Naïve and Paperclip: attribution, MIT, and what we actually build

How Naïve attributes the open-source software it builds on, why MIT-licensed code in a commercial product is the point of the license, and where the line sits between upstream code and the stack we built ourselves.

Attribution exists, and always has

When we first published this post in April 2026, a claim was circulating that Naïve provided "zero attribution" for Paperclip, the MIT-licensed agent orchestration framework an early version of our product was built on. That claim was false then and it is false now, so we are leaving this post up and keeping it current.

Section 7.4 of our Terms of Service says:

"The Service incorporates open source software components, including Paperclip, licensed under the MIT License. Copyright © 2025 Paperclip AI. Full license terms are available in the project repository and on our Open Source Licenses page. Nothing in these Terms restricts your rights under applicable open source licenses."

That section was in our Terms when the claim was made, and it is there today. It links to the Paperclip GitHub repository, names the license, and reproduces the copyright line. Our open-source licenses page carries the full MIT license text for Paperclip alongside the notices for the other upstream projects we ship. That is what the MIT license asks for: keep the copyright notice and the permission notice with the software. We did, and we still do.

Paperclip was the most visible dependency, but it was one of many. The licenses page lists the rest, and every open-source project we build on next goes on it too.

Residual strings are not a smoking gun

The other half of the claim was that leftover "Paperclip" references in our production bundle proved we were hiding something. They proved the opposite.

When you build on a large open-source project, string literals, CSS class names, and config defaults flow through from upstream. Not every internal identifier gets rebranded, because rebranding identifiers is work that produces nothing for users. Every large SaaS product ships hundreds of upstream references in its bundle. Open a minified bundle from any company you admire and you will find the names of the libraries they depend on.

Framing inherited artifacts as concealment misrepresents how software gets built. Those strings were evidence of usage, and the usage was disclosed in the one document every customer agrees to.

What Naïve builds today

The more useful question was never "did you use Paperclip". It was "what did you build". Here is the honest answer for the product as it exists now, which is different from the product that existed in April.

Naïve is company templates run by agents. A template lives in a blueprint, a public repository with a naive.config.ts in it: the agent team, their prompts, their tool allow-lists, their schedules, and the apps the company runs on. You clone it, claim it against your organization, and naive up provisions the whole thing:

naive template agency
cd agency
naive claim --key sk_...
naive up

naive up reconciles what the config declares (skills, identities, vaults, apps, agents) against what exists, and reports every resource as created, updated, unchanged, deleted, or refused. Re-running it is always safe. The naive CLI reference has the full surface.

The agents those templates provision run on Vetta, our managed agent for long-horizon tasks. Vetta is three layers, and we operate all of them:

The thesis behind that split is that the model is a commodity and everything around it decides the cost of a finished task. We optimise the three layers together, and we publish the result on the benchmark page. How Vetta works walks through each layer.

Underneath the agents sit the primitives, which is the part of Naïve that never had anything to do with orchestration:

• Identity and legal. KYC, a real US company, domains, a custom-domain inbox, and a phone number an agent can text from.
• Money. Virtual cards with a hard spend cap the agent cannot raise, and a USD budget quoted before every call.
• Hands. A real computer with a shell, a filesystem, and a browser, plus OAuth connections into the apps a business already pays for.
• Content. Image, video, clips, audio, and social publishing from one compose.

None of this existed in Paperclip. None of it depends on which harness an agent runs on. That was true when we used Paperclip and it is true now.

Paperclip is no longer in our stack

We removed Paperclip from the product in the spring of 2026. We say this plainly because the honest version of an open-source story includes the part where you stop using something.

We chose Paperclip for the first version because it was MIT-licensed, well-engineered, and pointed in the direction we thought agent infrastructure was heading. We still respect the project and the people behind it. What changed is that the runtime layer became the thing we needed to own. A company that runs for months needs a session loop that wakes, takes one bounded turn, commits, and sleeps, so that an idle agent costs storage rather than a machine held hot. It needs a budget gate that refuses a call before it runs rather than reporting overspend the next morning. It needs tool policy that leaves a denied tool out of the model's view entirely. Those are runtime properties, and we built the runtime to have them.

Removing Paperclip did not remove the attribution. The Terms section is still there, the licenses page is still there, and they will stay until the last artifact of that code is gone from anything we ship. Attribution is a record of what you built on, not a marketing claim about what you use today.

We still build on open source

Nothing about that decision made us less dependent on open source. The default harness a Vetta agent runs on, pi, is an open-source coding agent under the MIT license. We name it in our documentation, and it carries the same obligation we met for Paperclip: keep the copyright notice and the license text with the software. We chose not to write our own agent loop for the default case for the same reason we chose Paperclip at the start: a well-engineered open project beats a hand-rolled one, and the license exists so that people can build on it. The harness documentation lists the loops an agent can run on, what each one holds while idle, and which capabilities it declares. We also ship our own loop, vetta, held to a small measured core and the only one that runs inside the session itself.

We also publish. The blueprint repositories our templates deploy from are public under github.com/usenaive. naive template clones one with the git history dropped, on purpose: the first commit of your company should be yours. You can read every prompt, every tool allow-list, and every schedule before an agent spends a cent under your organization. A template is not a black box you rent; it is code you own from the moment you clone it.

We believe the agent infrastructure layer should be composable and open. We say that as practitioners, not as a slogan. We build on MIT code, we credit it, and we publish the parts of our own work that others can build on.

What the MIT license is for

Using MIT-licensed software in a commercial product is not a grey area. It is the explicit purpose of the license. The MIT license grants permission to use, copy, modify, merge, publish, distribute, sublicense, and sell copies of the software, with one condition: keep the copyright notice and the permission notice. Every company shipping a Node application, a React frontend, or a Postgres client does exactly this thousands of times over.

Authors who choose MIT are choosing this outcome. The projects we build on chose it, and we are grateful for the foundation they provide. Compliance means honouring the one condition, which we do, and it means being honest about what is upstream and what is ours, which is what this post is for.

Where we stand

We are a small team building fast, and we will not get everything right. We welcome good-faith criticism, including about the code we shipped in April. But the narrative that we stripped attribution and presented someone else's work as our own was wrong on the facts. Attribution is in our Terms and on our licenses page. The product is company templates, the primitives underneath them, and a managed agent we built across every layer. And our commitment to open source is visible in what we build on and what we publish.

If you are weighing whether to run agents on a managed runtime or bring your own, hosted vs bring-your-own runtime covers the tradeoffs. Questions about this post can go to dennis@usenaive.ai.