Paperclip supervises agents instead of building them
Paperclip starts from a familiar failure mode: several AI agents are active, but nobody has a dependable view of who owns each task, what they spent, which goal the work supports, or whether a human approved the risky step. Its answer looks like a task manager, then adds an org chart, scheduled heartbeats, execution locks, budgets, secrets, workspaces, approvals, and a durable activity trail.
The distinction from an agent framework is important. Paperclip does not prescribe how an agent reasons or which model it uses. Claude Code, Codex, OpenClaw, shell commands, HTTP bots, and external adapter plugins can all be workers if they accept a heartbeat. Paperclip assigns work, provides scoped context, records runs, and decides whether policy allows the next action. CrewAI or LangGraph builds behavior inside an agent application; Paperclip supervises a collection of those systems.
That makes the product most credible after a team already feels operational pain. One coding agent used twice a week does not need an org chart. Ten agents touching repositories, customer queues, or scheduled reports may need atomic checkout and a place to stop duplicated work. The README is unusually direct that single-agent users probably should choose something smaller.
The company metaphor maps to real controls
Issues carry company, project, goal, parent, blocker, and assignee relationships. Agents have titles, managers, permissions, budgets, and session state. A heartbeat queue wakes them on schedules or events, while execution locks stop two workers from claiming the same task. Run records collect logs, costs, work products, and audit events. Orphaned runs can be recovered instead of vanishing with a terminal.
Governance goes beyond a pause button. Policies can require review or approval stages, agent changes are revisioned, and budgets can warn or stop work. The runtime gateway puts plugin discovery and tool calls behind the same policy layer. Company-scoped entities aim to keep one organization's issues, secrets, and agents separate from another in the same deployment. Export and import scrub secrets so a company template can move without carrying credentials.
These are the right primitives, yet their value depends on enforcement under failure. A dashboard that says an agent is paused means little if an old process still holds a credential or a queued task can escape a budget boundary. Paperclip therefore deserves the same threat modeling and failure drills as a CI runner or internal automation platform, not the lighter review given to a normal task board.
What happened when we ran it
We cloned commit 23048f1 into a clean, unprivileged Node 22 container with three CPUs, 8 GB of RAM, and no secrets. The monorepo was large: 5,005 files, about 1,361,318 lines of source, and a 113.9 MB checkout. Pnpm installed 1,311 packages in 44 seconds, using 2,167 MB. The build completed successfully in 121 seconds.
The test command did not finish within our 900-second limit. The last output showed a series of skipped runtime-gateway cases covering durable sessions, local stdio slots, backoff, deferred write-risk calls, plugin tools, and company-scoped issue context. That tail does not identify a failing assertion or explain why the command remained active. We stopped it at the timeout, so the fair result is simply incomplete. The repository has a test directory and ten CI workflow files, but our sandbox did not establish a passing full run.
The measurements used Node 22, while the current quickstart requires Node.js 24.11 or newer. Our successful build at the measured commit should not be read as verification of the documented managed installer or the latest release. Paperclip publishes quickly, so match runtime requirements to the tag you deploy.
Local trial is easier than production
The installer can set up a managed CLI and begin onboarding, or npx can run a temporary trial. Manual development uses pnpm. A local single-process deployment creates embedded PostgreSQL and stores files locally, which is a sensible way to evaluate the interface. Trusted local mode binds to loopback. LAN and tailnet presets move toward authenticated access.
Production changes the problem. The README recommends an external PostgreSQL database, and operators must decide storage, identity, backups, TLS, agent workspaces, secret providers, and network routes to runtime previews. Shell-capable agents may edit files or start services. MCP tools and plugins add their own capabilities. Each connection should receive the smallest company, workspace, tool, and secret scope that lets it complete assigned work.
Anonymous telemetry is enabled by default. The project says it excludes prompts, issue content, paths, secrets, and personal information, and hashes private repository references with a per-install salt. PAPERCLIP_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 disables it. Regulated deployments should make that an explicit configuration decision.
Version v2026.824.1 fixes onboarding, not every execution race
Version v2026.824.1 was published on August 25, 2026, and the repository was pushed on August 27. GitHub listed 5,402 issues and pull requests combined. The patch repairs a background service installed through npx, removes a duplicate start prompt, opens the dashboard after readiness, and improves diagnosis when the service binary is missing. That is useful maintenance on the first-run path.
Two same-day reports cut closer to the promised control-plane behavior. Issue 12276 says a stale-lock sweep marked live runs terminal, cleared their locks, and allowed another session onto the same issue. The reporter measured six affected issues and activity continuing after terminalization. Issue 12272 says heartbeat requests accumulated after a container restart while no new runs were dispatched. These are reports, not our lab findings, but both concern the exact coordination guarantees Paperclip is meant to supply.
Paperclip is worth testing when agent coordination has become an infrastructure problem. Start with a noncritical company, a small budget, narrow credentials, and an operator watching every approval. The 900-second test timeout and current execution reports make staged failure testing a requirement before broad shell access or production secrets enter the system.