Self-host Paperclip
Hire a team of AI agents. Give them an office that never closes.
Shelley handles the setup. About 10 minutes.
Prefer a terminal?
curl -fsSL https://exe.dev/deploy/paperclip/prompt.txt | ssh exe.dev new --prompt=/dev/stdinPaperclip runs a company made of AI agents. You set a goal, hire agents into an org chart, and hand out tasks; Paperclip wakes the right agent, tracks what each one spends, and asks you before anything that needs a board decision. The agents are the coding agents you already know: Claude Code, Codex, Pi, OpenCode, Hermes, and more.
Agents that work for days need a computer that stays on. Here Paperclip runs on its own exe.dev VM, private behind your exe.dev login, and its agents reach Claude and GPT through exe.dev's LLM gateway, so there are no API keys to paste. Its database and every agent's workspace live on the VM's disk.
What you get#
- Paperclip's dashboard at your VM's private URL, behind your exe.dev login and its own sign-in.
- A one-time link that makes you its first admin; your password never passes through Shelley.
- Claude Code and Codex agents on models from exe.dev's LLM gateway, with no API key on the VM.
- Agents, tasks, and the database on the VM's disk, back after a reboot.
- Hourly database dumps by Paperclip, plus a nightly archive of everything, with a tested restore.
What's running, and where
https://my-paperclip.exe.xyz/
The Paperclip dashboard, behind your exe.dev login and a Paperclip account
https://my-paperclip.exe.xyz/
Teammates you share the VM with and invite in Paperclip
Deploy with Shelley#
Click Deploy and Shelley will set up Paperclip on a new VM, then check that it works. No config-file wrangling required.
Prefer a terminal?
curl -fsSL \
https://exe.dev/deploy/paperclip/prompt.txt \
| ssh exe.dev new --prompt=/dev/stdinWhat Shelley is told
Set up Paperclip on this VM by following the exe.dev recipe at https://exe.dev/deploy/paperclip.md from top to bottom.
The recipe's example VM name is my-paperclip. This VM's name is the output of `hostname`: use it wherever the recipe writes my-paperclip. Skip the step that creates the VM; you are on it.
You are done when all of these are true. Check each one yourself:
- Paperclip's dashboard at your VM's private URL, behind your exe.dev login and its own sign-in.
- A one-time link that makes you its first admin; your password never passes through Shelley.
- Claude Code and Codex agents on models from exe.dev's LLM gateway, with no API key on the VM.
- Agents, tasks, and the database on the VM's disk, back after a reboot.
- Hourly database dumps by Paperclip, plus a nightly archive of everything, with a tested restore.
Read the whole recipe, including the closed details. For initial setup,
follow "Install by hand" first, skipping VM creation and SSH. The
walkthrough at the top is for the owner afterwards: don't create the
owner's Paperclip account, companies, agents, or AI connections
yourself. Do not run the restore or update instructions.
Install exactly the pinned version. Don't use paperclip.ing/install.sh.
Don't run `exeuntu configure claude` or `exeuntu configure codex`, and
don't create ~/.claude/settings.json or ~/.codex/config.toml: Paperclip
refuses AI connections when those hold API settings.
Keep the VM private. Never run share set-public or switch Paperclip to
local_trusted mode. On an existing VM, ask before replacing anything
on port 8000.
Verify: /api/health says authenticated and private, the service is
enabled and active, Linger=yes, the backup timer is scheduled, and the
test archive lists default/config.json. Do not reboot.
Finish with the dashboard URL and the invite link from "Make yourself
the admin", and tell the owner it works once and expires in 72 hours.
Finish with the URLs I should open.
Also at /deploy/paperclip/prompt.txt. The recipe it follows is /deploy/paperclip.md.
Make yourself the admin#
Shelley's last message has a one-time invite link. Open it, sign in to exe.dev, then create your Paperclip account with your name, email, and a new password. The first account made this way becomes the instance admin.
Paperclip then asks for your organization's name and a first agent's
name. When it gets to Connect a model, leave the wizard: open
https://my-paperclip.exe.xyz/agents/new instead. Its setup has the
gateway option the wizard lacks.
Lost the link, or it expired? On your computer:
ssh my-paperclip.exe.xyz 'PATH="$HOME/.local/bin:$PATH" paperclipai auth bootstrap-ceo --base-url "https://$(hostname).exe.xyz"'
Hire your first agent#
On New agent, give it a name and choose Claude Code. Under Connect a model, pick Advanced, open Connection, and choose Connect an account…, then Custom gateway:
- Provider URL:
https://llm.int.exe.xyz - Authentication: API key · x-api-key
- API key:
implicit. It's a placeholder: exe.dev adds the real credentials outside the VM.
Click Connect, then Use connection. On Configure your agent, click Run test; expect Connection successful and "Claude hello probe succeeded". Then Finish setup.
