diff --git a/README.md b/README.md
index 32c293c..f18246e 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,11 @@ A self-hosted, end-to-end encrypted secrets store for deploy scripts.
 decrypted locally — the server never sees plaintext values, and never
 sees the key that would let it.
 
+![keep is a CLI, not a web app — no server UI to screenshot. This is a full round trip: register an identity, push a vault, grant a second identity read-only access, and watch it get correctly blocked from writing.](./docs/cli-example.png)
+
+`keep` has no web UI by design — it's API + CLI only, so there's nothing
+server-side to show beyond the terminal above.
+
 ## Why
 
 Across a small family of self-hosted projects, every repo tends to have
diff --git a/docs/cli-example.png b/docs/cli-example.png
new file mode 100644
index 0000000..5367070
Binary files /dev/null and b/docs/cli-example.png differ