Bring your own key, or your own machine

There are now two ways to run Clusy on inference you already pay for.

Bring your own key. Connect an Anthropic or OpenAI API key in Settings → Integrations, and Sonnet 5, Opus 4.8 and GPT-5.6 appear in the model picker marked Your key. Connecting the key is the only thing that unlocks them, and the turns they run cost zero Clusy credits.

Bring your own machine. If you already use the Claude Code or Codex CLI, pair the machine it runs on. Those CLIs then appear in the same picker marked Your machine, and Clusy drives the CLI you already have — signed in as you, on your own subscription — while your notebook keeps running in the cloud.

If you already pay Anthropic or OpenAI, you have already bought the inference. There is no good reason for us to make you buy it twice.

The key is the whole gate

Worth being precise about: BYOK is gated on the connected key, and on nothing else.

Internally, the check for whether you may use a model returns as soon as it sees the connected provider — it never reaches any further entitlement check. Connect an Anthropic key and you get Opus 4.8, the same Opus 4.8 as anyone else who connects one. There is no flag, no waitlist, and no upsell in the middle.

Your key is encrypted at rest, it is verified against the provider once when you connect it so a typo fails immediately rather than three turns later, and it is used for nothing except the turns you run.

Including the work you don't see

Most bring-your-own-key implementations are quietly partial. Your key runs the visible chat turn — and then the summarizer that compacts your context, the sub-agent the model spawned, and the verification pass that checks its own work all fall back to a house model on the vendor's account, and you are billed for them.

Ours don't. Verification, sub-agents and context compaction all stay on the model you connected. The credit meter reads zero because the work is zero, not because we stopped counting some of it.

This is the claim in this post most worth attacking, so here is where it lives: model calls whose alias ends in -byok return a cost of 0.0 from telemetry, are excluded from credit metering, and the model-selection policy deliberately keeps system work on the connected slug instead of escalating to a house model.

Or bring the CLI you already have

The second option is stranger, and we think more interesting.

If you have Claude Code or Codex installed and signed in, Clusy can use it. You pair your machine once, and three rows appear in the model picker — Claude Code Sonnet, Claude Code Opus, and Codex — each badged Your machine. Pick one, and the turn is handed to the CLI sitting on your laptop, which runs on the subscription you are already paying for.

Pairing is two commands. Clusy shows you an eight-character code, and:

npm i -g https://api.clusy.io/local-runners/clusy-runner.tgz
clusy-runner pair ABCD2345

Two things worth saying plainly about that second command, because "pair" does not obviously imply either of them. It installs a background service — launchd on macOS, systemd on Linux — so your machine comes online and stays online without you keeping a terminal open. Pass --no-service if you would rather run it yourself. And it opens no inbound ports: the daemon dials out to us, so there is nothing to configure on your firewall.

Your credential never leaves your machine

This is the part that has to be exactly right, so here is exactly what happens.

Clusy never sees, stores, or transmits your Anthropic or OpenAI login. We do not broker an OAuth flow, and there is no "sign in with Claude" button anywhere in the product — you log into your own CLI yourself, the way you already do. The daemon never reads a keychain or a credential store; its entire inspection of your CLI is running claude --version and codex --version. When a turn runs, we spawn the genuine binary and it does its own authentication, in its own process, on your machine. The model traffic goes from your laptop straight to Anthropic or OpenAI. We are not in that network path, and we hold no key for it.

What does cross the wire is the turn itself: your prompt, the notebook context, the model's text and reasoning as it streams back, and the tool calls it makes. That is how the chat panel renders at all, and it is persisted in your Clusy transcript like any other turn.

So the honest claim is narrow, and it is the one that matters: your credential stays on your machine, and your inference is billed to your own subscription. Not "your data never leaves your laptop" — it does, and anyone telling you otherwise about a product with a hosted chat panel is not being straight with you.

Your machine thinks; the sandbox still runs the code

The other thing people assume, and get wrong: this does not move your notebook onto your laptop.

When a turn goes to your CLI, what runs locally is the reasoning — the model, its context, its loop. When it decides to run a cell, that cell executes in the same Clusy cloud sandbox as always, on the same CPU or GPU, against the same files. The result travels back to the CLI, which carries on thinking.

Clusy borrows the CLI's brain, not its hands. Its own shell and file tools are denied for the duration of a Clusy turn — it cannot read or write your laptop's filesystem while it is working for us.

What it can't do yet

Being specific, because you will hit these:

• One turn at a time, per machine. A second concurrent turn is refused rather than queued.
• Your machine has to be awake. A paired machine that is offline keeps its models in the picker, greyed out and badged Offline, rather than silently vanishing. A closed laptop means no local-runner turns.
• If the connection drops mid-turn, the turn dies. There is no resume yet.
• Plan Mode is not available on a local-runner turn, and neither are sub-agents or batch experiments. Branching works; the plan-approval gate does not.
• No thinking-effort control. The CLI owns its own reasoning configuration, so we show no knob rather than one that does nothing.
• Codex is less sealed than Claude Code. We pin it to a read-only sandbox with untrusted approvals, but it has no equivalent of --strict-mcp-config, so your own MCP servers remain visible to it during a Clusy turn.
• Needs Node 20 or newer. The start-at-login service is macOS and Linux; on Windows you keep clusy-runner start running yourself.

What neither of these covers

Both options zero out model inference. Neither zeroes compute.

The sandbox your notebook runs in is still ours, and it is still metered the way it always was. A local-runner turn that trains a model on a GPU is free on the inference and billed on the GPU. Only a CPU-sandbox turn is free end to end.

That is the honest shape of the deal, and it is the shape we want. We would rather sell you the notebook, the branching, the sandbox and the vault than resell you tokens at a markup.

Availability

Both are live now, for everyone. Anthropic and OpenAI keys give you Sonnet 5, Opus 4.8 and GPT-5.6. A paired machine gives you Claude Code Sonnet, Claude Code Opus and Codex. Both live in Settings → Integrations; disconnect a key or unpair a machine and the models simply leave the picker again.

What's next

Two things we're building: resume for a local-runner turn whose connection drops, and support for a self-hosted or gateway endpoint rather than a first-party provider key.