d627632874
Docs for parent release `v2026.1106.0` (`d69631b0`), up from `v2026.1023.0` (`1b4c8038`): 515 parent commits. ## How this branch was built The tag is 914 commits behind what `nightly` has drafted, so this branch isn't cut from `nightly` HEAD. It starts at nightly commit `1952052` (parent `043f2514`), 19 commits before the tag, then adds: - the `main` hotfix (#160) - the sync tooling from `nightly` - docs for those 19 commits Later nightly drafts stay on `nightly`, so no pages had to be removed. No `nightly-draft/*` PRs are open. ## What changed - **Runner by default:** new Claude, Codex, OpenCode and Pi agents start on Paperclip Runner on supported hosts, with **Legacy runner** and **Upgrade runner**. - **Workspaces:** cleanup of finished workspaces, optional Git expiration, and restore points for unsaved work. Restore points are off by default. - **New pages:** Prompt injection prevention, Google Workspace, GitHub Copilot, Speko, Braintrust, Daytona, Ditto and Unikraft. - **Breaking and upgrade notes:** the run history limit, Sentry run failures off by default and the DSN variables, the Docker start command for custom images, `--yes` on `instructions-file:delete`, and slower migrations on large instances. - **Also covered:** project repositories as skill sources, roster bulk edit, Artifacts V1 (experimental, off by default), composer dismissal, `expectedStatusVersion`, `unexecuted_review_stage`, and plugin workspace providers. - **Changelog:** a v2026.1106.0 entry in `reference/changelog.md`. ## Older text corrected These were wrong at the tag, and most are also wrong on the live site: - which permissions let an agent read a peer's configuration or change instructions (`api/agents.md`) - `decideNowCount`, which doesn't exist; the field is `deskBadgeCount` - `file-resources` routes, which are board-only - the **Create project** dialog fields, a CEO rule the code doesn't enforce, and where a terminated agent's reports appear - `instructions-file:put` and `:delete` examples that always failed (`cli/agent.md`) - a curl example that returned `422` (`api/cases.md`) - Google Workspace **Reconnect** instructions, which claimed it reopens the service picker - the `permissionKey` table, which listed 8 of 21 keys - drafting text at the end of `api/agents.md` ## ⚠ Please check these - **Product behaviour that may be a parent bug.** The docs now describe the tag's code, which you may prefer to fix upstream: - The project **Environment** dropdown saves a choice, but runs ignore it (`experimental/environments.md`). - `environments:manage` is granted by roles but no environment route checks it. - `suggest-changes` is documented as agent-only, because only agents have a consent path. Company skill policy decides skill edits. - **Reader-visible mismatches in the parent UI.** The docs follow the code. Upstream copy still mentions a "Built-in agents tab", says Copilot "awaits qualification", and tells people to "Reconnect Google Workspace to change access". ## ⚠ Post-tag leaks removed Nothing to remove from an already-drafted page: post-tag surfaces such as 1Password, Vercel, Supabase deploy, custom gateway onboarding and Artifacts V1 as default never came onto this branch. Authors left out post-tag hunks of the next nightly draft, and the reasons are in the run notes. ## ⚠ Drift None. Zero findings at the tag, from a full parent snapshot. ## ⚠ Verification Failures The tag-accuracy gate reports one leak and nine review entries. None is a real failure: - **Leak:** `reference/cli/service.md`, `paperclipai payload and`. This is a false positive; it's prose from a real message at `cli/src/commands/service.ts:184`. - **Review, 8 new connector pages:** the gate can't confirm new pages. Reviewers confirmed each surface exists at the tag. - **Review, `local_tools`:** an example value from the tag's Runner README. Not provable from code, and kept deliberately: - `sandbox-providers.md` uses `sandbox.yaml`. The tag's README says `install.yaml`, which returned 404 when checked. The upstream fix is post-tag. - The Google Workspace row about older OAuth brokers rests on release notes and a design doc. The broker isn't in this repo. - External claims about provider behaviour (for example Braintrust, Daytona, Unikraft and Google scopes). ## ↻ Renames detected None. The rename helper wasn't run: the 19-commit delta adds no new adapter, skill, or plugin directories that it would check. ## Verification All checks read a checkout pinned to the tag. - **First round:** authors, a release-notes audit, an audit of corrections stranded on `nightly`, an audit of 321 lines the last realign dropped from `main` (about 130 checked directly in code), and six fresh verifiers. - **Second round:** seven new verifiers re-checked every changed area, tracing behaviour rather than matching labels, and fixed about 50 more defects. That volume means more may remain. - **Limits of that second round:** - Each verifier reported what it only string-matched. That includes parts of Artifacts V1, the **Upgrade runner** notice, Copilot run behaviour, and some Plugin SDK contract text. - The second-round fixes themselves weren't reviewed by a third round. - **Gates:** `docs:build`, `docs:test` and `sync:check` pass. - **Nothing was run against a live instance.