Jason Lee

Posted on Aug 19

Anthropic Solved 'Access My Own Session From Anywhere.' It Took a 17-Star Repo to Solve 'Let My Teammate In.'

#ai #devtools #productivity #opensource

Anthropic spent 2026 building an increasingly elaborate answer to one question: how do you keep working on a Claude Code session when you're not at your laptop anymore? --teleport pulls a cloud session into your terminal. /remote-control exposes a local session to your phone. --cloud spins up a fresh session on Anthropic's infrastructure that survives your laptop closing. It's a genuinely good stack of features, and OpenAI's Codex has been building the equivalent muscle for its own cloud tasks.

All of it solves the same shape of problem: one person, many devices. None of it solves the other shape: one session, many people.

If your cofounder is three hours deep into a Claude Code session tracing a race condition, and you want to jump in and add a turn under your own name — not screen-share, not read a pasted transcript, not take over their laptop — there has been no built-in way to do that. You'd --resume your own copy of the conversation and diverge, or you'd read over their shoulder.

A two-week-old, 17-star open source project called mpai (short for "multiplayer AI") went after exactly that gap. It launched on Product Hunt on August 3, 2026, and it's small enough, and specific enough, that it's worth looking at closely — not because it's about to replace anything, but because it's a clean illustration of a seam nobody big has closed yet.

What mpai actually does

mpai lets a named teammate enter an already-running Codex or Claude Code terminal session from their own machine, type a prompt under their own identity, and have that turn land in the host's real, native session — the same transcript the host would see if they scrolled back locally. Not a copy. Not a mirrored screen. The actual conversation, with a second name now attached to specific turns.

The pitch on the landing page is concrete about what this replaces: no screen sharing, no pasting 40 turns of context into a Slack message so a teammate can catch up, no handing over your unlocked laptop. The host stays the host. The guest's prompt is attributed as theirs in the record, both live and in whatever audit trail exists afterward.

Installation is a single host command (brew install godfaddaai/tap/mpai && mpai start, or the npm equivalent), which walks through naming both people, picking exactly one existing Codex or Claude Code session to share, and printing an invite command. The teammate pastes that command — no account, no global install required on their end, just Node.js 20+. The whole flow is built around Tailscale, so the connection runs over a private mesh network the two machines already trust, rather than through a hosted relay operated by the tool vendor.

How it's built

The architecture is deliberately narrow. mpai describes itself as "a small coordination layer above the agents — not a transcript cloud and not a remote shell." Three design choices do most of the work:

Native session discovery, not terminal mirroring. This is the part that separates mpai from the terminal-sharing tools developers already reach for. tmate, ttyd, upterm, and sshx all solve a genuinely different problem: they broadcast raw terminal bytes — literally the pixels of your shell — to a second viewer, optionally letting them type into the same pseudo-terminal. That's powerful for pair debugging in general, but it means both people are typing into one undifferentiated stream. There's no concept of "whose turn was this," because the tool doesn't know it's looking at an AI agent's conversation — it just sees a terminal. mpai instead hooks into Codex's and Claude Code's own session stores on disk, so a guest's prompt is inserted as a first-class, attributed turn in the agent's actual conversation state, not as keystrokes typed into a shared PTY.

Tailscale as the trust boundary, not a hosted relay. tmate's default mode and sshx both route your session through the vendor's own servers (sshx's README apparently states self-hosting isn't supported at all — you use their relay or you don't use it). mpai pushes that trust decision onto infrastructure you already run: if your team already has a Tailscale network, mpai rides on top of it rather than asking you to trust a new company's backend to see your code. That's a smart, low-effort way for a two-week-old project to inherit a mature security posture instead of building one from scratch.

Explicit, scoped sharing. The host picks exactly one session to expose per invite. Nothing else on the host machine — other sessions, other projects, the filesystem — is reachable through that invite. Roles (viewer vs. participant) are revocable, and the project's own docs describe firm boundaries for what a guest can't do: no arbitrary shell execution, no deletion, no archival, no remote-approving a permission prompt on the host's behalf. A denied tool-use approval stays denied regardless of who's connected.

One mechanical detail worth understanding because it shapes the trust model: invites bind to the first Tailscale identity that uses them. The host doesn't type in Alex's email or issue a password — they generate an invite scoped to one session, hand it to Alex through whatever side channel they already trust (Slack, in person, whatever), and the first Tailscale-authenticated device that redeems it becomes "Alex" for that session, permanently, until the host revokes it. That's a reasonable model for a small trusted team where Tailscale device auth is already the perimeter, but it also means the whole scheme inherits Tailscale's identity guarantees wholesale — mpai isn't adding its own authentication layer on top, it's borrowing one. If your Tailnet's ACLs are loose, mpai's sharing boundary is exactly as loose.

