🩺 Vitals
- 🟢 Last active: 2026-07-30
- 📦 Latest release: v2026.722.0 (2026-07-22)
- 🐞 Open issues: 5024
- 🌟 Stars: 75.2k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: paperclip.ing
- Source: github.com/paperclipai/paperclip
- License: MIT
- Deployment: Node.js Runtime | Docker
- Data Model: PostgreSQL (embedded or external)
- Jurisdiction: USA 🇺🇸 (Paperclip Labs, Inc.; Delaware)
- Compliance (SaaS): N/A (No managed offering)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Medium (3/5) - Node.js process, Postgres, and external LLM key routing
- Maintenance: Medium (3/5) - Fast release cadence; you track a young, single-vendor codebase
- Enterprise Ready: Medium (3/5) - Native audit logs, RBAC & tenant isolation, but no certifications and concentrated governance
1. The Executive Summary
What is it? Paperclip is a self-hosted control plane for coordinating teams of autonomous AI agents. Rather than running agents in isolation, it imposes organizational structure on them: org charts with defined roles, per-agent monthly budgets, approval and governance workflows, and an immutable activity log. It is agent-agnostic: you "bring your own agents" (Claude Code, Codex, OpenClaw and others) and Paperclip becomes the management and accountability layer above them.
The Strategic Verdict:
- 🔴 For Compliance-Bound Procurement (Today): Caution. The project launched in early 2026 and is governed by a single corporate entity with no independent foundation. Treat continuity (bus factor) and the absence of third-party certifications as live procurement risks, not afterthoughts.
- 🟢 For Teams Operationalizing Agent Fleets: Strong Buy (Conditional). If you are moving from one-off agent experiments to managed, budgeted, auditable agent operations, Paperclip delivers the governance primitives (budgets, approvals, audit trails, tenant isolation) that proprietary platforms reserve for paid tiers, with zero data leaving your infrastructure.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Salesforce Agentforce (Proprietary) | Paperclip (Self-Hosted) |
|---|---|---|
| Pricing Model | Per-conversation / per-action metered billing | Free software (Bring Your Own LLM keys) |
| Governance Features | Audit, RBAC & isolation gated to enterprise tiers | Native: included in the OSS build |
| Data Control | Operational data routed through vendor cloud | Full (runs on your infrastructure) |
| LLM Inference | Bundled with platform markup | Direct provider billing (BYOK) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Runs as a single Node.js 20+ process; an interactive setup provisions an embedded Postgres and local file storage for quick starts. Production deployments require a managed Postgres, configured auth, and secure routing of external LLM provider API keys.
- Scalability: A single deployment supports multi-company isolation, running dozens of tenants with separate data boundaries. Scaling beyond that is standard Node.js/Postgres operational work. There is no proprietary clustering layer to license.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & The CLOUD Act: Paperclip Labs, Inc. is a US (Delaware) entity and therefore within reach of the US CLOUD Act. Because Paperclip ships as self-hosted software with no vendor data plane, that exposure is neutralized once you run it on sovereign infrastructure: the vendor never touches your operational data.
- The Compliance Shift: As open-source, self-hosted software, the vendor assumes no compliance liability. Paperclip gives you the technical primitives for control (immutable audit logs, approval gates, budget ceilings, RBAC), but your team owns 100% of the work to map those primitives onto SOC 2, ISO 27001, or GDPR obligations. The certifications are not inherited; the building blocks are.
- License Risk & Governance Continuity: The MIT license carries no copyleft trap or commercial clause: embedding it in proprietary systems is unrestricted, and there is no enterprise paywall to fall into. The material risk is not legal but organizational: a young project under concentrated, single-vendor stewardship with no foundation. Budget for the possibility that you may need to maintain a fork.
4. Market Landscape
🏢 Proprietary Incumbents
- Salesforce Agentforce: An enterprise agentic platform for deploying a managed "digital workforce," but billed per interaction and tightly coupled to the Salesforce cloud and data estate.
- Lindy: A polished SaaS for building and running teams of AI "employees," strong on usability but fully vendor-hosted, with governance and scale gated behind paid plans.
🤝 Open Source Ecosystem
—