{"name":"dev.yafl/mcp","slug":"yafl-mcp","title":null,"description":"Agent-first E2EE file transfer over MCP: move files between machines in one tool call, gone in 24h.","url":"https://mcp.market/server/yafl-mcp","rating":null,"grade":"B","score":72,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":18,"stars":0,"forks":0,"downloads_week":33,"last_push_at":"2026-08-01T20:37:38.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/yafldev/mcp","website":null,"version":"0.1.6","remotes":[],"packages":[{"registryType":"npm","identifier":"@yafldev/mcp","version":"0.1.6","transport":{"type":"stdio"},"environmentVariables":[{"description":"API key for authenticated transfers. Optional — omit and run `yafl login` (device flow) instead.","isSecret":true,"name":"YAFL_API_KEY"}]}],"tools":[{"name":"delete_file","description":"Permanently deletes ONE of the caller's own YAFL transfers, identified by `id` (a bare transfer id or a full share URL \\u2014 the fragment/key, if present, is never read). This cannot be undone: the R2 object is purged and the transfer record is removed. Destructive action.","write_action":true,"price_micros":0,"input_schema":null},{"name":"download_file","description":"Downloads and decrypts exactly the one file referenced by the given YAFL share `url`, writing it only into `destDir` (default: the current working directory) \\u2014 never anywhere else. Requires the decryption key embedded in the URL fragment; the key is used only locally to decrypt and is never sent to the API. No YAFL API key is required for retrieval \\u2014 anyone holding the link can download ","write_action":false,"price_micros":0,"input_schema":null},{"name":"email_link","description":"Emails this YAFL share link to a recipient. The link carries the decryption key in its fragment \\u2013 anyone with access to that inbox can open the file. Requires a verified account.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_status","description":"Checks whether the YAFL share link at the given `url` is still live \\u2014 live, expired, or not found \\u2014 without downloading or decrypting anything. Returns liveness, size, and expiry only. Does not read the decryption key even if present in the URL fragment, and never fetches any file bytes.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_files","description":"Lists the caller's OWN YAFL transfers only \\u2014 metadata only (id, size, status, expiry, and a download path). Never returns file contents, never a decrypted name, and never another account's files. Optionally cap the number of results with `limit`.","write_action":false,"price_micros":0,"input_schema":null},{"name":"login","description":"Starts a device-code login for an MCP agent that has no shell. Returns a verification URL and a short user code for the human to open and approve in a browser; approving is a one-time email-link sign-in that proves the human controls the account. This tool does NOT open a browser itself - relay the returned URL and code to the human. Once approved, the minted API key is stored locally and subseque","write_action":false,"price_micros":0,"input_schema":null},{"name":"upload_file","description":"Encrypts and uploads exactly the file or directory at the given local `path` (absolute, or relative to the current working directory). A directory is zipped client-side into a single archive before upload. Reads only that one path \\u2013 never scans unrelated files or directories. Returns a shareable link (24h expiry, 100MB cap) with the decryption key embedded in the URL fragment; the key is neve","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":72,"grade":"B","scanned_at":"2026-09-24T12:01:53.683Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-24T12:01:53.877Z","components":{"code":{"score":25,"max":25,"notes":["3 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 54 days ago"]},"identity":{"score":4,"max":10,"notes":["namespace and repository owner differ"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"@yafldev/mcp","version":"0.1.6","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-08-01T20:30:32.545Z","repositoryUrl":"git+https://github.com/yafldev/mcp.git","weeklyDownloads":33}],"repo":{"found":true,"owner":"yafldev","repo":"mcp","archived":false,"pushedAt":"2026-08-01T20:37:38Z","stars":0,"forks":0,"openIssues":0,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/302598069?v=4","ownerCreatedAt":"2026-07-11T17:58:19Z","license":"MIT"},"icon":{"url":"https://yafl.dev/logo.svg","source":"site"},"presence":{"stars":0,"forks":0,"downloadsWeek":33,"license":"MIT","lastPushAt":"2026-08-01T20:37:38.000Z","score":18}}}},"grade_history":[],"reviews":[]}