Paw

On a server

Your agents keep working while your laptop sleeps.

A long task shouldn't die because you closed the lid. Run Paw on a small server and use it from the Mac app or your phone. Same chats, same workspace, and the work goes on.

Laptop and phone reach Paw on a server through Tailscale A sleeping laptop on the left, a server running pawd and its agents in the middle, a phone on the right. Dashed lines between them are labelled Tailscale. Underneath: the public internet gets nothing. Your Mac lid closed z z z Your server pawd, always on Builder Reviewer Planner still working Your phone same app Tailscale Tailscale public internet: nothing

Why bother

Laptops sleep. Builds don't.

An agent that is halfway through a refactor doesn't care that you walked to the kitchen. On a server it keeps going, and Paw tells you when it finishes or needs you.

  • Agents keep running through a deploy: only pawd restarts, and a small holder process keeps each agent alive
  • Your phone sees the same chats and the same workspace as your Mac
  • Files, terminals, the browser and the agents all act on the server
  • Offline on the phone? Chats are cached and messages queue until you're back

Set it up

Three steps. One of them is a command.

  1. Put Paw on the server

    Run the deploy script from the repo. It builds Paw on the server, sets it up as a service and restarts it. You tell it which login is allowed to open Paw. 

    scripts/deploy-vps.sh --host user@host --owner you@example.com

  2. Point Tailscale at it

    On the server, serve the owner-only port to your tailnet. That is the only thing that makes Paw reachable, and only from your own devices. 

    tailscale serve --bg http://127.0.0.1:7291

  3. Connect

    In the Paw Mac app, open Settings, then Server, and paste the server's link. On your phone, open the same link and add it to the home screen. Agents on the server sign in to Claude with a token from claude setup-token.

The security model

Who can reach what.

Short version: only you, only over Tailscale, only with the token. The long version is a table.

Door Who gets in How
Port 7291
for you 		Only the owner you named The owner's Tailscale login plus the token. Anything else is turned away.
Port 7290
for agents 		Agents on the same machine Token only, and it listens on localhost. You never point Tailscale at it.
Public internet Nobody Nothing is open. If Tailscale Funnel gets turned on, Paw warns you.
Analytics and trackers None No cookies on this site and none in the app.

Don't share the link

The link you open on your phone carries your token. Treat it like a password.

Questions

Do I need a server to use Paw?

No. Paw runs on your Mac as it is. The server is for work that should go on while the laptop is closed.

Do I need Tailscale?

For the phone and for a server, yes. It is how your devices reach Paw without a public address. On the Mac alone, no.

What does the server need?

A small Linux machine you control. The deploy script makes a user for Paw, installs what it needs and writes the service.

How do agents sign in to Claude there?

With a token from claude setup-token, placed in the server's Paw environment file.

What if the server restarts?

Paw comes back up with it. Agents start again on their next message.