The industry moment this fits into

mpai isn't happening in a vacuum. The same week it was making the rounds, Cursor shipped Origin, a full code-hosting platform built around the idea that a third of pull requests merged through Cursor are now opened by autonomous agents rather than humans — reported as happening days after GitHub absorbed a six-hour outage that took Copilot down with it. GitHub's own answer, Agent HQ, orchestrates third-party agents from inside GitHub's existing surface rather than replacing it. Both are chasing the same underlying shift: agent-produced work is becoming common enough that the surfaces around it — where it's reviewed, hosted, and collaborated on — are being rebuilt with agents as first-class participants, not humans typing at a bot.

mpai is a much smaller, much narrower bet inside that same shift, but it's aimed at a piece the bigger platforms haven't touched: not "where does the agent's output live" but "who else can be present, as themselves, while the agent is still working." Origin and Agent HQ are both about the artifact an agent produces. mpai is about the live conversation that produces it. That's a genuinely different layer, and it's telling that none of the well-funded players have shipped it yet — probably because it's a smaller, harder-to-monetize problem than owning the repo or the review queue, not because it's unimportant.

What changed versus what came before

Before mpai, your realistic options for "let a teammate see and touch my live agent session" were:

Paste the transcript. Loses formatting, loses tool-call context, and by the time you've copied 40 turns into Slack the moment has usually passed.
Screen share. Works, but it's synchronous, it's a Zoom call you have to schedule, and the other person can't actually drive.
Terminal-mirroring tools (tmate/ttyd/upterm/sshx). Get you real-time shared access, but treat the agent session as an opaque terminal, so you lose per-person attribution and the guest is really just typing into the host's raw stdin. If the host is also mid-thought and starts typing, you get keystroke collision, not two named contributors.
Claude Code's own Remote Control / teleport, or Codex cloud tasks. These are excellent for the single-operator case — the same person picking a session back up from a different device — but they're not built for a second identity to join. Remote Control connects your phone to your local session; teleport pulls a cloud session into your terminal. There's no "invite Alex" primitive in either.

mpai's contribution isn't a new capability nobody imagined — pairing on a shared AI session is an obvious thing teams want. It's that nobody had actually shipped the specific, narrow version of it: attributed, native, session-level access control for exactly two named CLI agents, built on infrastructure most engineering orgs already run.

Why this matters even at 17 stars

The instinct is to wave this off as too small to matter. That's fair as a bet on the project's survival, but the gap it's pointing at is real, and worth naming even if mpai itself isn't the tool that ends up filling it.

Attribution is becoming a compliance question, not just a nicety. As more teams let AI agents drive meaningful chunks of a codebase, "who approved this change, and who prompted the agent to make it" is turning into an actual audit requirement, not a curiosity. A terminal-mirroring tool where two people share one undifferentiated keystroke stream can't answer that question. A tool that inserts an attributed turn into the agent's own session state can, at least in principle — mpai keeps an append-only prompt audit trail as one of its stated working features.

The identity boundary is the interesting design decision, not the networking. Plenty of tools move bytes between two terminals. Deciding that a shared AI session needs its own concept of "whose turn is this" — separate from "whose terminal is this" — is a genuinely different modeling choice, and it's the one the big vendors haven't made yet because their products are still organized around a single operator per session.

It's a strong argument for building thin on top of infrastructure people already trust. By outsourcing the hard networking and identity problem to Tailscale instead of running its own relay, a two-person open source alpha gets to make a private-by-default claim that would otherwise require months of security work to earn credibly.

Practical use cases

Handing off a debugging session mid-incident. An on-call engineer three turns into diagnosing a production issue can pull in a second engineer without re-explaining what the agent has already found, and without giving up their terminal.
Reviewing an agent's proposed change live, with the person who prompted it. Instead of reviewing a diff cold, a reviewer can ask the agent follow-up questions inside the same context that produced the change — attributed as their own questions, not the original author's.
Cofounder or small-team pairing where a second IDE, account, or hosted workspace is overkill. Two people, one Tailnet, one shared session — no new tool to standardize on.
Mentoring or onboarding. A senior engineer can watch a junior engineer's live Claude Code session and step in with a clarifying prompt at exactly the point of confusion, then step back out.

A concrete way the trust surface bites

Take the "narrow authority" claims seriously, but also take seriously what they don't cover. Suppose Alex joins Maya's live Claude Code session mid-refactor and, either carelessly or maliciously, sends a prompt like "also update the deploy script to point at this new endpoint" — something outside what Maya actually wanted, but plausible-sounding enough that the agent just does it. mpai's stated boundaries (no shell execution outside the agent's own tool use, no deletion, no delegated approvals) stop Alex from doing damage mpai itself performs, but they do nothing to stop Alex from steering the agent into doing damage through its normal, already-approved tool access. The agent can't tell the difference between "Maya asked for this" and "the named guest Maya invited asked for this" in terms of what it's willing to act on — attribution shows up in the audit log after the fact, not as a gate beforehand. That's not a flaw unique to mpai; it's the same prompt-injection-adjacent reality every multi-operator agent surface has to reckon with once more than one identity can talk to the same tool-using agent. mpai is honest that invites should be reserved for trusted teammates and non-sensitive pilots — the point is that this is a real constraint on the feature's core value, not a footnote.

