A Claude Code plugin
Share a Claude Code session with a link
Teammates join from their own Claude Code and talk to it. One session does the work, everyone sees every turn as it streams, and the host approves what runs on their machine.
claude plugin marketplace add Paradigm-Study/claude-share && claude plugin install shared-session@claude-shareThen start a new session and press Share above the prompt (or type /share-session). For your team, press Team: sign in with GitHub or Google, and everything your team shares is a press from joining. Requires Claude Code 2.1.286 or later.
What this server sees and keeps
- What passes through: while a session is shared, its prompts and the files people attach to them, Claude's replies and, while someone else is in the room, its thinking as it happens (passed along, never kept), the tools it runs with the first lines of their results and the pictures in them (screenshots, images it opens), the side chat, people's reactions to Claude's replies and which replies each person has had on screen, and any files or local previews the host's Claude shows. Sharing a session that already has history asks first whether to include it.
- How long: a room and everything in it is deleted 24 hours after the host stops sharing or was last seen. For TCP previews the room keeps grants (which preview and seat, and when they expire) and coarse connection and byte-budget counters until the room is deleted; expired or revoked grants are removed sooner. Application TCP bytes are relayed, never stored. There are no analytics, and no request logs kept.
- Accounts, only for teams: sharing and joining need none. If you sign in (GitHub or Google) to use teams, the server keeps your name, username, verified email, which GitHub organizations you're in, the teams you're in and their settings, which open sessions are shared with each team, and invites to a session (who invited whom, until it's joined, dismissed, ends, or 12 hours pass). Sign-ins are kept as hashes, never the token itself. They stay until you delete your account (
/team delete-account), which removes them at once. Signed in, a session you share or join also knows your account for as long as it lasts, so your sessions count as one person. - Who can see it: anyone with the room's link, or for a session shared with a team that keeps it to its people, only the people in that team. Links are long and random; forward one only to people you'd hand the session to. Content is encrypted in transit, not end to end: the server can read what passes through it.
- What runs where: a teammate's prompt runs on the host's machine. Reads inside the host's project run without asking; everything else asks the host first, by default.
- Limits: new rooms and joins are rate-limited per network; rooms hold up to 20 people and 100 MB of files. Public HTTP previews limit request bodies to 1 MB and response bodies to 20 MB. TCP previews instead allow 32 connections per seat across all grants and previews, 64 per room, 2 grants per seat and preview, 128 per room, and 1200 new connections or grants per minute (240 for any one seat). Only a port the host chose to forward can be reached this way. A grant lasts 12 hours; unpaired connections close after 10 seconds. A room has a lifetime 1 GiB TCP byte budget, reserved in 1 MiB chunks per direction, unused parts given back when a connection closes. Data messages are at most 64 KiB, with at most 4 messages / 256 KiB outstanding per direction; each half also closes at 1 MiB of cumulative control output. Rooms that are abused get ended.
- Your own server: teams that want their sessions on their own infrastructure can run the same server on Cloudflare or Node in a few minutes (how), and set it in the plugin.
Questions or abuse reports: open an issue on GitHub.