# YAFL

> YAFL (Yet Another File Layer) is an agent-first, end-to-end-encrypted file-transfer layer. An
> agent hands a file to another agent or environment with one MCP tool call or one CLI command –
> encrypted client-side before it leaves the machine, auto-expiring in 24 hours, with the app
> server and storage only ever seeing ciphertext.

## Quickstart

- [MCP config + CLI quickstart](https://yafl.dev/agents): the fastest path to a first transfer –
  an `npx @yafl/mcp` config block for MCP clients, and a `yafl login` / `yafl put` / `yafl get`
  quickstart for the CLI.
- [install.sh](https://yafl.dev/install.sh): `curl -fsSL https://yafl.dev/install.sh | sh` –
  checks for Node 20+, installs `@yafl/cli` globally, prints the next step. No sudo.
- [Claude Desktop bundle](https://yafl.dev/downloads/yafl.mcpb): a self-contained `.mcpb` file
  for one-click install in Claude Desktop – no `node_modules` required at runtime.

## Tools

- **MCP** (`npx @yafl/mcp`): five tools – `upload_file({ path })`, `download_file({ url,
  destDir? })`, `get_status({ url })`, `list_files({ limit? })` (the caller's own transfers,
  metadata only), `delete_file({ id })` (permanently deletes one of the caller's own transfers –
  destructive). A missing API key does not block startup; each tool call returns a guided
  `no_api_key` error naming `yafl login` and the `YAFL_API_KEY` env var.
- **CLI** (`npm i -g @yafl/cli`, bin `yafl`): `login`, `put <file>`, `get <url> [dest]`, `status
  <url>`, `list [--json]`, `delete <id|url> [--yes]`, `whoami`. Global `--json` for machine
  output, `--api-url` override, exit codes 0 (ok), 1 (error), 2 (usage), 3 (auth), 4 (not
  found/expired).
- **REST API**: `POST /api/v1/transfers` (pre-signed upload URL), `POST /api/v1/transfers/:id/complete`, `GET /api/v1/transfers/:id` (download resolve), `GET /api/v1/transfers` (list the
  caller's own transfers), and `DELETE /api/v1/transfers/:id` (delete the caller's own transfer)
  back all of the above – encrypt client-side before calling any endpoint, since the server only
  ever stores ciphertext.

## Docs

- [Skill file](https://yafl.dev/skill/SKILL.md): a Claude-Code-style skill covering `put`/`get`/
  `status` via both the CLI and the MCP tools, for agents that load skills instead of reading a
  web page.
- [Agents page](https://yafl.dev/agents): full walkthrough – MCP config, CLI quickstart, the
  device-flow login explanation, and links to the REST API and the `.mcpb` download.

## How it works

Login uses RFC 8628 device flow: request a code, get a verification URL, approve it in a
browser (approving needs an account with a verified email – an email-link sign-in verifies you
by construction), and the CLI or a locally-stored key both work for CLI and MCP use. A file is encrypted
with a fresh AES-256-GCM key before upload; the decryption key travels only in the share URL's
`#fragment`, which is never sent to any server. Links expire in 24 hours.

## Optional

- [Privacy policy](https://yafl.dev/privacy/)
- [Source](https://git.marcushorndt.de/yafl.dev/yafl)