selan.ai Gateway Reactor Browser
Apps

Docs · Apps

Run agent apps on your company's accounts

selan app installs and starts a third-party agent on your company's models, connectors and limits. The catalog is public and every step is bash you can read. For how the pieces fit together, start at the docs.

Get started

What is selan app?

A way to run an agent app that is not Claude Code, Codex or OpenCode on your company's Selan accounts. The catalog includes:

Each app talks to Selan's gateway in the Anthropic Messages format, so your company's models, spend limits and secret scanning apply, and the usage is counted to you. 

selan app list

Where do the scripts come from?

From github.com/selan-ai/selan-apps, a public repository. It has one folder per app, and each folder has an install.sh and a run.sh in plain bash. The list of apps is catalog.json.

The scripts are visible on purpose. An app gets your session or a token, so you should be able to see what it does with it. Two rules hold for every app:

  • The scripts write only under the app's own folder, ~/.selan/apps/name. Never your shell rc files, a global install or the app's default home.
  • The token is not written to disk, unless the app has to keep a key itself. The first lines of that app's README say so.

How do I run an app with selan?

You need selan signed in. See Install and Sign in. Then: 

selan app hermes chat
selan app paperclip

Everything after the app's name goes to the app. Here is what selan app does:

  1. Reads the repository at main, every time. A new app or a fix reaches you without a Selan release.
  2. Prints the commit and every line of install.sh and run.sh.
  3. Asks [y/N] the first time, and again whenever one of the two scripts has changed since you said yes. Only y or yes approves; Enter refuses.
  4. Checks the tools the app needs are on your PATH.
  5. Runs install.sh, then run.sh with your own session.

With no terminal and nothing approved yet, it refuses. It needs bash, so it runs on macOS and Linux. On Windows it is refused: use WSL.

How do I run an app without selan?

The same scripts, run by you. You need an API token, which an owner mints in control under Settings → API tokens. Read the script before you run it. 

export SELAN_TOKEN=selanct_...
curl -fsSL https://raw.githubusercontent.com/selan-ai/selan-apps/main/hermes/install.sh | bash
~/.selan/apps/hermes/run.sh chat

For Paperclip, use paperclip in both places and a bare run.sh. Both ways read your company's settings from the gateway, so they get the same ones: Hermes gets the models, connectors and plugin marketplaces. Paperclip gets the models, and its agents keep Claude Code's own connectors and skills.

What does an app script read?

Three variables. selan app sets them; by hand, you set the first.

  • SELAN_TOKEN: your session's token, fresh for each launch. By hand it is required.
  • SELAN_GATEWAY: the gateway's address. By hand it defaults to https://gw.selan.ai.
  • SELAN_APP_HOME: where the app lives. It defaults to ~/.selan/apps/name.
Claude models served from a Claude subscription do not answer in Hermes Agent, but they do in Paperclip's agents. Hermes shows “Anthropic rejected this request as malformed” and “HTTP 400: Third-party apps now draw from your extra usage, not your plan limits.” Paperclip's agents are Claude Code itself, so a Claude model answers normally there. Every other model answers in both; for Claude on your subscription in Hermes, use selan claude.

Always on

How do I put an app on a server?

The same repository is a Claude Code plugin with three deploy skills. Add it, then ask Claude to deploy an app. 

/plugin marketplace add selan-ai/selan-apps
/plugin install selan-apps@selan-apps
SkillWhere it runs the app
deploy-localThis machine, with selan app or by hand. As a launchd or systemd user service if you want it always on.
deploy-google-cloudA Compute Engine VM in your own project, as a systemd service. You reach it over SSH through IAP, with no firewall port open.
deploy-hostingerA Hostinger VPS you already have, as a systemd service, over SSH. It has not been tested against a real VPS.

Each skill runs the same install.sh and run.sh, and shows you the commit and the scripts first. A server cannot use your session, so a remote deploy needs an API token that lasts. An owner creates it under Settings → API tokens and you paste it into a line that hides it, so Claude never sees it. It is kept in Secret Manager or in a file only root can read, and it is revoked when you remove the deploy.

How does an app get added?

With a pull request to selan-apps. An app is a folder with an install.sh, a run.sh and a README.md, and an entry in catalog.json with its name, description, homepage and the commands it needs on the PATH. The repository's CLAUDE.md has the rules. It is MIT licensed.