Yafl MCP server
{
"mcpServers": {
"yafl": {
"command": "npx",
"args": [
"-y",
"@yafldev/mcp@latest"
],
"env": {
"YAFL_API_KEY": "<yafl_api_key>"
}
}
}
}{
"mcpServers": {
"yafl": {
"command": "npx",
"args": [
"-y",
"@yafldev/mcp@latest"
],
"env": {
"YAFL_API_KEY": "<yafl_api_key>"
}
}
}
}{
"mcpServers": {
"yafl": {
"command": "npx",
"args": [
"-y",
"@yafldev/mcp@latest"
],
"env": {
"YAFL_API_KEY": "<yafl_api_key>"
}
}
}
}{
"servers": {
"yafl": {
"command": "npx",
"args": [
"-y",
"@yafldev/mcp@latest"
],
"env": {
"YAFL_API_KEY": "${input:yafl_api_key}"
}
}
},
"inputs": [
{
"id": "yafl_api_key",
"type": "promptString",
"description": "Yafl api key",
"password": true
}
]
}{
"mcpServers": {
"yafl": {
"command": "npx",
"args": [
"-y",
"@yafldev/mcp@latest"
],
"env": {
"YAFL_API_KEY": "<yafl_api_key>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @yafldev/mcpversion 0.1.6
What it does
YAFL is an MCP server that lets AI agents transfer files between machines with a single tool call. Files are encrypted client-side before upload, decryption keys stay in share links (never sent to servers), and transfers expire after 24 hours.
- An agent running on a VPS uploads a processed dataset to your laptop, encrypted, with a link that expires in 24 hours.
- Claude Desktop downloads a file from a share link, decrypts it locally, and saves it to your working directory.
- An agent emails a share link to a colleague without leaving the session, optionally password-protected and set to burn after first download.
Tools this server exposes
| Tool | Does |
|---|---|
| upload_file | Encrypts a file or directory client-side and uploads it; returns a share link with the decryption key in the fragment. Supports optional password and one-time-u |
| download_file | Fetches and decrypts a file from a share URL, writing it to local disk. |
| get_status | Checks whether a share link is still active and returns its remaining time-to-live without downloading file content. |
| list_files | Lists the caller's own active transfers, showing metadata only. |
| delete_file | Revokes a transfer before its 24-hour expiry. |
| email_link | Sends a share link to an email recipient, allowing agent-to-human handoff without leaving the session. |
| login | Authorizes the agent using RFC 8628 device flow; the agent holds its own revocable API key. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.