Filewash MCP server

filewash — privacy-first file tools for AI agents

The file-processing layer for agents and apps that can't send files to a third party. Compress, convert, resize, merge/split PDFs, strip metadata, and remove backgrounds — exposed as an MCP server, a metered REST API, and an npm SDK. Zero-retention by default: files are processed in memory and never stored or logged.

Built from filewash.app's client-side WASM tools. Same logic,

now callable by your agents.

Why this exists

Every other file-tools API and MCP server is a wrapper around an upload-to-server service. That's a non-starter for legal, healthcare, finance, and any GDPR-bound workflow — and it's a liability when you're piping documents into an LLM. filewash is the one built around not keeping your files, with two tools nobody else ships as an MCP: background removal and metadata scrubbing.

MCP server (Claude Desktop, Cursor, Claude Code)

// claude_desktop_config.json  →  mcpServers
{
  "filewash": { "command": "node", "args": ["/path/to/filewash-api/src/mcp/server.js"] }
}

Your agent now has 11 tools. Ask it: "strip the location metadata from these photos before I upload them" or "merge these contracts and rotate the scanned pages."

REST API

# discover
curl https://api.filewash.app/v1/tools

# strip EXIF/GPS from a photo (returns the cleaned image)
curl -X POST https://api.filewash.app/v1/tools/image_strip_metadata \
  -H "Authorization: Bearer $FILEWASH_KEY" \
  -F 'files=@photo.jpg' -o clean.jpg

# merge PDFs
curl -X POST https://api.filewash.app/v1/tools/pdf_merge \
  -H "Authorization: Bearer $FILEWASH_KEY" \
  -F 'files=@a.pdf' -F 'files=@b.pdf' -o merged.pdf

Every response carries X-Filewash-Meta (operation result) and X-Filewash-Quota-Remaining.

Tools

Pricing (planned)

Run locally

npm install
npm run test:engine   # 10 tools, end-to-end, no browser
npm run mcp           # stdio MCP server
npm run rest          # REST API on :8787  (try key "demo")

Privacy

No file is written to disk by the REST API; the MCP server writes output only to the path you pass. No file contents are logged. The Business tier adds a contractual zero-retention guarantee and audit logging.