claudefeed

tail -f for Claude Code. Every command a session runs, every file it opens, every TCP port it reaches or binds — decoded and streamed live to your terminal. Scoped to that session's process subtree. No other PIDs, no noise.

claudefeed turns a Claude Code session into a live, decoded audit log: every exec (with full argv), every openat, and every outbound or bound TCP port — for the matched session and its entire subtree.

Running

yeet run github:yeet-src/claudefeed

Filter what you see with --only and --except:

yeet run github:yeet-src/claudefeed -- --except=open --secs=30   # commands + network only, 30s
yeet run github:yeet-src/claudefeed -- --only=exec,conn          # just execs and outbound dials
yeet run github:yeet-src/claudefeed -- --match=node              # audit node sessions instead

Source

yeet-src/claudefeed on GitHub.