MCP.Market

Transfa MCP server

by colapsis·io.github.colapsis/transfa·v1.0.1·20 stars

Upload any file, get a signed link. SHA-256 verified, TTL-enforced, no account required.

B72/100grade B
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
Growing

20 stars44 downloads/wk

Reviews

Write one

Nobody has reviewed Transfa yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Transfa tools (4, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • delete_uploadwrite action

    Delete an upload immediately. Requires ownership (API key must match the uploader).

  • file_info

    Get metadata about an upload without downloading it.

  • list_uploads

    List your recent uploads. Requires TRANSFA_API_KEY or a key saved by `tf auth`.

  • uploadwrite action

    Upload a file from the local filesystem and get a signed link.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 135 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Transfa compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 38% of 48,255 servers
Tools
4
the typical server has 7
Tools that change things
50%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
20
more than 91% of 28,688 servers
Downloads a week
44
more than 36% of 12,191 servers with a package

What its tools let an agent do: 2 read · 1 create · 1 delete

Install Transfa in Claude Code, Cursor or VS Code

Runs npx -y transfa-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add transfa -- npx -y transfa-mcp
Add to Cursor

What the publisher says

From the Transfa repository's README, as published. We do not edit it. Read it on GitHub

Dead-simple file sharing for developers and AI agents. Upload with one command. Share with a link. No account required.

$ tf upload model.gguf
✓ Uploaded  model.gguf  (4.2 GB)  →  https://transfa.sh/f/xK9mRp
  SHA-256    a3f8c2...d91b
  Expires    in 7 days

Why transfa?

Most file-sharing tools are built for humans clicking through UIs. transfa is built for the terminal — designed to be called from shell scripts, CI pipelines, and AI agents (Claude, GPT, Cursor, etc.) that need to move files without friction.

  • No signup required — just install and upload
  • Any format, any size — up to 100 GB; ML models, archives, binaries, code, media
  • Built for agents — JSON API, SHA-256 checksums, idempotent uploads
  • Password protection, download limits, TTL — full control over every link
  • 100+ formats detected — MIME type auto-detection including .gguf, .safetensors, .parquet, .ipynb, and more

Install

Node.js / CLI

npm install -g transfa

Python SDK

pip install transfa

MCP server (Claude, Cursor, any MCP-compatible agent)

npx -y transfa-mcp

Or use the raw install script:

curl -fsSL https://transfa.sh/install | sh

Quick start

# Upload a file (no account needed)
tf upload photo.jpg

# Upload with custom TTL and password
tf upload secret.zip --ttl 24h --password hunter2

# Upload and pipe the URL to clipboard
tf upload bundle.tar.gz | grep url | awk '{print $2}' | pbcopy

# Download a file
tf download https://transfa.sh/f/xK9mRp

# List your uploads
tf list

# Delete an upload
tf delete xK9mRp

GitHub Actions

Upload build artifacts, coverage reports, and any CI output straight from your workflow:

- uses: colapsis/transfa-action@v1
  id: upload
  with:
    file: ./dist/report.pdf
    api-key: ${{ secrets.TRANSFA_API_KEY }}

- run: echo "${{ steps.upload.outputs.agent-link }}" >> $GITHUB_STEP_SUMMARY

All five outputs are available after the step: id, agent-link, human-link, sha256, expires-at.

See colapsis/transfa-action for the full input reference and more examples (password-protected links, self-hosted instances, single-download limits).

API

transfa is fully REST. Every operation the CLI does, you can do with curl or any HTTP client.

Upload

curl -X POST https://transfa.sh/api/upload \
  -H "Authorization: Bearer $TF_KEY" \
  -F "file=@model.gguf" \
  -F "ttl=7d"
{
  "id": "xK9mRp",
  "url": "https://transfa.sh/f/xK9mRp",
  "download_url": "https://transfa.sh/api/download/xK9mRp",
  "filename": "model.gguf",
  "bytes": 4512345678,
  "sha256": "a3f8c2...d91b",
  "expires_at": "2026-05-21T12:00:00.000Z"
}

Upload options (form fields or headers):

Download

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Transfa: common questions

Is Transfa MCP server safe?
Mostly: it is graded B (72/100). Read the Transfa safety report
How do I install Transfa?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Transfa need an API key?
Yes. The registry entry asks for TRANSFA_API_KEY.
Is Transfa maintained?
The last commit was 173 days ago (2026-05-15). The latest release is v1.0.1.
How does Transfa compare with other MCP servers?
safety score 72/100 (higher than 38% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 50% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.