Transfer files between two servers – without the key juggling

Server A has the file. Server B needs it. If A can SSH to B, scp/rsync are the right answer and you don't need this page. The annoying cases are all the others:

• A and B can't reach each other (different providers, firewalls, NAT).
• You'd have to forward your SSH agent or copy a private key onto a box just for one file – a bad habit that outlives the transfer.
• You're on B and the file is on A, and you'd rather not open a third terminal to your laptop to relay it.

The one-link way

On server A:

yafl put backup.tar.gz

The file is encrypted on A before upload; the command prints a share link and a ready-to-run retrieval command. On server B, paste it:

yafl get <id>#<key>

Decrypted, on disk, done. The two servers never talk to each other, no SSH key ever moves between them, and the link is dead within 24 hours – or immediately, if you sent it as a one-time link. The decryption key does travel – it rides in the #fragment you pasted – but it's never sent to any server; the infrastructure in the middle only ever saw ciphertext.

Sending a whole directory? yafl put ./dist zips it client-side automatically.

The agent version

If Claude Code (or any MCP agent) runs on those boxes, skip the manual steps entirely. On A: "upload backup.tar.gz with yafl and give me the retrieval command." On B: paste it. The agents use the same MCP tools, including login (upload_file, download_file, get_status, list_files, delete_file, email_link, login) – and because errors are machine-readable, an agent can retry or report expired cleanly. Setup →

Honest limits

Free tier caps at 100 MB per file – for a 40 GB database dump over a direct line, rsync remains king. YAFL's lane is the everyday artifact: builds, dumps under the cap, logs, configs, reports – anywhere the SSH topology is more annoying than the file is big. First send needs a one-time yafl login (device flow – approve from any browser, including your phone; the key is revocable per machine).

FAQ

How do I transfer a file between two Linux servers that can't reach each other? Upload from the source (yafl put file – encrypted client-side, returns a retrieval command) and redeem on the target (yafl get <code>). No direct connection, no SSH keys exchanged; the link expires in 24 hours.

How do I copy a file between servers without sharing SSH keys? Use a link-based transfer: the sender uploads encrypted, the receiver redeems the link. Neither machine gets credentials to the other; the app server never handles the bytes, and storage only ever holds ciphertext.

Install: npx -y @yafldev/mcp with YAFL_API_KEY set, or the one-liner curl -fsSL https://yafl.dev/install.sh | sh.