Agent God ModeUse your existing Claude, Codex, Cursor, and other coding-agent subscriptions through one interface—while your code and provider sign-ins stay on infrastructure you control.
Paseo runs on your Agent Instance and makes its installed provider CLIs available to Agent God Mode. You keep each provider subscription and sign-in; Agent God Mode gives you one place to choose models, coordinate work, and follow progress.
Sign in to Claude Code, Codex, Cursor Agent, and other supported CLIs with the accounts your team already pays for.
Paseo runs the agents beside your repositories. Agent God Mode uses GitHub for repository selection and delivery metadata, but does not ingest, store, index, or analyze repository source. Source code, working trees, and provider sessions remain on your machine or company infrastructure.
Agent God Mode provides one interface for planning, model selection, follow-ups, implementation, review, and pull requests.
Ubuntu 24.04 LTS is the recommended baseline. Run agents as a dedicated non-root user with access only to the repositories it should manage.
Your Mac or Linux computer can be an Agent Instance. This is useful for trying Agent God Mode or keeping everything on hardware you already manage. Keep the machine awake, connected, and running Paseo while agents work.
A dedicated cloud or company server keeps agents running through long plans, builds, and reviews without depending on a laptop staying awake. Your code and provider sessions still remain on infrastructure you control.
Install Node.js 22 or newer, then install the current headless Paseo CLI.
npm install -g @getpaseo/cli
paseo daemon startPaseo supervises provider CLIs already installed and authenticated on this machine; it does not replace their subscriptions.
Choose Your ProvidersSelect one connection method during setup. Tailscale Direct uses your private tailnet. Paseo Relay creates an end-to-end encrypted connection using outbound internet access.
Run these commands as the same Linux user that runs Paseo. Each provider stays signed in on this Agent Instance; Agent God Mode never needs the provider password or subscription credentials.
curl -fsSL https://claude.ai/install.sh | bash
claude install latest
BROWSER=echo claude auth loginOpen the printed URL locally. Wait until the terminal displays Paste code here if prompted, then paste the code. Current Claude Code releases include the remote OAuth paste fix.
curl -fsSL https://chatgpt.com/codex/install.sh | sh
codex login --device-authOpen the displayed URL on any device and enter the one-time code. Device-code login must be enabled in your ChatGPT security settings or workspace policy.
Codex Authenticationcurl https://cursor.com/install -fsS | bash
cursor-agent loginCursor currently documents browser login, not a device-code flag. Open the displayed sign-in URL locally. If browser login cannot be completed from the Agent Instance, use a Cursor API key instead.
export CURSOR_API_KEY="your_api_key"In App → Settings → Agent Instances, select the providers configured on the instance and choose Verify Providers. Agent God Mode asks Paseo to rediscover the selected CLIs and shows which ones are ready or still need sign-in.
paseo provider diagnostic claude
paseo provider diagnostic codex
paseo provider diagnostic cursorPaseo Relay creates an end-to-end encrypted connection to your Agent Instance. The instance needs only outbound internet access—no public IP, inbound security-group rule, or port forwarding.
paseo daemon pair --relayKeep the #offer=… fragment intact. The hostname before it can be a Paseo or Tailscale URL; the encrypted offer contains the relay endpoint used by Agent God Mode.
Open App → Settings → Agent Instances → Add Instance → Paseo Relay, paste the link, then connect and verify.
Install Tailscale on the device where you use Agent God Mode and join the same tailnet as the Agent Instance. Your browser then connects directly to Paseo over the private network; Agent God Mode does not need a public route to the instance.
Install Tailscale on the Agent Instance and on each computer that will use Agent God Mode.
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale upKeep Paseo listening locally and use Tailscale Serve to provide a trusted .ts.net HTTPS/WSS endpoint inside the tailnet.
sudo tailscale serve --bg http://127.0.0.1:6767
tailscale serve statusWhile Tailscale is connected on your computer, choose Tailscale Direct and enter wss://your-host.your-tailnet.ts.net/ws. The browser verifies the daemon, providers, projects, and workspaces directly.
Choose a one-time CloudFormation launch or connect your AWS account for managed provisioning. Both approaches create an Ubuntu instance with no inbound ports, Session Manager access, an encrypted root volume, and Paseo plus the supported agent CLIs.
Open a prefilled CloudFormation stack, review it, and launch it yourself. Agent God Mode has no continuing AWS access; you pair the completed Agent Instance manually.
Authorize a narrowly scoped role once. Agent God Mode can then create, monitor, pair, retry, open, and delete Agent Instances without storing AWS access keys.
This infrastructure cost is billed directly to your AWS account. The estimate uses 730 hours of Linux On-Demand usage in US East (Ohio). Data transfer, surplus T3 CPU credits, taxes, and optional VPC services such as a NAT Gateway are additional.
Open App → Settings → AWS Accounts and name the account. Agent God Mode prepares a unique, restricted AWS access configuration.
Use Create AWS Access for the guided CloudFormation setup, or choose Set Up AWS Access Manually to copy the exact trust and permissions policies. The complete template creates the connection, CloudFormation, and EC2 roles required for automatic deployment.
Wait for the access stack to show CREATE_COMPLETE. Open that stack’s Outputs tab, find the row with key ConnectionRoleArn, and copy its Value into Agent God Mode. Do not use ExecutionRoleArn or InstanceProfileName.
Choose a supported region, VPC, routed subnet, instance size, and encrypted disk. Agent God Mode creates the stack, waits for Session Manager, and pairs Paseo over encrypted Relay.
For a managed AWS Agent Instance, choose Sign In GitHub from the completed deployment or from Settings. Agent God Mode runs a fixed command through SSM, shows the device URL and one-time code, and leaves the resulting credential only on the instance.
Open an Ubuntu session for Claude, Codex, and Cursor, then complete each provider’s displayed login flow.
claude update
BROWSER=echo claude auth login
codex login --device-auth
cursor-agent loginUpdating Claude first includes its remote OAuth paste fix. Codex uses a device-code flow. Cursor currently has no documented device-code flag; use CURSOR_API_KEY if its browser flow cannot complete. GitHub remains available as a manual fallback with GH_BROWSER=echo gh auth login --hostname github.com --git-protocol https --web --skip-ssh-key.
In Agent Instance settings, check each CLI you authenticated and choose Verify Providers. Paseo will rediscover the provider catalog; ready Cursor models then become available for the Builder role.
Copy the Ubuntu Session command shown in Agent God Mode when you need an unrestricted terminal. AWS browser sessions start as ssm-user; Agent God Mode copies sudo -iu ubuntu when opening that fallback.
paseo daemon statuspaseo provider diagnostic claude
paseo provider diagnostic codexpaseo --host "$OFFER_URL" ls -aIf provider discovery still fails, verify the binary is installed for the daemon user and visible in that user’s PATH. See Paseo provider diagnostics.