where the Claude GitHub App is installed. Restriction must be enforced through GitHub account or team membership.
• Built-in GitHub tools: Issues, pull requests, diffs, and comments use the proxy without placing the real token in the guest.
• Raw GitHub CLI: Installing gh and supplying a personal token makes that token readable inside the session and loses the proxy’s no-token-in-guest benefit.
• MCP connectors: Enabled remote connectors route through Anthropic infrastructure and do not require their hosts in the environment allow-list. Remove connectors not needed for the task.
• Static secrets: Environment variables are the current option and are visible to environment editors and guest code.
• Interactive cloud login: Browser-based service login such as AWS SSO is not supported inside cloud sessions.

Pricing

Official prices checked 2026-07-14:

• Pro: $20monthly,or$200 billed annually (about $17 per month). Includes Claude Code.
• Max: $100monthlyfor5\times Prousageor$200 monthly for 20× Pro usage.
• Team standard: $25perseatmonthlyor$20 per seat monthly when billed annually.
• Team premium: $125perseatmonthlyor$100 per seat monthly when billed annually, with higher usage.
• Enterprise: Contact sales or use current self-serve Enterprise terms; eligible Claude Code seat types are required for web sessions.
• VM compute: Anthropic states there is no separate cloud-VM compute charge for Claude Code web sessions.
• Usage: Web tasks share the account’s Claude and Claude Code limits. Parallel sessions consume those limits proportionally.
• API fallback: Separate pay-as-you-go API use follows Anthropic model token pricing and is distinct from subscription allowances.

Plan availability, model access, limits, and regional taxes can change. Confirm the live pricing and seat rules before purchase.

Strengths

• No infrastructure work: VM creation, base image, agent installation, network proxy, and Git workflow are managed.
• Safe Git credentials: The real GitHub token and signing keys stay outside the sandbox.
• Useful network choices: Deny outbound access, keep a development allow-list, build a custom list, or allow full access.
• Remote continuity: Tasks continue while the laptop is closed and can be monitored from mobile.
• Parallel tasks: Separate fresh sessions allow multiple pieces of work at once.
• Built-in review: Conversation, diff, inline comments, session attribution, and pull-request creation are one workflow.
• Rich base image: Common languages, Docker, databases, and build tools need little setup.
• Cached environments: Repeated tasks avoid reinstalling dependencies and Docker images.
• Cloud/local handoff: Teleport preserves the branch and conversation when moving work back to a terminal.
• PR follow-through: Auto-fix can respond to CI failures and review feedback after the initial task.

Limits

• Research preview: Behavior, availability, and limits may change.
• Claude-only: It is not a neutral sandbox for Codex, OpenCode, or arbitrary agent runtimes.
• GitHub-centered: Other Git hosts lack the complete push and PR workflow.
• Fixed resources: Approximately 4 vCPUs, 16 GB RAM, and 30 GB disk; large builds may fail or be killed.
• Linux only: No macOS/Xcode/Simulator environment.
• No custom base image: Users can run containers or install packages but cannot replace the cloud session image.
• No proper secret store yet: Sensitive variables are visible to environment editors and the guest.
• Broad GitHub identity: Connected account visibility, not GitHub App installation scope, determines repository reach.
• Proxy compatibility: All outbound traffic is proxied; some tools, including Bun package fetching, have known issues.
• Session expiry: Inactive environments are reclaimed. Reopening creates a fresh environment while restoring conversation history.
• Sharing footgun: Public Pro/Max sessions can expose private repository material unless access verification is enabled.
• Usage bottleneck: Parallelism is limited by shared model usage rather than a separate VM quota.
• No zero-data-retention path: Organizations with Zero Data Retention enabled cannot use cloud session features.

Activity And Maturity

Checked 2026-07-14:

• Product state: Research preview.
• Current capabilities: Fresh VMs, environment caching, Docker, network modes, custom domains, GitHub proxy, terminal handoff, public/team sharing, Auto-fix, and mobile monitoring are documented.
• Recent CLI linkage: Current documentation references session attribution and cloud behavior through Claude Code versions in the 2.1.x series, showing active coordinated development.
• Operational status: Anthropic maintains a status page specifically referenced for cloud-session allocation incidents.
• Platform foundation: The service builds on the established Claude Code product and Anthropic account/GitHub integrations, but the web execution mode is newer and explicitly preview-grade.
• Assessment: A polished and unusually complete managed coding-agent experience with meaningful network and credential controls. It is not yet a stable general-purpose sandbox contract.

