Disclosure up front:I build[agentproto], which
overlaps with Paseo in the "daemon that runs coding agents" space. Everything
below is the verbatim session log from installing and exercising Paseo
v0.1.107 on macOS (Node 22) on 2026-07-13 — commands, outputs, and costs are
real. Where Paseo is better, I say so plainly. Corrections welcome — file an
issue and I'll amend.
Almost every agent-tool review you read this year was written from the README.
You can tell: the features arrive in the order the docs list them, and nobody
ever mentions the bill.
This one was written from the terminal. I installed Paseo, ran real agents
through it, made one hit its permission wall on purpose, and read the invoice.
The first thing it told me: saying "hi" costs twenty-nine cents.
And here's the part that should make you trust the rest — I build a Paseo competitor. A rival's praise is the only kind a README can't buy.
The one idea, if you remember nothing else:
A README is the tool's sales pitch. The terminal is its confession. So I
reviewed Paseo from the terminal.
Paseo is a local daemon (~/.paseo
, listening on 127.0.0.1:6767
) that
wraps the coding-agent CLIs you already have — Claude Code, Codex, OpenCode,
pi — behind one lifecycle API. It speaks to them via the
Agent Client Protocol (ACP, the protocol Zed
introduced), so a "Paseo agent" is really a provider session — a Claude Code
session, say — that the daemon owns and multiplexes.
The headline feature is your phone. The daemon holds an outbound WebSocket to
wss://relay.paseo.sh
, and the mobile/web app reaches your machine through that
relay after a QR pairing (paseo daemon pair
) — no inbound port, no tailscale.
10.3k GitHub stars (as of 2026-07-13), AGPL-3.0, and, credit where it's due, the
onboarding is genuinely smooth.
$ paseo status
Local Daemon running
Listen 127.0.0.1:6767
Relay wss://relay.paseo.sh:443
Providers
Claude available (daemon)
Codex available (daemon)
OpenCode available (daemon)
pi available (daemon)
That four-provider list is the whole pitch in one screen: one daemon, one lifecycle, four agent brands underneath it. Which is a real thing to want. So
$ paseo run "hi" --provider claude
Created workspace wks_1043f3c7…
AGENT ID STATUS PROVIDER TITLE
a722bba… completed claude hi
It worked on the first try. It also cost more than I expected for one syllable,
and it quietly created a workspace I didn't ask for. Two gotchas the quickstart
won't warn you about, and both cost you real money if you skim past them.
Gotcha 1 — the default Claude model is Opus.My"hi"
— one word in,
eighteen tokens out — cost$0.29.paseo inspect <id>
shows per-agent
usage down to the cent, which is a genuinely nice touch. For experiments, pass
--provider claude --model claude-haiku-4-5
or you're benchmarking on the
priciest model in the house.
Gotcha 2 — everyNotice therun
mints a fresh workspace.
Created workspace wks_1043f3c7…
on a one-word prompt. Reuse one with
--workspace <id>
orPASEO_WORKSPACE_ID
, or your workspace list silently
piles up run after run.
paseo inspect
is where the daemon earns trust. You see the wrapped session's
modes — for Claude they're literally Claude Code's permission modes (Always
,
AskAccept File Edits
, Plan Mode
, Bypass
) — plus token usage, cost,
pending permissions, worktree binding, and a parent-agent field. Nothing is
hidden behind the wrapper. Good. Now for the feature the whole thing exists to
sell.
The permission relay is Paseo's real product, so I didn't take the README's word
for it — I set an agent up to fail against it. Launch in default
(always-ask)
mode with a task that must write a file, and detach:
$ paseo run "Create a file named hello.txt containing exactly the line: paseo test ok" \
--provider claude --model claude-haiku-4-5 --mode default -d
Eight seconds later the agent is frozen mid-task, waiting on a human it can't
see. From a second terminal, I answered as that human:
$ paseo permit ls
AGENT REQ_ID TOOL DESCRIPTION
b402ffb permissi Write -
$ paseo permit allow b402ffb
REQUEST ID AGENT TOOL RESULT
permissi b402ffb Write allowed
$ paseo logs b402ffb
Done. Created hello.txt with the content "paseo test ok".
The same request lands as a push notification on the paired phone, with
approve/deny buttons. This works exactly as advertised — the permission prompt escapes the terminal the agent lives in, and you can answer it from the couch.
What the relay is, in ladder terms.An agent freezes on aWrite
, the
request surfaces inpaseo permit ls
(and on your phone), you tap allow, it
finishes. On the[supervision ladder], that's a
polishedL2 — permission relay: it moves the human decision to a better
surface. It does not remove the human. Same person, better couch — which is
the ceiling of L2, not a knock on Paseo's execution of it.
That distinction — better surface vs. fewer humans — is the whole review, and
it's worth being fair about how much surface Paseo actually ships.
