---
sidebar_position: 1
title: claudefeed
---

# claudefeed

> `tail -f` for Claude Code. Every command a session runs, every file it opens, every TCP port it reaches or binds — decoded and streamed live to your terminal. Scoped to that session's process subtree. No other PIDs, no noise.

`claudefeed` turns a Claude Code session into a live, decoded audit log: every `exec` (with full argv), every `openat`, and every outbound or bound TCP port — for the matched session and its entire subtree.

![claudefeed demo](/img/examples/claudefeed.gif)

## Running

```sh
yeet run github:yeet-src/claudefeed
```

Filter what you see with `--only` and `--except`:

```sh
yeet run github:yeet-src/claudefeed -- --except=open --secs=30   # commands + network only, 30s
yeet run github:yeet-src/claudefeed -- --only=exec,conn          # just execs and outbound dials
yeet run github:yeet-src/claudefeed -- --match=node              # audit node sessions instead
```

## Source

[`yeet-src/claudefeed`](https://github.com/yeet-src/claudefeed) on GitHub.