Independent read

Judged purely as a two-week-old public alpha, mpai is a well-scoped, honestly documented experiment: it picked one narrow, real gap, built the smallest possible thing that closes it, and borrowed a mature trust anchor (Tailscale) instead of trying to invent one. That's a good way to build a v0.4 release, and the project's own "current boundary" section is more candid about limitations than most Product Hunt launches bother to be.

Judged as something to bet team workflow on today, it's clearly too early — 17 stars, a single visible maintainer org, macOS-only, two supported agents, and a "managed Codex mode" that isn't finished yet all point the same direction. The interesting thing isn't whether mpai specifically wins; it's that the gap it identified — attributed, multi-person access to a single live agent session — is real enough that something is going to fill it, and the fact that a two-person open source team got there before Anthropic, OpenAI, or Cursor did says more about how those companies are prioritizing their roadmaps than it does about the difficulty of the problem.

Limitations the launch page undersells

The landing page is unusually candid for a Product Hunt launch — it has an explicit "current boundary" section — but a few things deserve more weight than they get there:

This is a two-week-old project with 17 GitHub stars, three forks, and effectively one visible maintainer (the godfaddaai org). That's not a knock on the engineering; it's a real statement about bus factor and how much you should trust it with anything sensitive today. The project itself says as much — "begin with a non-sensitive pilot" — but it's worth repeating outside the marketing copy.
macOS only, and it needs an existing Tailscale network. If your team hasn't already adopted Tailscale, you're adopting two new pieces of infrastructure to get this, not one. There's no Linux or Windows host support yet, which rules out a large share of engineering teams outright.
Two agents, full stop. Codex and Claude Code are supported; nothing else is, and there's no stated roadmap for Cursor, Gemini CLI, or other agents. Given how fast the agent landscape is moving, a two-agent scope is a real constraint on how many teams this is useful to on day one.
"Managed Codex mode for safe remote prompting" is listed as not yet done, and standalone Codex sessions are view-only for now — so the flashiest capability (a teammate actually prompting into your session) currently leans more heavily on the Claude Code side than the marketing implies.
Letting a second, real person inject prompts into your live agent session is a new kind of trust surface, not just a networking one. The project's "narrow authority" constraints (no shell execution, no deletion, no delegated approvals) are a reasonable first mitigation, but the core exposure — someone else's words landing in your agent's context window, shaping what it does next — is inherent to the feature, not a bug to patch out. That's worth treating as a real access-control decision per teammate, not a checkbox you enable once and forget.
No large-organization certification, and physical sleep/wake handling is explicitly still on the roadmap, which matters for anything beyond a two-person pilot.

Competitive picture

	mpai	tmate / ttyd / upterm / sshx	Claude Code Remote Control / `--teleport`
What's shared	Native agent session state, attributed per person	Raw terminal bytes	Your own session, across your own devices
Multi-person, distinct identities	Yes, by design	Only as raw keystrokes, no attribution	No — single operator
Transport	Your existing Tailnet	Public relay (tmate.io, sshx.io) or self-hosted	Anthropic's cloud infra or your local machine
Audit trail	Append-only prompt log	Session recording (tmate only)	Conversation history
Maturity	Public alpha, 2 weeks old	Years-old, thousands of GitHub stars each	Shipped product from a well-funded vendor
Agent-aware	Yes (Codex, Claude Code)	No — agent-agnostic, just a terminal	Yes, but single-agent, single-operator

The honest read: mpai isn't competing with tmate or sshx, because they're not solving the same problem, and it isn't competing with Claude Code's own remote features either, because Anthropic hasn't built the multiplayer piece. It's occupying a gap between "share my terminal" and "access my own session from another device" that happens to be exactly where a lot of real collaboration friction lives.

Who should try it, wait, or skip it

Try it now if you're a small, macOS-based team already running Tailscale, doing serious pair work on Codex or Claude Code sessions, and comfortable running a public alpha from a two-week-old repo on non-sensitive work. The install is low-cost enough (brew install plus one invite command) that a real trial costs you an afternoon, not a sprint.

Wait if you're on Linux or Windows, don't already have Tailscale in place, or need this to work with any agent besides Codex or Claude Code — none of that is solved today, and there's no committed timeline for it in what's public so far.

Skip it if your work involves anything you wouldn't want a second identity's prompts influencing without a much harder look at the authority model first, or if you need something an enterprise security team can sign off on this quarter. A 17-star public alpha from a single GitHub org is not that, yet, whatever the roadmap says.

The bigger point stands regardless of whether mpai itself sticks around: the AI coding tools with real budgets solved "let me keep working from anywhere." Nobody with a real budget has yet shipped "let someone else into the room." That's a strange gap to still be open in August 2026, and it's exactly the kind of gap a two-person open source project is built to expose, even if it isn't the one that ends up closing it for good.

Have you actually tried getting a teammate into a live Claude Code or Codex session — pasted transcript, screen share, tmate, something homegrown? What broke first: the context loss, the attribution, or the trust model?

Sources:

DEV Community