This is where I expected a thin wrapper and found a real product. The CLI is
broad, and several of these I'd happily use:
| Surface | What it does |
|---|---|
paseo loop |
|
| Iterative worker loops (the "Ralph" pattern: same prompt, N iterations, stop condition) | |
paseo schedule |
|
| Cron-style recurring runs, with /resume and run logs | |
paseo chat |
|
| Named rooms agents post to / read from — lightweight agent-to-agent coordination | |
paseo worktree |
|
Managed git worktrees; run --worktree <name> isolates an agent per branch |
|
paseo terminal |
|
| Workspace terminals you create, send keys to, and capture — from the phone too | |
paseo import |
|
| Adopt an existing Claude Code / Codex session as a Paseo agent | |
--output-schema |
|
| Force an agent's final answer to match a JSON schema |
Two of these are quietly excellent. --output-schema
gives you structured
output from an interactive coding agent, which is rare and genuinely useful.
And import
lets you bring a session you started in a plain terminal under
daemon management after the fact — a thoughtful escape hatch most wrappers
skip.
On steering — running, watching, and approving agents from anywhere — Paseo is best-in-class, and I'm saying that as someone who ships a competitor. The
Three limits matter if you're evaluating Paseo seriously — and none of them are
knocks on its polish. They're about a different job than the one it's built for.
1. Supervision means you, faster — not you, removed. The relay moves the
human decision to your pocket; it doesn't take the human out of the loop. There
is no policy engine that fires at the agent's turn-end — nothing that says
"when the agent claims done, run lint + tests, have a second model try to refute
the diff, and stage the commit until a human acks." Schedules and loops re-run
prompts; they don't verify outcomes. That's the jump from L2 to
L3/L4 on the ladder, and it's the jump Paseo
doesn't make.
The critique isn't mine — it's from the reviewers.From a 2026 cross-device
Paseo review:a supervision layer makes it easier to watch and review agents,A nicer approval surface still hands
but it cannot improve a model that produces bad edits or fix a misdiagnosed
bottleneck.youthe same diff to judge.
2. Your tools don't ride along. Paseo injects its own control tools into the
agents it runs — that's how permit/chat/terminal reach the model — but there's
no mechanism to register your tool once and have every agent (Claude, Codex,
OpenCode) see it. Each provider keeps its own MCP config; the daemon isn't a
tool bus. If you want one capability visible to every agent brand, that's still
manual, per-provider labor with your name on it.
3. The daemon's own MCP surface is off by default. My first probe of
127.0.0.1:6767
returned 404s on the obvious MCP paths — because the MCP server
is config-gated. Set daemon.mcp.enabled
in ~/.paseo/config.json
and the
daemon exposes its control surface (agent lifecycle, terminals, schedules,
worktrees, permission handling, voice) as MCP tools, so a Claude Desktop or
Codex session can drive Paseo.
Credit, then the caveat.That flag turns Paseo into a real
drivable-from-agents surface — a legitimately nice property. But what it
exposes is Paseo'sowncontrol tools, not a bus for distributingyour
tools into the agents it runs. Point 2 still stands.
None of that makes Paseo worse at its job. It makes it a different rung than the
one I build for — which is the fair way to end a review a competitor wrote.
Use Paseo if your bottleneck is being physically present. You run two to
five Claude Code / Codex sessions, permission prompts are what shreds your day,
and you want to approve them from the couch — with worktrees, schedules,
structured output, and a phone app that, honestly, is nicer than most. It's
free, open source, self-hosted, and the polish is not a facade. On steering, it
beats us.
Look further if your bottleneck is trust at scale. You want the "done"
claim checked by something other than the agent that made it, commits staged
behind verification, one tool you wrote visible to every agent brand, or a gate
that survives your laptop closing. That's the layer I build agentproto for — and
the two aren't rivals on the same repo: nothing stops a Paseo-steered session
and an externally-gated one from coexisting.
The daemon tax, named fairly.Adding an orchestration daemon means a failed
run can now originate in the provider, the daemon, the client,orthe relay —
the debugging and threat surface genuinely grows. That's true of Paseo and true
of agentproto; it's the cost of the shape, not of either tool. (Also flagged
in VibeCodingHub's Paseo review.)
If you're just meeting this series, the map is
You can't parallelize the trust
(why steering more agents doesn't scale), the
supervision ladder (the five rungs Paseo sits low
on, deliberately and well), and routing by cost (why
the checking layer has to reach cheap models Paseo doesn't gate). Paseo is an
excellent answer to "how do I steer agents from anywhere." It just isn't
trying to answer "what — other than me — decides my agent is done."
A README would never tell you that. Its terminal did, in two commands and
twenty-nine cents.
If I've mis-read where Paseo stops, or a flag I missed already does the thing I say it can't, tell me exactly which — I'll re-run it and fix the piece.
Ten pieces, one argument. Start anywhere; each one cross-links the rest.
| Piece | The one idea | |
|---|---|---|
| 1 | ||
Written by the maintainer of agentproto (Apache-2.0, source). Same contract as our /compare page — dated facts, named strengths, corrections by issue. Got something wrong? File an issue.
Building agentproto in the open — follow @theagentproto and @agentik_ai on X.