by getpaseo
Orchestrate multiple coding agents from desktop and mobile
# Add to your Claude Code skills
git clone https://github.com/getpaseo/paseoLast scanned: 4/20/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@cloudflare/vite-plugin: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@expo/config: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@expo/config-plugins: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@expo/plist: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@expo/prebuild-config: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@tanstack/react-start: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@tanstack/react-start-server: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@tanstack/start-plugin-core: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@tanstack/start-server-core: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@tootallnate/once: @tootallnate/once vulnerable to Incorrect Control Flow Scoping",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@typescript-eslint/eslint-plugin: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@typescript-eslint/parser: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@typescript-eslint/type-utils: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@typescript-eslint/typescript-estree: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@typescript-eslint/utils: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"severity": "low"
},
{
"type": "npm-audit",
"message": "eas-cli: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron: Electron: Use-after-free in offscreen shared texture release() callback",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "expo-module-scripts: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "flatted: Prototype Pollution via parse() in NodeJS flatted",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "h3: h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "http-proxy-agent: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "jest-environment-jsdom: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "jest-expo: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "jsdom: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "markdown-it: Uncontrolled Resource Consumption in markdown-it",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "miniflare: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-forge: node-forge has ASN.1 Unbounded Recursion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "react-native-markdown-display: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "smol-toml: smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "srvx: srvx is vulnerable to middleware bypass via absolute URI in request line ",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "wrangler: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-04-20T06:16:21.296Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}See how paseo compares with popular alternatives.
paseo is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by getpaseo. Orchestrate multiple coding agents from desktop and mobile. It has 20,218 GitHub stars.
paseo returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/getpaseo/paseo" and add it to your Claude Code skills directory (see the Installation section above).
paseo is primarily written in TypeScript. It is open-source under getpaseo on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh paseo against similar tools.
No comments yet. Be the first to share your thoughts!
Based on votes and bookmarks from developers who liked this skill
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Paseo is an open source agentic development environment for desktop, mobile, web, and CLI. Open the desktop app and work: agents, editor, terminals, diffs, pull requests, and a browser in one window. Run many agents at once, each in its own worktree, on one machine or several. The mobile app is the full app, native on iOS and Android.
Run parallel tasks in Paseo: start agents in separate worktrees, review their diffs, run each app, and check it in the built-in browser.
Plugins run on the daemon and show up in every client you connect, with the same UI on desktop, web, iOS, and Android. Write a plugin once and it is on your phone.
Install from the registry with paseo plugin add owner/slug, or from Git or a local directory.
Plugins run with access to your daemon machine and inside connected clients; install only code you trust.
Paseo runs a local server called the daemon that manages your coding agents. Clients like the desktop app, mobile app, web app, and CLI connect to it.
You need at least one agent CLI installed and configured with your credentials:
Download it from paseo.sh/download or the GitHub releases page. Open the app and the daemon starts automatically. Nothing else to install.
To connect from your phone, open Settings → your host → Pair Device.
For a server, a VM, or any machine without the desktop app. Install the CLI and start the daemon:
npm install -g @getpaseo/cli
paseo
Paseo starts, then asks whether to enable the end-to-end encrypted relay for device pairing. If you decline, connect directly over TCP, Tailscale, or another VPN. The desktop, mobile, and web apps connect to this daemon like any other host.
For full setup and configuration, see:
Run the Paseo daemon and self-hosted web UI in Docker:
docker run -d --name paseo \
-p 6767:6767 \
-e PASEO_PASSWORD=change-me \
-v "$PWD/paseo-home:/home/paseo" \
-v "$PWD:/workspace" \
ghcr.io/getpaseo/paseo:latest
Open http://localhost:6767 after it starts. Extend the base image with the agent CLIs you use, then provide credentials through environment variables or the persistent /home/paseo volume. See the Docker documentation for full setup details.
Everything you can do in the app, you can do from the terminal.
paseo run --provider claude/opus-4.6 "implement user authentication"
paseo run --provider codex/gpt-5.5 --worktree feature-x "implement feature X"
paseo ls # list running agents
paseo attach abc123 # stream live output
paseo send abc123 "also add tests" # follow-up task
# run on a remote daemon; --cwd is a path on that host
paseo run --host workstation.local:6767 --cwd /workspace "run the full test suite"
See the full CLI reference for more.
Build issue integrations, dashboards, and orchestration services with @getpaseo/client:
import { createPaseoClient } from "@getpaseo/client";
const client = createPaseoClient({ url: "ws://127.0.0.1:6767/ws" });
await client.connect();
const agent = await client.agents.create({
config: { provider: "codex/gpt-5.5" },
cwd: "/Users/me/dev/storefront",
prompt: "Review the current diff and name the riskiest change.",
});
const result = await agent.waitForFinish();
console.log(result.lastMessage);
await client.close();
See the SDK quickstart, recipes, and API reference.
Skills teach your agent to use Paseo to orchestrate other agents.
npx skills add getpaseo/paseo
Then use them in any agent conversation:
/paseo-handoff — hand off work between agents. I use this to plan with Claude and then handoff to Codex to implement./paseo-advisor — spin up a single agent as an advisor for a second opinion, without delegating the work itself./paseo-committee — form a committee of two contrasting agents to step back, do root cause analysis, and produce a plan.Quick monorepo package map:
packages/server: Paseo daemon (agent process orchestration, WebSocket API, MCP server)packages/app: Expo client (iOS, Android, web)packages/cli: paseo CLI for daemon and agent workflowspackages/desktop: Electron desktop apppackages/relay: Relay transport and encryption used by the daemon and clientspackages/website: Marketing site and documentation (paseo.sh)Common commands:
# run all local dev services
npm run dev
# run individual surfaces
npm run dev:server
npm run dev:app
npm run dev:desktop
npm run dev:website
# build the server stack
npm run build:server
# repo-wide checks
npm run typecheck
Paseo is an independent project used by tens of thousands of developers daily, built by one person and funded by the people who use it. Support the work on GitHub Sponsors. Companies can sponsor Paseo monthly and have their logo shown here and on the paseo.sh homepage.
Apache-2.0