Skip to main content
Glama
yafldev

YAFL MCP Server

Official
by yafldev
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

YAFL — Yet Another File Layer (MCP server + CLI)

Your AI agent moves files between machines with one MCP call — encrypted client-side, links gone in 24 hours.

This repository is the open-source MCP server and CLI client for YAFL. Your agents (Claude Desktop, Claude Code, Cursor, any MCP client — including agents on remote VPSes) hand files across environments — laptop ↔ VPS, agent ↔ agent — with a single tool call, instead of a human dragging files into WeTransfer and copying links around. Files are encrypted on your machine before they leave it; the service only ever sees ciphertext.

The client is open source so you can audit exactly what touches your files. The YAFL service lives at yafl.dev.

Install

Add YAFL to your MCP client config:

{
  "mcpServers": {
    "yafl": {
      "command": "npx",
      "args": ["-y", "@yafldev/mcp"],
      "env": { "YAFL_API_KEY": "<your key — or leave unset and run yafl login>" }
    }
  }
}

Works in Claude Desktop, Claude Code, Cursor, and any MCP client. Claude Desktop users can install the one-click .mcpb bundle. Prefer the CLI:

curl -fsSL https://yafl.dev/install.sh | sh

No API key is required to start. On the first tool call the server returns a guided error pointing to yafl login — an RFC 8628 device flow: the agent shows a short code, you approve it in a browser, and the agent holds its own revocable key. Built for headless boxes. Runs via npx (Node.js 18+); no global install needed.

Related MCP server: vnsh-mcp

Tools

Tool

Call

What it does

upload_file

{ path, password?, oneTime? }

Encrypts client-side, uploads ciphertext, returns the share link. Zips a directory first. Optional password layer; optional one-time link that burns after the first download.

download_file

{ url, destDir?, password? }

Fetches, decrypts, writes the file to local disk.

get_status

{ url }

Checks liveness and remaining TTL — no bytes downloaded.

list_files

{ limit? }

The caller's own transfers, metadata only.

delete_file

{ id | url }

Revoke one of your transfers before expiry.

email_link

{ link, recipient }

Email a share link straight to a recipient — the agent-to-human handoff without leaving the session.

login

device flow

Authorize this agent (RFC 8628); it holds its own revocable key.

Errors are stable and machine-readable — your agent gets expired or not_found, not a mystery 404.

How encryption works

The file is encrypted with a fresh AES-256-GCM key before upload. The key travels only in the share URL's #fragment — browsers never send fragments to servers, so it is never transmitted to, logged by, or stored on any server. An optional link password adds a second derived layer the server never sees either, and a one-time link self-destructs after the first successful download. File bytes go directly to storage via pre-signed URLs; the app server never handles them, and storage only ever receives ciphertext. Access stops at 24 hours. Free tier: 100 MB per file.

What happens if an agent's key leaks

The API key is not the decryption key. If a machine is compromised and its YAFL key is stolen, the attacker can at most see ciphertext metadata for that key's own transfers — file contents stay unreadable, because decryption keys exist only in the links you exchanged. Revoke the key and move on. This is why the recommended setup is one key per agent, per machine — keys are named and individually revocable.

Links

License

MIT — see LICENSE.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • ftp-mcp

    kemalabuteliyte
    A
    license
    B
    quality
    D
    maintenance
    Enables AI agents to perform FTP/FTPS/SFTP file operations including upload, download, sync, and directory management with multi-server support.
    36
    45 npm
    3
    MIT

  • vnsh-mcp

    raullenchai
    A
    license
    Not graded
    quality
    A
    maintenance
    Enables sharing and reading encrypted files (text, images, logs) for AI workflows, with automatic 24-hour expiration and host-blind security.
    62 npm
    156
    MIT

  • justdrop-mcp

    Managed-Digital-LLC
    A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to send and receive files securely via JustDrop, with end-to-end encryption, QR codes, and no server-side storage.
    4
    76 npm
    MIT

  • pulr

    taleilon
    A
    license
    Not graded
    quality
    B
    maintenance
    Secure file exchange MCP server enabling AI agents to upload, share, fetch, and revoke files with SHA-256 verification, malware scanning, expiry, access restrictions, and human approval workflows.
    11 npm
    MIT