mcp · yafldev — Claude Code MCP server: move files between machines
YAFL's MCP server lets an agent hand a file from a laptop to a VPS in one tool call. Encryption happens on your side, links expire after 24 hours.
claude mcp add mcp -e YAFL_API_KEY=<YAFL_API_KEY> -- npx -y @yafldev/mcpWhat mcp does
YAFL ships as an MCP server plus a CLI client. The agent calls upload_file, the bytes get encrypted locally, and only ciphertext reaches the service. Pulling a file back works through download_file with the share URL. Alongside those two there is get_status for checking whether a link is still alive and how long it has left, list_files for your own transfers, and delete_file to revoke a link early.
The decryption key sits in the URL's #fragment, which browsers never send to a server, so the service has nothing to decrypt with. A link password adds a second derived layer, and a one-time link dies after the first successful download. Should an agent's key be stolen, the thief sees only metadata for that key's transfers — the file contents stay unreadable. Keys are named and revoked one at a time, so one key per machine is the sensible setup.
It runs through npx and needs Node.js 18+. No API key is required up front: the first tool call comes back with a guided error pointing at yafl login, an RFC 8628 device flow where the agent shows a code and you approve it in a browser. The free tier caps a single file at 100 MB.
What it helps with
- push a file from a laptop to a remote VPS without a manual web upload
- hand a share link to a person without leaving the agent session
- check whether a link has expired without downloading the file
- revoke a transfer before its expiry
- pass a file between agents running on different machines
Example prompts for the agent
- Upload
build/report.pdfand give me the link - Download the file from this link into
~/downloads - Check whether the link I sent this morning is still alive
How to install mcp
Platform CLI
claude mcp add mcp -e YAFL_API_KEY=<YAFL_API_KEY> -- npx -y @yafldev/mcpReplace <…> with your own values
Platform CLI
codex mcp add yafldev-mcp --env YAFL_API_KEY=<YAFL_API_KEY> -- npx -y @yafldev/mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"yafldev-mcp": {
"command": "npx",
"args": [
"-y",
"@yafldev/mcp"
],
"env": {
"YAFL_API_KEY": "<YAFL_API_KEY>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"yafldev-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@yafldev/mcp"
],
"env": {
"YAFL_API_KEY": "<YAFL_API_KEY>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e YAFL_API_KEY=<YAFL_API_KEY> yafldev-mcp npx -y @yafldev/mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mcp
How do I install mcp in Claude Code?
Run claude mcp add mcp -e YAFL_API_KEY=<YAFL_API_KEY> -- npx -y @yafldev/mcp. You can leave the key out at first — the first tool call will point you to yafl login.
What does mcp do?
It gives an agent tools for moving files between machines: client-side encrypted upload, download by link, TTL checks, a list of your own transfers and early revocation. Links stop working after 24 hours.
What happens if an agent's key leaks?
The API key is not the decryption key. An attacker gets metadata for that key's transfers only, while file contents stay unreadable because the decryption key lives in the link itself. Revoke the key and the rest keep working.
Similar MCP servers
All MCP servers for Agent setup: memory, context, orchestration →mcp by other authors comes first.