** All of this comes from reading code. ## Screenshots **196 of 278 screenshots are stale and none were recaptured.** The list is in `SCREENSHOTS_PENDING.md`. Some visibly differ from the text, such as the removed **Run with provider trace** button and the old roster tabs. ## After merge 1. Keep the PR title as is: `tag-docs-release.yml` reads the version from it. 2. Confirm the `docs/v2026.1106.0` tag exists. 3. Run `node scripts/sync/realign-nightly.mjs release/v2026.1106.0 --push`, then audit for dropped lines and duplicated paragraphs, and set `nightly` state back to `branch_mode: nightly`. 4. Check that `docs.paperclip.ing` serves the release: a new page, a new claim, and the changelog's top entry. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: DevRel Gemini <[email protected]> Co-authored-by: Paperclip <[email protected]> Co-authored-by: Dotta <[email protected]> Co-authored-by: ClaudeCoder <[email protected]>
9.9 KiB
paperclip_version, seo_title, seo_description
| paperclip_version | seo_title | seo_description |
|---|---|---|
| v2026.1106.0 | Connect Apps Through an MCP Aggregator | Reach apps that have no native Paperclip connector through Arcade, Composio, Executor, or Zapier, and pick the provider when an agent asks you to. |
Connect apps through an MCP aggregator
Some apps have no connector of their own in Paperclip. An MCP aggregator fills that gap: it is an outside service that connects to many apps on your behalf and hands them to Paperclip through one MCP server. Paperclip lists four of them on the Connectors page — Arcade, Composio, Executor, and Zapier — and they are available on every instance, with no setting to turn on.
Keep one thing in mind throughout: the aggregator sits between your agent and the app. It holds the app sign-ins and carries the requests. Paperclip still decides which people and agents can use the connection and which of its tools they may call, but anything the aggregator does inside the app is governed on the aggregator's side.
Native connectors come first
If Paperclip has its own connector for an app, use that. It is the path Paperclip reviews, and it is what agents are steered to. An aggregator is for the app that has no native connector.
The four providers
Each provider has its own catalog entry and its own connection. The setup screen shows the steps for the provider you picked, with a link to that provider's guide.
| Provider | What you paste | Sign-in |
|---|---|---|
| Arcade | The MCP gateway URL for a gateway you created in Arcade, with its tools selected. | Browser sign-in when the gateway asks for it. |
| Composio | Nothing, usually: the Composio Connect URL is prefilled. Replace it only if you set up a Composio session elsewhere. | Browser sign-in with your Composio account. |
| Executor | The URL under "Connect an agent" in your Executor workspace's Integrations. A self-hosted endpoint works if Paperclip can reach it. | Browser sign-in when prompted. |
| Zapier | The complete server URL from a Zapier MCP server, token included. See Zapier. | None — the token is part of the URL, so treat the URL as a secret. |
Set one up
- In the left sidebar, select Connectors, find the provider, and select it.
- Read the access summary above the main button. New gateway setup normally starts with everyone in your organization and all agents; select Change to narrow either audience. Share a connector with people and agents explains the choices.
- Paste the address into MCP server URL and select Connect {provider}, such as Connect Arcade. Composio uses its prefilled URL unless you open Reuse an existing session. Paperclip shows "Connecting and discovering tools…" while it reaches the server and reads its tool list.
- If the provider needs a sign-in, a provider window opens. Finish there and come back; Paperclip waits for confirmation.
- Review Permissions and set each tool to Allowed, Ask first, or Off, as on any connector — see Set action permissions.
A URL that is not an MCP endpoint is caught straight away with "Enter a valid MCP URL". A dashboard page is not an MCP endpoint, so copy the server URL the provider gives you.
Advanced authentication
Most setups need nothing more than the URL. If your provider gave you a token or headers instead of a browser sign-in, select Change and use Sign-in method under Authentication:
- Automatic (sign in if required) — the default for providers that support browser sign-in.
- Bearer token — paste the token only, without the word Bearer.
