vibeshare-liveCAUTION
Share a live agent coding session by URL, for developers who pair in a browser.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Share your live agent coding session by URL — traces.com-style, open source, CLI-first. Spectators watch read-only; invite links let viewers request to join as collaborators (host approves, live).
Part of the Vibe Suite — companion tools for agentic coding CLIs (Claude Code, Codex, Gemini, Grok/pi, Kimi). Ships as CLI + npm package + MCP server, built on `@pooriaarab/vibe-core` (consent ledger, hooks bus, badges).
Local-first: the share runs on your machine. The consent ledger gates every share (share:session scope), the stream is served straight from your host, and nothing is stored on a server.
Works with any harness
vibeshare shares a LIVE TERMINAL SESSION. It wraps a PTY, so the program inside is irrelevant — any agent CLI, shell, or TUI renders faithfully (colors, cursor, full-screen) via xterm.js in the browser.
Two ways to share a session:
- Wrap at launch (no tmux):
vibeshare --public --— vibeshare is the parent, PTY-captures. Examples:vibeshare --public -- claude,-- codex,-- gemini,-- aider,-- opencode,-- kimi,-- amp, or any shell/command. - Attach to an already-running session (needs tmux): run the harness inside tmux, then
vibeshare attachtaps it live. Harness-agnostic — it captures the terminal, not the app.
Verified harnesses (all render the real TUI live): Claude Code (claude), OpenAI Codex (codex), Gemini CLI (gemini), aider (requires pip install aider-chat), opencode, Moonshot Kimi (kimi), pi (grok/glm), Sourcegraph amp (requires its own PATH setup). Others (Continue, Goose, Crush, Qwen, Cursor Agent, Warp, Zed, ...) wrap identically — they're just terminal programs.
Modes:
fc17bb0f9633OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add vibeshare-live -- npx -y [email protected] mcp
Exposed tools (3)
1 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
vibeshare_create | write | Share this live session by URL. Spectators watch read-only; with access= |
vibeshare_stop | write | End a live share: viewers are disconnected and the URL stops working. |
vibeshare_viewers | read | List viewers of a live share: who is watching, roles, and pending join requests. |
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
res = await fetch(`http://127.0.0.1:${record.port}${path}`, {'-----BEGIN PRIVATE KEY-----',
.cursorignore
.jscpd.json
.oxlintrc.json
expect(() => new Function(js)).not.toThrow();
expect(() => new Function(js)).not.toThrow();
import { xtermPageStyles } from '../../xtermClient.js';import { xtermScriptTags, XTERM_BOOT_JS } from '../../xtermClient.js';import { xtermPageStyles } from '../../xtermClient.js';import { xtermScriptTags, XTERM_BOOT_JS } from '../../xtermClient.js';import { XTERM_BOOT_JS, xtermPageStyles, xtermScriptTags } from '../../xtermClient.js';url: http://127.0.0.1:50613/s/KKxzdjLpr_km
const base = `http://127.0.0.1:${server.port}`;const res = await fetch(`http://127.0.0.1:${server.port}/control/viewers?share=x`);base = `http://127.0.0.1:${transport.port}`;var bin = atob(b64);
var bin = atob(s);
var bin = atob(b64);
var bin = atob(b64);
export const VIEWER_JS_PART_2 = ` var bin = atob(b64);
@pooriaarab/vibe-core, @xterm/addon-fit, @xterm/xterm, node-datachannel, node-pty, vibelive, ws, @cloudflare/workers-types
@pooriaarab/vibe-core, @cloudflare/workers-types, typescript, wrangler
**Local-first: the share runs on your machine.** The consent ledger gates every share (`share:session` scope), the stream is served straight from your host, and nothing is stored on a server.
Badge: "● p2p · e2e · nothing stored on a server". `share:session` consent grant
Gates applied: no_behavioural_pass.
fc17bb0f9633full audit observations/trust-audit/mcp-server/pooriaarab__vibeshare.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | fc17bb0f9633 | CAUTION | C | 79 | first audit |
Questions
What is the vibeshare-live MCP server?
Share a live agent coding session by URL, for developers who pair in a browser.
What tools does vibeshare-live expose?
3 in total: 1 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is vibeshare-live safe to connect to an agent?
With care. The audit graded it C (79/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does vibeshare-live need?
No credential environment variables were found in its source, so it appears to need none.
How does vibeshare-live run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as vibeshare-signaling at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (fc17bb0f9633), read on 2026-10-12. The repository is watched and re-audited when it changes.