The connection is saved for the whole organization: your next Claude
Code agents pick Company llm.int.exe.xyz from the list. For a Codex
agent, add a second gateway with https://llm.int.exe.xyz/v1 and
Bearer token authentication, with the same placeholder key.
Give it work#
Click Assign … a Task, or New Task in the sidebar, and try:
Write a file HELLO.md in your workspace containing a one-line greeting, then mark this task done.
The task shows the agent's run and its reply within a minute, and the dashboard counts what it cost. Agents wake when they're given work; turn on an agent's heartbeat in its settings to have it check in on a schedule, and set a budget first.
Warning
Keep this VM private. Agents run commands on the VM, with sudo, and Claude Code agents skip permission prompts by default. Don't make the VM public or keep unrelated secrets on it.
Bring your team#
On your computer, share the VM:
ssh exe.dev share add my-paperclip teammate@example.com
Then invite them in Paperclip: click your organization's name at the top left, choose Invite people to …, pick a role, and Create invite. Each link works once. They sign in to exe.dev, open the link, and make their own Paperclip account. Admins can create agents, and agents can run anything on the VM, so give that role only to people you'd give a shell.
Keep your company#
Everything lives in ~/.paperclip/instances/default: the database,
settings, uploads, agent workspaces, and the key that encrypts stored
secrets. Paperclip dumps its database every hour. Each night at about
3:30 UTC, a timer stops Paperclip for a few seconds and archives the
whole folder to ~/backups/paperclip, keeping two weeks. Copy them
off the VM too. On your computer:
rsync -av my-paperclip.exe.xyz:backups/paperclip/ ./paperclip-backups/
Keep those copies private: they hold the encryption key and everything your agents wrote.
Setup and upkeep#
No need to read on unless you're curious—or doing it yourself.
Install by hand
On your computer (pick another name if my-paperclip is taken):
ssh exe.dev new --name=my-paperclip
ssh my-paperclip.exe.xyz
All remaining installation commands run on the VM, as exedev.
Install Node.js 24#
Paperclip needs Node.js 24.11 or later:
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version
Expect v24. and something.
Install Paperclip#
Paperclip publishes builds daily. Pin a tested stable release; the
installer keeps it in ~/.paperclip/cli and puts paperclipai in
~/.local/bin:
npx -y paperclipai@2026.1023.0 install --version 2026.1023.0 --yes
export PATH="$HOME/.local/bin:$PATH"
paperclipai --version
Expect 2026.1023.0 (managed npm pinned; …). It takes about a minute;
warnings about EBADENGINE are harmless.
Set up the server#
--bind lan puts Paperclip in authenticated mode, so everyone signs in.
It listens on port 8000, where the HTTPS proxy sends the
VM's address, and accepts only that hostname. Lingering keeps the
service running after you log out:
sudo loginctl enable-linger "$USER"
PORT=8000 PAPERCLIP_ALLOWED_HOSTNAMES="$(hostname).exe.xyz" \
paperclipai onboard --yes --bind lan --install-service
That writes ~/.paperclip/instances/default, with generated secrets in
.env and secrets/master.key, then starts the service. Check it:
sleep 5
loginctl show-user "$USER" -p Linger
systemctl --user is-enabled paperclipai
systemctl --user is-active paperclipai
curl -fsS --retry 10 --retry-connrefused --retry-delay 3 \
-H "Host: $(hostname).exe.xyz" http://127.0.0.1:8000/api/health |
jq -r '.status, .deploymentMode, .deploymentExposure'
Expect Linger=yes, enabled, active, then ok, authenticated, and
private.
Set up nightly backups#
The archive is taken with Paperclip stopped, so the database in it is consistent. A run in progress is stopped and retried after the restart:
mkdir -p ~/.config/systemd/user ~/backups/paperclip
chmod 700 ~/backups ~/backups/paperclip
cat > ~/.config/systemd/user/paperclip-backup.service <<'EOF'
[Unit]
Description=Paperclip backup
[Service]
Type=oneshot
UMask=0077
ExecStartPre=/usr/bin/systemctl --user stop paperclipai.service
ExecStart=/bin/sh -c 'tar -C %h/.paperclip/instances -czf %h/backups/paperclip/paperclip-$$(date +%%Y%%m%%d-%%H%%M).tar.gz default && find %h/backups/paperclip -name "paperclip-*.tar.gz" -mtime +13 -delete'
ExecStopPost=/usr/bin/systemctl --user start paperclipai.service
EOF
cat > ~/.config/systemd/user/paperclip-backup.timer <<'EOF'
[Unit]
Description=Nightly Paperclip backup
[Timer]
OnCalendar=*-*-* 03:30:00
RandomizedDelaySec=30m
Persistent=true
[Install]
WantedBy=timers.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now paperclip-backup.timer
systemctl --user start paperclip-backup.service
tar -tzf "$(ls -t ~/backups/paperclip/paperclip-*.tar.gz | head -1)" | grep -c 'default/config.json'
systemctl --user is-active paperclipai
systemctl --user list-timers paperclip-backup.timer
Expect 1, active, and a scheduled next run.
