mcpField
Y
yafl

yafl

Local
github.com/yafldevFiles & Storage0Updated 13w ago
Repository

About yafl

yafl is an MCP server and CLI client for agents to transfer files between machines. Files are encrypted on the client, and share links expire within 24 hours.

Key features

  1. 01Client-side AES-256-GCM encryption
  2. 02Upload files or directories and create links
  3. 03Download and decrypt files
  4. 04Check transfer status and remaining lifetime
  5. 05Manage, revoke, and email share links

Use cases

  1. 01Move files between a laptop and a VPS
  2. 02Transfer files between agents on separate machines
  3. 03Share files with one-time links
  4. 04Email a file link to a recipient from a session

MCP support

It provides MCP clients with tools for uploading, downloading, checking status, listing and deleting transfers, emailing links, and logging in.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "dev-yafl": {
      "command": "npx",
      "args": [
        "-y",
        "@yafldev/mcp"
      ],
      "env": {
        "YAFL_API_KEY": "<YAFL_API_KEY>"
      }
    }
  }
}
Run commandnpx -y @yafldev/mcp
Environment variables to set
YAFL_API_KEYSecretAPI key for authenticated transfers. Optional — omit and run `yafl login` (device flow) instead.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@yafldev/mcp0.1.6

Tools

7

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
pathstringYesAbsolute or cwd-relative path to the local file or directory to upload
oneTimebooleanNoWhen true, the link is destroyed after the first successful download – a second download attempt returns a not_found-style error. Defaults to false (the link stays live until its normal 24h expiry).
passwordstringNoOptional password to protect the link. Composed into the decryption key on the client via a fresh salt – never transmitted to the API. When set, the returned link requires this same password to decrypt.

Details

From the project README

YAFL — Yet Another File Layer (MCP server + CLI)

Your AI agent moves files between machines with one MCP call — encrypted client-side, links gone in 24 hours.

This repository is the open-source MCP server and CLI client for YAFL. Your agents (Claude Desktop, Claude Code, Cursor, any MCP client — including agents on remote VPSes) hand files across environments — laptop ↔ VPS, agent ↔ agent — with a single tool call, instead of a human dragging files into WeTransfer and copying links around. Files are encrypted on your machine before they leave it; the service only ever sees ciphertext.

The client is open source so you can audit exactly what touches your files. The YAFL service lives at yafl.dev.

Install

Add YAFL to your MCP client config:

{
  "mcpServers": {
    "yafl": {
      "command": "npx",
      "args": ["-y", "@yafldev/mcp"],
      "env": { "YAFL_API_KEY": "<your key — or leave unset and run yafl login>" }
    }
  }
}

Works in Claude Desktop, Claude Code, Cursor, and any MCP client. Claude Desktop users can install the one-click .mcpb bundle. Prefer the CLI:

curl -fsSL https://yafl.dev/install.sh | sh

No API key is required to start. On the first tool call the server returns a guided error pointing to yafl login — an RFC 8628 device flow: the agent shows a short code, you approve it in a browser, and the agent holds its own revocable key. Built for headless boxes. Runs via npx (Node.js 18+); no global install needed.

Tools

ToolCallWhat it does
upload_file{ path, password?, oneTime? }Encrypts client-side, uploads ciphertext, returns the share link. Zips a directory first. Optional password layer; optional one-time link that burns after the first download.
download_file{ url, destDir?, password? }Fetches, decrypts, writes the file to local disk.
get_status{ url }Checks liveness and remaining TTL — no bytes downloaded.
list_files{ limit? }The caller's own transfers, metadata only.
delete_file{ id | url }Revoke one of your transfers before expiry.
email_link{ link, recipient }Email a share link straight to a recipient — the agent-to-human handoff without leaving the session.
logindevice flowAuthorize this agent (RFC 8628); it holds its own revocable key.

Errors are stable and machine-readable — your agent gets expired or not_found, not a mystery 404.

How encryption works

The file is encrypted with a fresh AES-256-GCM key before upload. The key travels only in the share URL's #fragment — browsers never send fragments to servers, so it is never transmitted to, logged by, or stored on any server. An optional link password adds a second derived layer the server never sees either, and a one-time link self-destructs after the first successful download. File bytes go directly to storage via pre-signed URLs; the app server never handles them, and storage only ever receives ciphertext. Access stops at 24 hours. Free tier: 100 MB per file.

What happens if an agent's key leaks

The API key is not the decryption key. If a machine is compromised and its YAFL key is stolen, the attacker can at most see ciphertext metadata for that key's own transfers — file contents stay unreadable, because decryption keys exist only in the links you exchanged. Revoke the key and move on. This is why the recommended setup is one key per agent, per machine — keys are named and individually revocable.

Links

License

MIT — see LICENSE.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.