paperclipai/paperclip

Selection

Select when

• You coordinate many simultaneous Claude Code or mixed-agent sessions.
• You need persistent task context and resumable adapter sessions.
• You need organization, role, reporting-line, and goal models for agents.
• You need cost attribution, budget warnings, and hard stops.
• You require human approvals or review stages before agent work proceeds.
• You want recurring agent work triggered by schedules, APIs, or webhooks.
• You need governed MCP or application connections with auditable action policies.
• You want a self-hosted dashboard spanning coding and non-coding work.
• You need multiple organizations isolated within one deployment.
• You plan to extend the control plane through trusted plugins.

Boundaries

Avoid when

• You only use one agent occasionally and do not need orchestration.
• You want a small Claude Code skill, hook, or configuration-only extension.
• You cannot operate a persistent Node.js service and database-backed application.
• You require a mature sandbox for untrusted third-party plugin code.
• You require telemetry to be disabled without configuration.
• You cannot review credential, network, storage, and authentication settings.
• You need guaranteed real-time budget enforcement before delayed usage is recorded.
• You need a finished desktop application rather than a web UI.
• You require every advertised surface to be non-experimental.
• You need proven compatibility with a Claude Code version not covered by supplied evidence.

Strengths

Capabilities

Risk profile

Risks and limitations

• Uncertainty: only selected first-party files were supplied, so adapter internals, authorization enforcement, migrations, backup behavior, installers, and most runtime code were not directly inspected.
• Uncertainty: repository metadata and many supplied plans or tests are dated in 2026, so release chronology and current stability cannot be independently reconciled here.
• Uncertainty: no supplied Claude Code version matrix establishes compatibility across Claude Code releases.
• Uncertainty: first-party claims about scale, merged pull requests, isolation, recovery, and feature completeness were not independently reproduced.
• Several surfaces are explicitly experimental, including Agent Chat and chat or email connectors, while memory, cloud deployment, and a desktop app remain incomplete or planned.
• Budget enforcement uses recorded spend, so reporting delay and in-flight work can postpone a hard stop.
• Telemetry is enabled by default, although documented configuration can disable it.
• Plugin workers and same-origin plugin UI are trusted code; capability declarations are not a sandbox boundary for untrusted plugins.
• Dynamic plugin installation is currently best suited to single-node persistent deployments and needs writable storage, npm, and registry access.
• Company exports omit referenced secrets but may retain plain environment values and local paths, so packages require review before sharing.
• Self-hosting requires careful management of credentials, network exposure, storage, backups, upgrades, and optional third-party services.
• No independent security audit, privacy assessment, sandbox escape analysis, or comprehensive production benchmark was supplied.

Documented controls include trusted-local or authenticated modes, human permissions, company-scoped access, agent API keys, short-lived run JWTs, encrypted credential storage, secret references, action policies, approvals, audit history, non-root runtime images, ephemeral run credentials, and signed container images. Important caveats are that plugin workers and same-origin plugin UI are trusted rather than sandboxed, broad escape-hatch MCP API access exists within authenticated `/api` scope, sandbox strength depends on the configured provider, and safe remote deployment requires explicit authentication and network design.