paperclipai/paperclip · error

Existing Anthropic Environment does not match Paperclip's no

Error message

Existing Anthropic Environment does not match Paperclip's no-network, no-package profile

What it means

`assertSafeManagedEnvironment` verifies that an existing Anthropic Environment matches Paperclip's locked profile: not archived, cloud type, limited networking with MCP servers and package managers disabled, an empty allowed_hosts list, and no installed packages. Any deviation throws this error. It is a safety check so Paperclip never drives an environment with broader network/package capabilities than expected.

Source

Thrown at cli/src/commands/managed-agent.ts:191

export function assertSafeManagedEnvironment(environment: Record<string, unknown>): void {
  const config = record(environment.config);
  const networking = record(config.networking);
  const packages = record(config.packages);
  const installed = Object.entries(packages)
    .filter(([key]) => key !== "type")
    .flatMap(([, value]) => (Array.isArray(value) ? value : [value]))
    .filter((value) => value !== undefined && value !== null);
  if (
    environment.archived_at !== null
    || config.type !== "cloud"
    || networking.type !== "limited"
    || networking.allow_mcp_servers !== false
    || networking.allow_package_managers !== false
    || !Array.isArray(networking.allowed_hosts)
    || networking.allowed_hosts.length > 0
    || installed.length > 0
  ) {
    throw new Error(
      "Existing Anthropic Environment does not match Paperclip's no-network, no-package profile",
    );
  }
}

export function assertSafeManagedAgent(agent: Record<string, unknown>): void {
  const model = typeof agent.model === "string" ? agent.model : record(agent.model).id;
  if (
    agent.archived_at !== null
    || agent.system !== CLAUDE_MANAGED_SYSTEM_PROMPT
    || typeof model !== "string"
    || !model
    || !Array.isArray(agent.tools)
    || agent.tools.length > 0
    || !Array.isArray(agent.mcp_servers)
    || agent.mcp_servers.length > 0
    || !Array.isArray(agent.skills)
    || agent.skills.length > 0

View on GitHub (pinned to 5716fe907e)

Solutions

1. Omit --environment-id and let Paperclip create/resolve a matching environment automatically
2. Recreate the environment via Paperclip setup so it is provisioned with the locked profile
3. If you want to keep the environment, revert its config: type cloud, networking limited with allow_mcp_servers=false, allow_package_managers=false, allowed_hosts=[], no packages, unarchive it
4. Inspect the environment JSON (GET /v1/environments/:id) and compare each field against the profile to find the offending one

Example fix

// before
--environment-id env_existing_general_purpose
// after (let Paperclip resolve/create)
paperclip managed-agent setup ... # no --environment-id
// or fix the env config:
{"config":{"type":"cloud","networking":{"type":"limited","allow_mcp_servers":false,"allow_package_managers":false,"allowed_hosts":[]},"packages":{}}}

// Fetch and check before passing --environment-id:
const env = await getEnvironment(key, environmentId);
const cfg = env.config ?? {};
const net = cfg.networking ?? {};
const unsafe = env.archived_at !== null || cfg.type !== "cloud" || net.type !== "limited"
  || net.allow_mcp_servers !== false || net.allow_package_managers !== false
  || (net.allowed_hosts?.length ?? 1) > 0 || Object.keys(cfg.packages ?? {}).filter(k => k !== "type").length > 0;
if (unsafe) throw new Error("Environment does not match the locked no-network/no-package profile");

function isSafeEnvironment(env: Record<string, unknown>): boolean {
  const cfg = (env.config ?? {}) as Record<string, unknown>;
  const net = (cfg.networking ?? {}) as Record<string, unknown>;
  const pkgs = (cfg.packages ?? {}) as Record<string, unknown>;
  return env.archived_at === null && cfg.type === "cloud" && net.type === "limited"
    && net.allow_mcp_servers === false && net.allow_package_managers === false
    && Array.isArray(net.allowed_hosts) && net.allowed_hosts.length === 0
    && Object.keys(pkgs).filter(k => k !== "type").length === 0;
}

try {
  await setupManagedAgent(opts);
} catch (err) {
  if (err instanceof Error && err.message.includes("no-network, no-package profile")) {
    console.error("Environment drifted from the locked profile — recreate via Paperclip or revert its config"); process.exitCode = 2;
  } else throw err;
}

When it happens

Trigger: Passing --environment-id pointing at an environment you configured manually with allowed_hosts entries, MCP servers enabled, or packages installed; an environment whose config.type is not "cloud" or networking.type is not "limited"; reusing an archived environment; someone loosened the environment's networking settings after Paperclip created it.

Common situations: Hand-editing the environment in the Anthropic console to add an allowed host for debugging, then the next Paperclip run rejects it; pointing the CLI at a pre-existing general-purpose environment instead of one Paperclip created; beta API changes altering field defaults so a previously-valid env no longer parses as safe.

Related errors

• Existing Anthropic Agent enables or omits the locked tools,
• managed_profile_not_found
• agentcore_profile_not_found
• paperclip_runner_aws_agentcore_profile_mismatch
• ACPX session profile differs from its initialization

AI-assisted analysis of paperclipai/paperclip@5716fe907e (2026-09-02). Data as JSON: /api/errors/62962b72eb02b71a. Report an issue: GitHub.