slingit

Fire-and-forget: share formatted Markdown notes via link. Encrypted end-to-end by default — the AES-256 key lives only in the URL's # fragment, the server is physically unable to read the content.

# Encrypted note — the CLI prints a link with the key in #
npx slingit shot analysis.md

# With a pipe
cat analysis.md | npx slingit shot

# Send the link by email (the email contains the full working link)
npx slingit shot analysis.md --mailto [email protected]

# Add a short message visible only in the email
npx slingit shot analysis.md --mailto [email protected] --mailmessage "Context before you open this"

# Add a sender signature to the note page and email
npx slingit shot analysis.md --from "Marcin"

# Public note: no encryption, server-side render, SEO
npx slingit shot analysis.md --public

# Delete after 7 days
npx slingit shot analysis.md --expire 7

# Load a note back — prints its Markdown to stdout (decrypts locally, key from #)
npx slingit pull https://slingit.dev/payment-retry-bug/aX7k2mQp9f#Hk3...

# Also pull back any reader comments left on the note (feedback loop)
npx slingit pull https://slingit.dev/payment-retry-bug/aX7k2mQp9f#Hk3... --comments

# Skill for Claude Code ("send these findings to X's email")
npx slingit install-skill

# Skill for Codex
npx slingit install-skill --target codex

Configuration

No configuration is required — the CLI works out of the box with npx slingit shot, using a built-in public token (an anti-bot filter, not a secret; the real protection is the server's rate limits). Overrides, e.g. for a self-hosted instance:

| Source | Keys | |---|---| | env | SLINGIT_TOKEN, SLINGIT_URL (defaults to the official SlingIt instance) | | ~/.slingit/config.json | { "token": "...", "url": "...", "defaultToMail": "..." } |

Env takes precedence over the file; the file takes precedence over the built-in values.

Flags

| Flag | Description | Default | |---|---|---| | --public | Disables encryption, enables server-side render (SEO/preview) | off (encrypted) | | --mailto [email] | Send the link by email; without a value, uses defaultToMail | off | | --mailmessage <text> | Add an optional message/comment to the email body; requires --mailto | off | | --expire <days> | Delete the note after X days (1-365) | no TTL | | --title <text> | Title. Sets the email subject (SlingIT note — {title}) and the readable slug in the link; with --public it also feeds the preview/SEO | first # H1 | | --from <text> | Optional sender/signature shown on the note page and email | hidden | | --copy | Copy the link to the clipboard | off |

Loading a note (pull)

npx slingit pull <url> [--comments|--comments-only]

Fetches a published note and prints its Markdown to stdout — handy for pulling an analysis another agent slung straight into a session. The note id is read from the URL path and, for encrypted notes, the AES key from the # fragment: the ciphertext is fetched by id alone and decrypted locally, so the key is never sent to the server (same zero-knowledge model as the browser reader). Pass the full link including the part after #; --public links have no fragment and pull just as well. Expired or missing notes produce a clear error and a non-zero exit code.

With --comments, any reader comments left on the note are fetched too and appended as a ## Comments section after the body — closing the feedback loop when someone reviews a note you shared. Comments on encrypted notes are decrypted locally with the same key. If the comments cannot be fetched, the note body still prints and a one-line notice goes to stderr.

With --comments-only, only the comments are fetched and printed — the note body is skipped entirely. Unlike --comments, a failure to fetch here is a hard error (there's nothing else to fall back to).

| Flag | Description | Default | |---|---|---| | --comments | Also fetch reader comments and append them after the note body | off | | --comments-only | Fetch and print just the comments, skipping the note body | off |

Skill installation

npx slingit install-skill                    # Claude Code, user profile
npx slingit install-skill --project          # Claude Code, current repo
npx slingit install-skill --target codex     # Codex, user profile
npx slingit install-skill --target all       # Claude Code + Codex

Claude Code installs to ~/.claude/skills/slingit/ or ./.claude/skills/slingit/. Codex installs to ~/.agents/skills/slingit/ or ./.agents/skills/slingit/.

Privacy model

• Default (encrypted): content is encrypted with AES-256-GCM locally; only the ciphertext goes to the server. The key in the # URL fragment is never sent by the browser — full zero-knowledge.
• --mailto + encrypted: the key passes through the server (in transit, not stored) and the mail — a deliberate decision: since the recipient needs the key anyway, they get the full link. Security model: capability URL — whoever has the link can read it.
• --public: a deliberate opt-out from encryption (plaintext, SEO, nice preview).

Backend: Cloudflare Workers + R2. Code: slingit repo.