Docs

Install & run

One command. npx peekmarquee in the folder where Claude Code is running prints a public link in seconds.

npx peekmarquee

npx peekmarquee
→ Streaming  https://peekmarquee.live/s/<id>   (viewers 0 · 0 secrets hidden)

Node 18 or newer. Works with Claude Code.

Flags

`npx peekmarquee`	Stream the active Claude Code session for the current folder (public, listed in /live).
`--file <path>`	Tail a specific JSONL file (skips detection).
`--agent claude`	Only claude in this version; other values exit with "not supported in this version".
`--title "<≤80 chars>"`	Title in the viewer and directory. Default "Untitled session". The folder name is never sent.
`--wallet 0x…`	Wallet for tips (checksum validated). Without it there is no Tip button.
`--private`	Unlisted link: not in /live, not in /api/live, not in public stats.
`--no-replay`	The relay keeps nothing; the stream is gone when it ends.
`--no-prompts`	Your prompts are not sent (agent actions only).
`--hide <glob\|/regex/>`	Extra redaction (repeatable).
`--dry-run`	Does not connect to the relay; prints to stdout exactly the events that would be sent, already redacted.
`delete <id>`	Delete a stream and its replay now.

Dry run

See exactly what would be sent: npx peekmarquee --dry-run.

npx peekmarquee --dry-run

What gets redacted

Secrets are hidden on your machine, before anything leaves it. The relay runs the same filter again.

Each hidden value becomes a chip with its class; the value itself, its length and its hash are never sent.

[redacted:api_key][redacted:token][redacted:private_key][redacted:seed_phrase][redacted:credential_url][redacted:jwt][redacted:high-entropy][redacted:env_value]

Results of tools that touch sensitive paths are hidden whole: .env, .env.*, *.pem, *.key, id_rsa*, id_ed25519*, .npmrc, .netrc, .aws/*, .ssh/*, .gnupg/*, .kube/config, wallet*.json, keystore/*, .claude/settings*.json, .docker/config.json and similar.
Commands that dump the environment or credentials (printenv, env, gh auth token, security find-* and others) have their output hidden.
Known key formats (OpenAI/Anthropic, GitHub, GitLab, AWS, Slack, Google, Stripe, SendGrid, npm, PyPI, Hugging Face, Replicate, JWT, PEM private keys, Telegram and Discord bot tokens), 12+ word seed phrases, credentials in URLs, paid RPC keys, Authorization headers and password=-style pairs.
Long high-entropy strings. Transaction hashes, addresses and UUIDs stay visible.
Your own patterns with --hide.

Thinking blocks are never streamed.

What it can't catch

Secrets without a known prefix and with low entropy (a password like hunter2, a username) are not caught unless a keyword is on the same line.
Secrets split across lines, spelled out character by character, or inside an image or screenshot are not caught.
Content that is private but not a secret (customer names, emails, database rows printed to the terminal) is not hidden unless you use --hide.
Redaction uses regular expressions, not an understanding of context. Transaction hashes and addresses are left visible on purpose.
--dry-run exists so you can check for yourself before you stream. Don't stream a session that holds production credentials.
The relay filters again with the same patterns, but it never sees anything already hidden on your machine; it is a safety net, not a replacement.

Read-only

Read-only. Viewers can't type into your session; there is no channel from the page back to your terminal.

The CLI only accepts three message types from the relay: ack, viewers and error. It never executes anything it receives. The only POST a viewer can make is a report.

Chat

Live chat for viewers. Chat never reaches the streamer's machine. Addresses and links in chat are removed.

Messages are plain text (nick up to 24 characters, message up to 280). Each message has a report button; the streamer can delete messages, set slow mode or turn chat off from the manage link. Chat is deleted with the replay.

Replay & delete

Replays stay 24 hours, then they're deleted. Delete earlier with npx peekmarquee delete <id>.

npx peekmarquee delete <id>

Unlisted streams: --private keeps the link out of the directory and the stats.

A secret slipped through? Run npx peekmarquee delete <id> right away. Viewers can report it as secret_leaked, which unlists the stream and turns its replay off until we check.

Tips & contract

Tips go straight to the streamer's wallet through a tiny contract that holds nothing.

Tip in ETH or USDG now; $MARQ after launch. ETH is one transaction (tip); a token tip is two: approve the exact amount, then tipToken.

Not audited. The contract has two functions, tip (ETH) and tipToken (tokens), and holds no ETH and no tokens. Source verified on Sourcify (exact match).

Totals are gross and unfiltered: anyone can tip anyone, including themselves. A recipient whose wallet rejects ETH makes the tip transaction fail; no funds get stuck. Proof

API

Built for agents too: llms.txt, /api.

`GET /api/live`	Public live streams.
`GET /api/recent`	Last 20 public replays that haven't expired.
`GET /api/stats`	Totals from real streams only.
`GET /api/s/<id>`	Stream meta.
`GET /api/s/<id>/events?from=<seq>`	Server-sent events, live and replay.
`GET /api/s/<id>/replay.jsonl`	Full replay download (after redaction).
`GET /api/tips/top`	Tips read from the chain.
`POST /api/s/<id>/report`	`{"reason":"illegal\|secret_leaked\|spam\|other"}`

curl -s https://peekmarquee.live/api/live
curl -N https://peekmarquee.live/api/s/<id>/events

Privacy

Stored: stream events after redaction, for the replay window. Nothing before redaction.
Your folder name, working directory and git branch are never sent.
IP addresses are kept only as hashes for rate limits, for 24 hours.
No accounts.

Report & takedown

Every stream page has a Report a stream button (illegal, secret leaked, spam, other). Three reports unlist a stream from /live; a secret-leaked report unlists it and turns its replay off until we check.

Source

The CLI's source is readable in the npm tarball (no minification).

npm: peekmarquee