Teeny Tiny,recipes.

Before you start

• A GitHub account that can read the repositories.
• A machine. See the quick start.

Steps

1. 1

   Open Integrations

   Sign in and open Integrations.

2. 2

   Connect GitHub

   In the GitHub card, click Connect GitHub. Approve the authorization on GitHub in five minutes.

3. 3

   Install the GitHub App

   If the card shows Install the GitHub App, click Install GitHub App. On GitHub, select the repositories that your machines can use.

4. 4

   Set your Git name and email

   Do this one time on each machine, before your first commit.

   $git config --global user.name "Your Name"
   $git config --global user.email you@example.com

Check it

On the machine, clone a repository, commit a change, and push it.

• HTTPS and SSH addresses for github.com both go through Teeny Tiny.
• To add or remove repositories, click Manage repositories in the GitHub card.
• Every machine on your account gets the same repositories.
• You cannot use Git LFS on a machine.

Disconnect

In the GitHub card, click Disconnect. Every machine loses GitHub access at once. Cloned repositories and local commits stay on the machine.

To remove the GitHub App from your GitHub account too, uninstall it in your GitHub settings.

Before you start

• GitHub connected, with the GitHub App installed on the repository. See GitHub.
• Admin access to the repository.
• A repository that is not public.
• The Teeny Tiny CLI, signed in. See the quick start.

Steps

1. 1

   Turn on runners for the repository

   $teenytiny workflows add <owner>/<repo> --runners

   Do not add --branch. Teeny Tiny refuses --runners with --branch.

2. 2

   Set runs-on in the workflow

   Set this value on each job that must run on Teeny Tiny.

   runs-on: [self-hosted, teenytiny]

   You can also add linux and x64. Teeny Tiny ignores a job with other labels.

3. 3

   Push the workflow

   Push the change to GitHub, then start the workflow.

Check it

• Open the run on GitHub. The runner name is teenytiny-<machine-id>.
• The dashboard shows the machine when the job runs.
• A runner machine runs for 6 hours at most.
• A runner machine cannot use your GitHub connection, Drive, or integrations.

Disconnect

Turn off runners and keep the repository on your list:

Or remove the repository from your list:

Before you start

• A 1Password account that can make service accounts.
• A machine. 1Password is for machines only. The Agent sandbox cannot read your vaults.

Steps

1. 1

   Make a service account in 1Password

   Give it read access to only the vaults that your machines must see. Copy its token. The token starts with ops_. See 1Password service accounts.

2. 2

   Paste the token in Teeny Tiny

   Open Integrations. In the 1Password card, paste the token in Service account token. Click Connect. The card then shows the vaults that the token can read.

3. 3

   Use 1Password on a machine

   All your machines can read the vaults at once. You do not have to restart a machine that runs. See Which machines get integrations.

Check it

On the machine, run this command. It prints connected.

• You can type 1p for 1password. The old command tt-secrets works until the next release.
• A reference uses the vault, item, and field titles. If a title has characters other than letters, digits, spaces, _, ., and -, use the IDs: op://<vault-id>/<item-id>/<field-id>.
• 1Password lets a service account make 1,000 requests a day on individual and family plans. The limit is 5,000 on Teams and 50,000 on Business.

Disconnect

In the 1Password card, click Disconnect. Teeny Tiny deletes the token, and machines cannot read your vaults.

Then delete the service account in 1Password.

Before you start

• A Teeny Tiny account. Machines get Drive with no connection step.

Steps

1. 1

   Open Drive

   Open Drive in the dashboard. Upload, move, and delete files there.

2. 2

   Make a password for your computer

   In the Connect a computer card, click Connect. Type a name in Name this computer and click Create password. Copy the Server address, the Username, and the Password. You see the password one time only.

3. 3

   Connect from macOS

   In Finder, choose Go → Connect to Server (⌘K). Paste the server address and click Connect. Choose Registered User, then paste the username and password.

4. 4

   Or connect from Windows

   In File Explorer, open This PC and choose Map network drive. Paste the server address as the folder. Tick Connect using different credentials, then paste the username and password.

Check it

On a machine, list the files in Drive.

For the limits of Drive, see Drive limits.

Disconnect

On the Drive page, click Revoke next to the name of the computer. That computer cannot open your Drive. Your files, your browser sessions, and the CLI do not change.

Before you start

• A Tailscale account that can change the tailnet policy file and make OAuth clients.

Steps

1. 1

   Add a tag to your tailnet

   In the Tailscale admin console, open the tailnet policy file. Add a tag owner, for example:

   "tagOwners": { "tag:teenytiny": ["autogroup:admin"] }

   Add access rules that limit what the tag can reach. Machines can then reach only those services.

2. 2

   Make an OAuth client

   In the Tailscale admin console, make an OAuth client. Give it the auth_keys write scope and the devices:core write scope. Limit each scope to your tag. Copy the client ID and the secret. See Tailscale OAuth clients.

3. 3

   Paste the client in Teeny Tiny

   Open Integrations. In the Tailscale card, paste the values in OAuth client ID and OAuth client secret. Type your tag in Tag. The default is tag:teenytiny. Click Connect.

4. 4

   Start the machine

   A machine joins your tailnet when it starts. If the machine runs now, run tt plugin tailscale up on it, or stop it and start it again. See Which machines get integrations.

Check it

On the machine, run this command. It prints running when the machine is on your tailnet.

• You can type ts for tailscale. The old command teenytiny-tailscale status works until the next release.
• The device name is tt- and the machine name, for example tt-demo.
• Programs reach the tailnet through a proxy. A new terminal sets ALL_PROXY to socks5h://localhost:1055 and HTTPS_PROXY to http://localhost:1056.
• Open a new terminal after the machine joins. Old terminals keep their old proxy settings.
• Teeny Tiny keeps your OAuth client. The machine gets only a key that it can use one time, for 10 minutes.

Disconnect

In the Tailscale card, click Disconnect. Teeny Tiny forgets the OAuth client and removes its machines from your tailnet.

Then revoke the OAuth client in the Tailscale admin console.

When a machine stops or you delete it, Teeny Tiny removes its device from your tailnet.

Before you start

• An Executor workspace, in Executor Cloud or on your own server.

Steps

1. 1

   Make an API key in Executor

   In the settings of your Executor workspace, make a personal API key. See the Executor docs.

2. 2

   Paste the key in Teeny Tiny

   Open Integrations. In the Executor card, keep the MCP URL for Executor Cloud. For your own server, type its MCP URL. Paste the key in API key. Click Connect.

3. 3

   Start the machine

   A machine gets the Executor tools when it starts. If the machine runs now, run tt plugin executor sync on it, or stop it and start it again. See Which machines get integrations.

Check it

Teeny Tiny adds an MCP server with the name executor to Claude Code, Codex, and pi. Its address is http://teenytiny-mcp.internal/executor. On the machine, list the MCP servers of Claude Code:

• Teeny Tiny writes the server into ~/.claude.json, ~/.codex/config.toml, and ~/.pi/agent/mcp.json.
• If you have your own MCP server with the name executor, Teeny Tiny does not change it.
• Agents call your sources through the execute tool of Executor. To add sources and approval rules, click Manage sources and policies in the Executor card.

Disconnect

In the Executor card, click Disconnect. Teeny Tiny deletes the API key, and agents lose the Executor tools.

Then delete the API key in Executor.