- Custom headers — add each header name and value the provider supplied.
- No additional authentication — the URL alone is enough.
Two provider-specific notes from the setup screen: for Arcade headers, use an API key as the bearer token and add the Arcade-User-ID header for the acting user. For Executor, an API key must be a user key; workspace and organization keys cannot open an MCP session.
If sign-in does not finish
Cancelling the sign-in or declining consent does not lose your work. Paperclip shows "Connection cancelled. Your setup details are preserved; try again when you are ready." and the button becomes Try again. If sign-in fails instead, Paperclip says the connection couldn't connect, keeps your saved setup, and offers Try again too. If you need to stop partway, you can leave and pick it up later — the connection shows Resume setup with your access choices intact.
When an agent asks for an app
You do not have to set these up in advance. When an agent needs an app that Paperclip has no native connector for, and one or more aggregators are known to support it, the agent asks you to choose. You see a question like:
"Connect HubSpot through an external service? These services handle the connection and requests to HubSpot. Connecting a provider does not yet authorize HubSpot."
Agents find these apps the same way they find any connector: by name, or by describing what they need in plain language. A whole sentence works, and so do small typos and split names. To know which apps an aggregator can reach, Paperclip keeps its own list built from the providers' published catalogs, including Composio's public toolkit catalog, so the agent's search never leaves Paperclip. A match in that list is a lead, not a promise: it does not mean your provider account is connected to the app.
The options list the providers that support that app, with the first one marked Recommended, plus None for now. Paperclip ranks them Composio, Arcade, Executor, then Zapier. Choosing None for now stops there: nothing is connected.
If you pick a provider you already have a connection for, the setup card offers to reuse it ("Use an existing connection or connect a new account"), or you can select Connect new. Reusing an account keeps its existing access as it was.
Choosing a provider connects the provider, not the app behind it. After you connect, the agent checks that the app is actually reachable through that provider and walks you through any extra authorization the provider needs. It should not report success until it has confirmed that.
What Paperclip controls, and what it does not
Paperclip controls access to the tools it lists for the connection. App and action permissions inside those tools are managed in the provider.
So set up both layers deliberately:
- In the provider, connect only the apps you need and expose only the actions you need.
- In Paperclip, active actions start as Allowed, including writes. Set writes to Off or Ask first if you want narrower access, and run Refresh actions after changing the provider's tool selection. Review what appeared.
Find and manage app accounts
The catalog starts on Paperclip. Use Composio, Arcade, Installed, or All to change the view. Search matches app names, aliases, providers, and saved accounts. The uninstalled catalog has pages of 50 entries; matching installed apps stay above it.
An app without native setup can appear as one card with the logos of its available providers. Connect opens a provider choice when more than one supports it. A native connector keeps its own setup, even when the same app also appears in an external provider's catalog.
Saved native and imported accounts are grouped under their app card. An imported row says Managed by {provider} and links to the saved gateway that supplies it. A provider filter includes a native app card when it has an account managed by that provider, not merely because the provider's public catalog lists that app.
Composio, Arcade, and Executor gateways can show Connected apps on Permissions. Where discovery is available, Paperclip refreshes the list on first load. Use Refresh Composio, Refresh Arcade, or Refresh Executor there, or in the saved gateway's menu, to check that gateway again. Executor is still available as a connection; its catalog filter is temporarily hidden.
A failed or incomplete check keeps last-known accounts marked Not verified. An account whose sign-in was started but not finished shows Waiting for sign-in, and an expired account shows Needs sign-in. Replacing a credential hides observations from the previous credential until the new one is checked. Discovery reports accounts; it does not grant access or authorize an app.
Imported account menus open the upstream provider. Rename, removal, and app authorization happen there. Paperclip's access and action settings stay on the parent gateway and apply across its apps; grouped cards do not create separate app-level access boundaries. Removing a saved gateway from Paperclip leaves the provider's accounts intact.
For provider-specific setup and discovery, see Composio, Arcade, and Executor.
Old Composio connections
Composio connections made through Paperclip's earlier Composio integration no longer run. Add a new Composio connection from Connectors, set it up, then remove the old one. Credentials and permissions do not carry over. Providers Paperclip recognizes but does not list has the details.
Related
- Connectors
- Connect a custom MCP server
- Zapier
- How connector access works
- Set action permissions
- Tool Gateway
Sources
- Catalog and account grouping — filters, grouped account rows, and gateway menus.
- Connected app list — refresh controls and verification states.