Wormhole file transfer vs YAFL – live codes or async links
Magic Wormhole and croc are two of the best-loved file-transfer tools in the terminal world, and they deserve it: a short human-speakable code, strong PAKE-based encryption, no accounts, and a live code hands the file from one machine to the other (magic-wormhole is usually peer-to-peer but can fall back to a transit relay; croc always relays). If you and another human are both at a terminal right now, use them happily.
They're built around one assumption, though: both ends are live at the same moment. Someone runs wormhole send, someone runs wormhole receive, and the code is exchanged out-of-band while both processes wait. That assumption breaks in exactly the situations YAFL was built for.
Where the live-code model stops
- Nobody is at the other end. An agent that runs on a schedule – or a colleague who's asleep – can't type a code into a waiting process.
- Agents can't do the handshake. An MCP tool call is one shot; it can't sit in an interactive send/receive rendezvous.
- The sender can't leave. Close the laptop mid-transfer and the offer is gone.
What YAFL does differently
| Magic Wormhole / croc | YAFL | |
|---|---|---|
| Timing | Both ends live simultaneously | Async – a 24-hour link is the buffer |
| Receiver requirement | The tool installed + a human at the prompt | A browser, the CLI, or any MCP agent |
| Agent surface | – | MCP tools incl. login (npx -y @yafldev/mcp), CLI with --json and stable exit codes |
| Encryption | PAKE, end-to-end | AES-256-GCM client-side; key only in the URL #fragment; app server never handles the bytes, storage holds ciphertext only |
| Accounts | None | Free account to send (revocable per-agent keys); receiving needs nothing |
| Cleanup | Nothing stored | Links self-destruct at 24h, or one-time links that burn on first download |
The account difference is a real trade-off, not spin: wormhole's no-account model is beautiful for ad-hoc human use. YAFL ties sends to an account because unattended agents need keys you can revoke when a box is compromised.
When to use which
- Two humans, two terminals, right now → Magic Wormhole or croc.
- The receiver is an agent, or picks it up later, or only has a browser → YAFL.
- You're scripting or orchestrating → YAFL – one MCP tool call, machine-readable errors.
- You want a Magic Wormhole alternative that doesn't need both ends live → YAFL.
- Comparing against a local-network-first tool instead? See LocalSend vs YAFL.
FAQ
What is wormhole file transfer? Tools like Magic Wormhole and croc create a live, end-to-end-encrypted channel between two machines, unlocked by a short code both sides enter at the same time. It's synchronous by design – ideal for human-to-human, a poor fit for unattended agents (both clients need to run within roughly the same window and stay running until the transfer finishes).
How do I send a file when the other side is offline? Use a link-based tool: yafl put file.zip uploads it encrypted and gives you a link plus a ready-to-run yafl get command; the other side redeems it any time within 24 hours.
Install: npx -y @yafldev/mcp with
YAFL_API_KEY set, or the one-liner
curl -fsSL https://yafl.dev/install.sh | sh.