NexFade for Grok

NexFade for Grok creates one-time encrypted links for files and notes without sending plaintext to NexFade. The plugin encrypts on the Grok Bot/Grok Build computer with AES-256-GCM, uploads only ciphertext, and appends the decryption key as the recipient link's URL fragment.

Privacy boundary

Grok is a trusted processor in this workflow. A file attached to Grok and the final link are stored under Grok's privacy terms. NexFade does not receive the plaintext, AES key, or URL fragment. This plugin has no tool for opening or decrypting existing links.

The plugin reads only an explicitly supplied regular file inside the current Grok workspace. It rejects paths outside the workspace, symlink escapes, environment files, private keys, and common credential directories. It sends network requests only to the configured NexFade HTTPS API and to the presigned HTTPS upload destination returned by that API. It contains no telemetry, hooks, post-install scripts, package dependencies, downloaded binaries, or dynamic code execution.

Requirements

• Grok Bot or Grok Build with plugin and MCP support

• Node.js 20 or newer in the agent computer

• A NexFade account

• Files up to the lower of the NexFade plan limit and 100 MB

Grok Bot currently accepts ordinary document attachments up to 25 MB. Larger supported local files may work in Grok Build, while larger NexFade files should use the browser send flow.

Grok Bot deployment requirements

Grok Bot uses the existing Cursor team plugin and MCP policy. A team administrator must enable the plugin in the team plugins page and permit its MCP server if the team uses an MCP allowlist. The plugin then runs on the Bot's managed computer, where its preinstalled Node.js runtime must satisfy the Node 20 requirement above. Users complete NexFade sign-in in the Bot browser; no API token is copied into chat. Use grok inspect (Grok Build) or the Bot's Plugins page to confirm the plugin is enabled and trusted.

This package is the local-plugin lane for Grok Bot and Grok Build. A grok.com/connectors custom connector is a separate lane: xAI requires that connector's MCP server to be reachable over public HTTPS, so this local stdio package must not be advertised as a grok.com connector until a hosted remote MCP service is added.

Install and connect

During private testing, install this directory as a trusted local plugin. The public release will be published from an official NexFade GitHub repository and submitted to xAI's plugin marketplace at a pinned commit.

After installation, ask Grok to connect NexFade. The plugin returns a NexFade authorization page; sign in, approve the three displayed scopes, then tell Grok the approval is complete. No API-token copying is required.

The access credential is stored in the host-provided plugin data directory with owner-only file permissions. Revoke it from the NexFade Integrations page at any time.

Tools

• nexfade_connect

• nexfade_account_status

• nexfade_send_file

• nexfade_send_note

• nexfade_list_links

• nexfade_get_link_status

• nexfade_revoke_link

Version 0.1 intentionally supports one-time links only. Recipient delivery is performed through an email or messaging connector chosen by the user and requires explicit approval.

Development

npm test
npm run check
npm run validate

No dependency installation is required.

Release and discovery

1. Deploy the NexFade web app and PocketBase schema, configure GROK_DEVICE_FLOW_SECRET, and run a private end-to-end canary with a Free and a paid account.

2. Publish this directory in an official NexFade-owned public repository and verify direct install from its immutable commit.

3. Submit that pinned commit to the Grok Build marketplace/catalog process available at release time. Do not claim a grok.com connector listing unless xAI has separately approved one.

4. Put the install and privacy instructions on nexfade.com/integrations/grok, then measure connection, first-link, quota-hit, upgrade-click, and paid-conversion events on the NexFade server side. The plugin itself intentionally contains no telemetry.

Marketplace publication, production deployment, and external repository creation are release operations and are not performed by this source package.

For the exact repeatable catalog commands, SHA rules, validation steps, and final listing checks, use the marketplace release checklist. The package can generate the catalog object after the reviewed commit is public:

npm run marketplace:entry -- \
  --repo-url https://github.com/<official-nexfade-org>/<repo>.git \
  --sha <40-character-commit-sha>

The recommended public source is a plugin-only repository with this package at its root. If the package is instead published from a public monorepo, also pass --path integrations/grok-plugin.