Make yourself the admin#
Create the one-time link that makes its user the instance admin:
paperclipai auth bootstrap-ceo --base-url "https://$(hostname).exe.xyz"
Open the Invite URL it prints and carry on from
Make yourself the admin.
Back up and restore
On the VM, take a fresh archive now (Paperclip stops for a few seconds):
systemctl --user start paperclip-backup.service
ls -t ~/backups/paperclip | head -3
To restore, replace BACKUP.tar.gz with the archive's filename. The old
folder is kept beside it until you delete it:
systemctl --user stop paperclipai &&
mv ~/.paperclip/instances/default ~/.paperclip/instances/default.old &&
tar -C ~/.paperclip/instances -xzf ~/backups/paperclip/BACKUP.tar.gz &&
systemctl --user start paperclipai
Sign in again and check your tasks are there. Moving to a new VM? Install
there first, copy the archive over with scp, restore, then let the new
hostname in and restart:
paperclipai allowed-hostname "$(hostname).exe.xyz"
systemctl --user restart paperclipai
Paperclip's own hourly database dumps are in
~/.paperclip/instances/default/data/backups, kept for 30 days.
Update
Paperclip ships a stable release every week or two, and nightly and
canary builds in between; stay on stable. Find the newest version on the
releases page and
read its notes. Then, on the VM, take an archive, stop Paperclip, and
update, replacing VERSION:
systemctl --user start paperclip-backup.service &&
systemctl --user stop paperclipai &&
paperclipai update --version VERSION --no-backup &&
systemctl --user start paperclipai &&
paperclipai --version &&
systemctl --user is-active paperclipai
Expect the new version and active; the new version updates the
database as it starts. Sign in and check your tasks.
Note
Don't run
paperclipai updatewith the service running. In authenticated mode it can't read the new version from the server, so it waits a minute, then switches back to the old version, which is left with a database the new one may have changed. The archive replaces the database's own pre-update dump, which needs the service running.
If the new version misbehaves, stop the service and run paperclipai update --rollback, then restore the archive you
just took: rollback switches the program back but not the database.
Something stuck?
Ask Shelley, or check on the VM:
systemctl --user is-active paperclipai
journalctl --user -u paperclipai -n 40 --no-pager
curl -fsS -H "Host: $(hostname).exe.xyz" http://127.0.0.1:8000/api/health | jq -r .status
paperclipai: command not found? Runsource ~/.profile, or log in again.- 502 from the dashboard? Paperclip takes a few seconds to start; reload. Still there? Look for errors in the log above.
- 403 or "hostname not allowed"? The VM's address isn't in
Paperclip's list. Run
paperclipai allowed-hostname "$(hostname).exe.xyz"andsystemctl --user restart paperclipai. - "Project authentication settings conflict with the selected AI
connection"? Something wrote API settings to
~/.claude/settings.jsonor~/.codex/config.toml(exeuntu configuredoes). Move the file aside and run the test again. - "The provider rejected this API key"? You used API key rather than Advanced: that option checks keys with Anthropic or OpenAI directly. Use the custom gateway above.
- An agent run fails? Open the run on the task page for its log, and check your LLM integration.
Frequently asked questions#
What does it cost?
Paperclip is free and MIT-licensed. You pay for your VM plan and the agents' model usage, billed through the LLM integration. The dashboard's Month Spend shows what agents have used; give each agent a budget before letting it run on a schedule.
Can I use my Claude or ChatGPT subscription instead?
Yes. When you hire an agent, pick Claude Subscription or OpenAI Subscription instead of Advanced, and sign in. Or point your LLM integration at your own key or subscription and keep using the gateway connection.
Why two logins?
exe.dev's login keeps everyone you haven't shared the VM with away from the page. Paperclip has its own accounts and roles, and it can't take its sign-in from exe.dev, so it keeps its own password. Your browser remembers both.
Can agents work on my GitHub repositories?
Yes. Agents run on the VM and can use git like you do. The GitHub integration gives the VM access to chosen repositories without a token on its disk.
Can Paperclip run agents on other machines?
Paperclip has experimental execution environments, such as SSH hosts and cloud sandboxes. We haven't tested them on exe.dev; agents in this guide run on the Paperclip VM itself.
Does Paperclip send data anywhere?
It sends anonymous usage telemetry by default, without prompts, issue content, or secrets. To turn it off, set telemetry.enabled to false in ~/.paperclip/instances/default/config.json and restart the service. Prompts go to the model provider through exe.dev's gateway.
Updated Oct 31, 2026 · tested end to end Oct 31, 2026 · Markdown · manifest.json · Something wrong? Tell us
