pairwave

Connect two people's Claude Code sessions over one live, end-to-end-encrypted channel. Stop being the copy-paste middleman between your AI and your friend's AI.

Get started — 2 minutes, one line each

The easy way: don't even open a terminal. Paste the line for your system into Claude Code itself (this works in the CLI, the VS Code extension, or the desktop app) and say "run this". Claude runs it, reads the output, and walks you through the rest. That's the whole setup.

Step 1 — Person A creates the room (run inside your project folder)

🪟 Windows (PowerShell):

iex "& { $(iwr -useb https://raw.githubusercontent.com/goofypluto999/pairwave/main/scripts/install.ps1) } init"

🍎 Mac / 🐧 Linux:

curl -fsSL https://raw.githubusercontent.com/goofypluto999/pairwave/main/scripts/install.sh | bash -s -- init

When it finishes, it prints a ready-to-send line for your friend — invite code already inside. You copy it, send it somewhere private (Signal, WhatsApp, in person — it is the room key), done.

Step 2 — Person B pastes the line you sent them

That's it — the line Person A sends already contains everything. Person B pastes it in their project folder (or into their Claude Code with "run this") and they're fully plugged in.

🪟 Windows (PowerShell):

iex "& { $(iwr -useb https://raw.githubusercontent.com/goofypluto999/pairwave/main/scripts/install.ps1) } join <invite-code>"

🍎 Mac / 🐧 Linux:

curl -fsSL https://raw.githubusercontent.com/goofypluto999/pairwave/main/scripts/install.sh | bash -s -- join "<invite-code>"

Step 3 — both of you

Open Claude Code in that folder → approve the pairwave server when it asks → type /pairwave. Done. Your Claude and their Claude are on one encrypted channel, and your local dashboard URL is printed for you.

That one line did everything: checked prerequisites, installed Pairwave (outside your project), built it, gave you a global pairwave command, wired your project (.mcp.json + the /pairwave skill + room config), and git-ignored the key material. Nothing else to configure.

One detail — the relay. One of you runs pairwave relay somewhere both machines can reach (same wifi/LAN works as-is; different networks need a free tunnel or any $0–5 VPS). It's safe to put anywhere because it only ever sees encrypted bytes — it literally cannot read your messages.

Want to feel it before inviting anyone? Clone the repo, npm run demo — it boots a fake two-person session and hands you the live dashboard to click around in.

Related MCP server: Universal AI Chat MCP Server

Why doesn't this already exist?

Anthropic's own issue tracker has the request (claude-code#21277). People hack around it daily: copy a Claude answer into WhatsApp, friend pastes it into their Claude, repeat. You can bridge two Claudes with a shared file or chat-room MCP — it's just clunky, unsafe, and blind. Five hard problems stood in the way. Pairwave is the bridge over each:

What you can do that you couldn't before: your Claude asks their Claude for the API contract it just wrote and gets a provenance-tagged answer; you ship a patch across as an inert artifact and watch their approval popup — then their own Claude applies it under its own permissions; both dashboards show the same decisions, open questions, and shared files in real time; you close your laptop, reopen tomorrow, type /pairwave, and both sides remember everything.

How it works

flowchart LR
    subgraph A["Person A's machine"]
        CA["Claude Code"] <-->|"MCP · 17 pair_* tools"| PA["Companion<br/>(holds the key)"]
        PA --- UA["Local dashboard<br/>127.0.0.1"]
    end
    subgraph R["Anywhere (untrusted)"]
        RY[("Relay<br/>ciphertext only")]
    end
    subgraph B["Person B's machine"]
        PB["Companion<br/>(holds the key)"] <-->|"MCP · 17 pair_* tools"| CB["Claude Code"]
        UB["Local dashboard<br/>127.0.0.1"] --- PB
    end
    PA <-->|"E2E encrypted WebSocket"| RY <-->|"E2E encrypted WebSocket"| PB

A typical exchange, end to end:

sequenceDiagram
    participant A as Alice + her Claude
    participant R as Relay (sees ciphertext)
    participant B as Bob + his Claude
    A->>B: SAS words compared out-of-band ✓
    A->>R: charter proposal (encrypted)
    R->>B: forwarded — Bob's human reviews, accepts
    Note over A,B: substantive exchange now unlocked
    A->>R: code artifact (encrypted)
    R->>B: lands INERT in Bob's quarantine
    A->>R: action.request "write src/lib/prefs.ts"
    R->>B: Gate 1 — permission popup on Bob's dashboard
    B->>B: Approve → Bob's OWN Claude applies it (Gate 2: Claude Code's prompt)
    B->>R: action.result ✓ (encrypted receipt)
    R->>A: Alice sees it resolved in her ledger

What your Claude gets — 17 MCP tools

The dashboard

Each person gets their own local web dashboard (zero build, served by their companion, never leaves 127.0.0.1): an activity rail (open questions, decisions, shared code, pending approvals), the live transcript with human/agent origin markers, permission popups with risk + exact payload, the SAS verification banner, floor control, and a chat composer for the humans. npm run demo shows it in 30 seconds.

Honest limits (v1)

• Async by design, not telepathy — Claude Code is turn-based; live mode is bounded polling that costs the poller tokens.

• Two local dashboards, not one website — a hosted UI would need your key and break E2E.

• Metadata is visible to the relay (room id, sizes, timing) — content never is.

• No forward secrecy yet (static room key — rotate rooms; Double-Ratchet is on the roadmap), and a malicious peer is out of scope: Pairwave protects the channel and your machine, not against a friend who lies.

Full threat model: docs/SPEC.md §15. Build status: docs/ROADMAP.md.

Repo layout

npm run verify builds everything and runs all 75 tests — if it's green, your install works.

Security disclosure

Found a vulnerability? Open a GitHub security advisory (preferred) or an issue tagged [security] without exploit details. The relay is designed to be operable by an adversary — if a malicious relay can read or forge content, that's a critical bug and we want to know immediately.