Server data from the Official MCP Registry
Agent-first E2EE file transfer over MCP: move files between machines in one tool call, gone in 24h.
About
Agent-first E2EE file transfer over MCP: move files between machines in one tool call, gone in 24h.
Security Report
Valid MCP server (2 strong, 1 medium validity signals). No known CVEs in dependencies. ⚠️ Package registry links to a different repository than scanned source. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.
14 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Environment variable: YAFL_API_KEY
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"dev-yafl-mcp": {
"env": {
"YAFL_API_KEY": "your-yafl-api-key-here"
},
"args": [
"-y",
"@yafldev/mcp"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
YAFL — Yet Another File Layer (MCP server + CLI)
Your AI agent moves files between machines with one MCP call — encrypted client-side, links gone in 24 hours.
This repository is the open-source MCP server and CLI client for YAFL. Your agents (Claude Desktop, Claude Code, Cursor, any MCP client — including agents on remote VPSes) hand files across environments — laptop ↔ VPS, agent ↔ agent — with a single tool call, instead of a human dragging files into WeTransfer and copying links around. Files are encrypted on your machine before they leave it; the service only ever sees ciphertext.
The client is open source so you can audit exactly what touches your files. The YAFL service lives at yafl.dev.
Install
Add YAFL to your MCP client config:
{
"mcpServers": {
"yafl": {
"command": "npx",
"args": ["-y", "@yafldev/mcp"],
"env": { "YAFL_API_KEY": "<your key — or leave unset and run yafl login>" }
}
}
}
Works in Claude Desktop, Claude Code, Cursor, and any MCP client. Claude Desktop users can install the one-click .mcpb bundle. Prefer the CLI:
curl -fsSL https://yafl.dev/install.sh | sh
No API key is required to start. On the first tool call the server returns a guided error pointing to yafl login — an RFC 8628 device flow: the agent shows a short code, you approve it in a browser, and the agent holds its own revocable key. Built for headless boxes. Runs via npx (Node.js 18+); no global install needed.
Tools
| Tool | Call | What it does |
|---|---|---|
upload_file | { path, password?, oneTime? } | Encrypts client-side, uploads ciphertext, returns the share link. Zips a directory first. Optional password layer; optional one-time link that burns after the first download. |
download_file | { url, destDir?, password? } | Fetches, decrypts, writes the file to local disk. |
get_status | { url } | Checks liveness and remaining TTL — no bytes downloaded. |
list_files | { limit? } | The caller's own transfers, metadata only. |
delete_file | { id | url } | Revoke one of your transfers before expiry. |
email_link | { link, recipient } | Email a share link straight to a recipient — the agent-to-human handoff without leaving the session. |
login | device flow | Authorize this agent (RFC 8628); it holds its own revocable key. |
Errors are stable and machine-readable — your agent gets expired or not_found, not a mystery 404.
How encryption works
The file is encrypted with a fresh AES-256-GCM key before upload. The key travels only in the share URL's #fragment — browsers never send fragments to servers, so it is never transmitted to, logged by, or stored on any server. An optional link password adds a second derived layer the server never sees either, and a one-time link self-destructs after the first successful download. File bytes go directly to storage via pre-signed URLs; the app server never handles them, and storage only ever receives ciphertext. Access stops at 24 hours. Free tier: 100 MB per file.
What happens if an agent's key leaks
The API key is not the decryption key. If a machine is compromised and its YAFL key is stolen, the attacker can at most see ciphertext metadata for that key's own transfers — file contents stay unreadable, because decryption keys exist only in the links you exchanged. Revoke the key and move on. This is why the recommended setup is one key per agent, per machine — keys are named and individually revocable.
Links
- Website: https://yafl.dev
- MCP guide: https://yafl.dev/mcp
- Security / threat model: https://yafl.dev/security
- npm:
@yafldev/mcp·@yafldev/cli
License
MIT — see LICENSE.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.