Best Fit

Claude Code on the web best fits a developer who:

• already prefers Claude Code and has an eligible subscription;
• keeps source on GitHub;
• wants tasks to continue away from the laptop;
• wants managed isolation without operating VMs;
• values diff review, pull requests, CI follow-up, and mobile monitoring;
• can place code and selected environment data on Anthropic infrastructure.

It is a weak fit for non-Claude agents, GitLab/Bitbucket-first teams needing push support, macOS/iOS builds, very large compute jobs, strict Zero Data Retention, or teams requiring their own hypervisor and data plane.

Comparison

• Versus Clawk: Both isolate agent work in a separate VM and restrict networking. Clawk is local, agent-neutral, mounts the worktree, and gives the user infrastructure control. Claude Code web is hosted, Claude-specific, GitHub-integrated, and includes review/PR/Auto-fix workflows with no VM operations.
• Credential design: Claude’s GitHub proxy is stronger than passing a raw token into a guest and limits push to the working branch. Clawk proxies host SSH signing but can expose broader repository authority through the forwarded identity.
• Versus Vercel Sandbox: Vercel supplies a programmable sandbox primitive for products and arbitrary code. Claude Code web supplies a finished coding agent, conversation, Git workflow, and subscription; its VM is not exposed as a general SDK resource.
• Versus exe.dev: exe.dev offers durable general Linux computers, SSH, hosting, and multiple agents. Claude web uses fresh task sessions, fixed resources, Claude only, and a more integrated GitHub/network security model.
• Versus Bitrise RDE: Bitrise provides real macOS and CI stack parity for mobile teams. Claude web provides Linux only but requires less setup and has a deeper built-in Claude review workflow.
• Versus GitHub Codespaces: Codespaces is an interactive developer environment with broader editor and devcontainer control. Claude web is task/agent-first, has a dedicated Git proxy, and runs autonomous work without requiring an editor session.
• Versus local Claude Code: Local use sees the developer’s selected files, credentials, tools, and machine resources. Web use starts clean remotely, keeps running, and limits network by policy, but sends the repository to Anthropic infrastructure.

HN Context

Claude Code on the web appeared as a short alternative in HN thread 48892859:

• Comment: mrbn100ful replied that the cloud version already existed and listed GitHub Codespaces, CodeAnywhere, and claude.ai/code.
• Follow-up: A Bitrise commenter replied that those named products did not solve the real-macOS environment need for iOS and tvOS development.
• What the comment gets right: Claude Code web does provide hosted isolated VMs, background execution, GitHub access, and parallel agent sessions.
• What it misses: It is Claude-specific, Linux-only, preview-stage, resource-limited, and not a general VM or macOS development environment.

The HN comment offered no first-hand security or performance evidence; the detailed assessment above comes from current Anthropic documentation.

Direct Sources

• https://claude.ai/code/
• https://code.claude.com/docs/en/claude-code-on-the-web
• https://code.claude.com/docs/en/claude-code-on-the-web#get-started
• https://code.claude.com/docs/en/security
• https://code.claude.com/docs/en/data-usage
• https://claude.com/pricing
• https://support.anthropic.com/en/articles/11145838-using-claude-code-with-your-pro-or-max-plan
• https://news.ycombinator.com/item?id=48892859
• https://news.ycombinator.com/item?id=48893909
• https://news.ycombinator.com/item?id=48894058

Unknowns

• VM internals: Anthropic does not identify the hypervisor or publish a detailed guest-to-host threat model on the reviewed page.
• Independent audit: No Claude-Code-web-specific external isolation audit was found.
• Exact retention: Session, cache, transcript, and deleted-data retention depend on account terms and are not fully summarized on the main web-session page.
• Resource guarantees: CPU, memory, and disk figures are approximate and may change; no performance service level is stated.
• Concurrency ceiling: The practical number of simultaneous sessions is governed by usage limits, but a fixed maximum was not published on the reviewed page.
• Environment secret roadmap: Timing and design for the promised dedicated secrets store are unknown.
• Network inspection: The exact content-filtering rules, TLS handling, and audit visibility are not fully documented publicly.
• General availability: No firm date or compatibility commitment for leaving research preview was found.

Sources

• • imported AI research note for Claude Code Web.