Remote machines for coding agents
Agents run for hours. Paperboat keeps them running where the work is, with exactly the access you give them.
$ pb connect gpu-box
ana@gpu-box:~/repo$ claude# close the laptop; the agent keeps working$ pb connect gpu-box- 1
Start the agent in a Paperboat terminal on the machine with the code and the GPU.
- 2
The session lives on gpu-box.
- 3
Check on it from another computer, or from the console in a browser.
Scoped API tokens
An agent should not inherit everything you can do. Tag the machines, create a token for those tags and those actions, and give it an expiry.
$ pb machine tag build-01 add agents
$ pb machine tag build-02 add agents$ pb api-token create agent --expires 7d --scope '[{"dst":["tag:agents"],"allow":["exec","files"]}]'$ pb login --api-token-file ./agent.token$ pb policy explain --dst machine:db --action exec --api-token agent- 1
Mark the machines an agent may touch.
- 2
A token for exec and files on those machines, for a week. The secret prints once.
- 3
Where the agent runs. No browser needed.
- 4
Confirm what it cannot do before you hand it over.
Commands for programs
The same properties that make pb safe in a shell script make it predictable for a model.
No shell in between
pb exec studio -- git status runs that argument list exactly. Nothing a model writes is expanded or split a second time.
JSON in, exit code out
Commands that return data take --json; pb exec --json streams events and ends with the remote exit status.
Says when it does not know
If a connection dies mid-command, the result says the outcome is unknown, so the agent can check before trying again.
Secrets by name
pb env names lists what exists. pb env run -- cmd puts the values in that command's environment and nowhere else.
Help it can read
pb COMMAND --help --json describes any command in a structured form, so an agent can discover the interface.
You can watch
Share the agent's terminal session and a teammate sees it live. Make them interactive and they can step in.
Questions
Does Paperboat sandbox what the agent runs?
No. Paperboat decides which machines and which actions a token can reach. Once a command runs, it has the permissions of the operating-system user it runs as. Use a dedicated user or a container on the target machine for real isolation.
Can the agent read my secrets?
It can run commands that receive them, and a command could print its environment, so scope the token and choose the machines with that in mind. What Paperboat adds is that the agent never needs the value in its prompt, its arguments or a file. A workspace owner can also stop commands from listing ENV names.
How do I see what an agent did?
The audit log records each action with the token that performed it, the machine, and whether it was allowed. It does not record command output or file contents.
Is there an SDK?
Not yet. Today the interface is the pb command with --json, which is stable enough to build on.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex