Why Riffpad?

Riffpad bridges the AI coding CLI running on your machine to your phone, so a long refactor doesn't chain you to the desk:

Watch — the agent's output streams live to your phone:

Steer — send a new instruction from your phone; it lands in the running terminal:

Approve — permission prompts become one-tap cards:

Quickstart

Using an AI agent? Paste this into its chat — it reads the skill and sets up Riffpad for you:

curl -fsSL https://riffpad.ai/SKILL.md

1. Install the daemon

macOS / Linux

curl -fsSL https://riffpad.ai/install.sh | sh

Windows PowerShell

irm https://riffpad.ai/install.ps1 | iex

The Windows script downloads the latest binary, adds it to your user PATH, and registers a logon autostart task for the daemon.

2. Sign in on the computer

riffpad login

This opens a browser for GitHub authorization (like gh auth login). The daemon registers this computer as a host under your account and restarts automatically.

3. Pair your phone

riffpad pair

The terminal prints a 6-character code and a QR code. On your phone, open https://app.riffpad.ai, sign in with the same GitHub account, and enter the code (or scan the QR).

4. Start and control a session

riffpad run codex

The session appears in the app immediately — watch progress, approve actions, and send instructions from your phone, from anywhere.

The CLI speaks English and Chinese. English is the default; use riffpad --lang zh to switch to Chinese, or riffpad --lang en to explicitly select English.

Want to capture a Claude session you started yourself? Use riffpad attach instead — see the documentation.

How it works

• Adapter — parses each CLI's structured output and hooks into a unified event stream (Claude Code, Codex, DeepSeek, Kimi, …).
• Daemon — runs on your computer, owns the keys, manages sessions, and bridges adapters to the relay.
• Relay — lightweight encrypted WebSocket relay. Zero-knowledge: it routes ciphertext and stores nothing.
• Mobile app — shows sessions and approval cards, and sends approve / reject / prompt actions back.

Is it safe?

Yes, by design:

• End-to-end encrypted — X25519 key exchange + AES-256-GCM.
• Keys never leave your devices — they live only on your daemon and phone; the relay never sees plaintext.
• Local-first — code, repositories, and API keys never leave your computer.
• Read-only by default — every approve, reject, or prompt is an explicit action.

Community

Questions, ideas, or show-and-tell? Join us:

• Discord — the community hangout
• GitHub Issues — bugs and feature requests
• Documentation — install, pairing, security model

License

Riffpad is Apache-2.0 by default — the CLI (apps/daemon), clients (apps/client-beta, apps/mobile), landing/docs, and the shared packages/ libraries all use it. See the LICENSE file.

The relay server (apps/relay) is under Business Source License 1.1 — source-available, with personal and internal use permitted (including self-hosting); it converts to Apache-2.0 on 2030-08-09. See apps/relay/LICENSE. A full breakdown lives in NOTICE.

Copyright (c) 2026 Liu Zhening.