Transfa

io.github.colapsisPublished by GitHub account colapsisv1.0.1Updated Oct 24, 2026

Upload any file, get a signed link. SHA-256 verified, TTL-enforced, no account required.

VerifiedSTDIODesktop onlyFiles & StorageDeveloper Tools

Overview

AI-generated overview

Lets an assistant upload local files to a Transfa file-sharing service and get back signed, expiring download links with SHA-256 checksums.

What you can do
The server exposes tools to upload a file from the local filesystem and return an agent link, a human share page and a SHA-256 checksum; to fetch metadata for an upload (filename, size, checksum, expiry, download count, provenance fields); to list recent uploads; to delete an upload; and to retrieve all files uploaded under a given run_id as a provenance manifest. Uploads can carry provenance fields such as run_id, step, consumer and intent. Links are TTL-enforced and can be password-protected or limited to a number of downloads.
When to use it
Useful when an assistant needs to hand a generated file, report, model or build artifact to a person or another agent without setting up storage. It fits script, CI and agent workflows that move files and need a shareable link plus a checksum.
Requirements
Runs locally over stdio, typically launched with npx transfa-mcp, so Node.js is needed. An API key is optional: set TRANSFA_API_KEY for account features such as listing uploads; without it the server works in guest mode with a 10 MB limit. TRANSFA_BASE_URL can point at a self-hosted instance instead of the default service. Network access to the Transfa service is required.
Before you install
Uploaded files leave the machine and are stored on a third-party service, so do not send secrets or sensitive data. The API key is passed as TRANSFA_API_KEY and should be treated as a credential. Uploads create publicly reachable links until they expire, and delete_upload removes an upload immediately. Paid plans exist for larger files and longer retention.

Installation

In SourceWeft

  1. Open Transfa in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[transfa]

Dead-simple file sharing for developers and AI agents.
Upload with one command. Share with a link. No account required.

[npm version] [npm downloads] [node version] [MIT License] [Hosted service]


$ tf upload model.gguf✓ Uploaded  model.gguf  (4.2 GB)  →  https://transfa.sh/f/xK9mRp  SHA-256    a3f8c2...d91b  Expires    in 7 days

Why transfa?

Most file-sharing tools are built for humans clicking through UIs. transfa is built for the terminal — designed to be called from shell scripts, CI pipelines, and AI agents (Claude, GPT, Cursor, etc.) that need to move files without friction.

  • No signup required — just install and upload
  • Any format, any size — up to 100 GB; ML models, archives, binaries, code, media
  • Built for agents — JSON API, SHA-256 checksums, idempotent uploads
  • Password protection, download limits, TTL — full control over every link
  • 100+ formats detected — MIME type auto-detection including .gguf, .safetensors, .parquet, .ipynb, and more

Install

Node.js / CLI

bash
npm install -g transfa

Python SDK

bash
pip install transfa

MCP server (Claude, Cursor, any MCP-compatible agent)

bash
npx -y transfa-mcp

Or use the raw install script:

bash
curl -fsSL https://transfa.sh/install | sh

Quick start

bash
# Upload a file (no account needed)tf upload photo.jpg
# Upload with custom TTL and passwordtf upload secret.zip --ttl 24h --password hunter2
# Upload and pipe the URL to clipboardtf upload bundle.tar.gz | grep url | awk '{print $2}' | pbcopy
# Download a filetf download https://transfa.sh/f/xK9mRp
# List your uploadstf list
# Delete an uploadtf delete xK9mRp

GitHub Actions

Upload build artifacts, coverage reports, and any CI output straight from your workflow:

yaml
- uses: colapsis/transfa-action@v1  id: upload  with:    file: ./dist/report.pdf    api-key: ${{ secrets.TRANSFA_API_KEY }}
- run: echo "${{ steps.upload.outputs.agent-link }}" >> $GITHUB_STEP_SUMMARY

All five outputs are available after the step: id, agent-link, human-link, sha256, expires-at.

See colapsis/transfa-action for the full input reference and more examples (password-protected links, self-hosted instances, single-download limits).


API

transfa is fully REST. Every operation the CLI does, you can do with curl or any HTTP client.

Upload

bash
curl -X POST https://transfa.sh/api/upload \  -H "Authorization: Bearer $TF_KEY" \  -F "[email protected]" \  -F "ttl=7d"
json
{  "id": "xK9mRp",  "url": "https://transfa.sh/f/xK9mRp",  "download_url": "https://transfa.sh/api/download/xK9mRp",  "filename": "model.gguf",  "bytes": 4512345678,  "sha256": "a3f8c2...d91b",  "expires_at": "2026-05-21T12:00:00.000Z"}

Upload options (form fields or headers):

FieldHeaderDescription
ttlX-Transfa-TTLExpiry: 1h, 24h, 7d, 30d
password—Password-protect the download link
max_downloads—Burn after N downloads
filenameX-Transfa-FilenameOverride the stored filename

Download

bash
# Direct download (no auth required)curl -L https://transfa.sh/api/download/xK9mRp -o model.gguf
# Password-protectedcurl -L "https://transfa.sh/api/download/xK9mRp?password=hunter2" -o secret.zip

File info

bash
curl https://transfa.sh/api/download/info/xK9mRp
json
{  "id": "xK9mRp",  "filename": "model.gguf",  "bytes": 4512345678,  "sha256": "a3f8c2...d91b",  "mime_type": "application/octet-stream",  "download_count": 3,  "has_password": false,  "expires_at": "2026-05-21T12:00:00.000Z",  "active": true}

List uploads

bash
curl https://transfa.sh/api/upload \  -H "Authorization: Bearer $TF_KEY"

Delete

bash
curl -X DELETE https://transfa.sh/api/upload/xK9mRp \  -H "Authorization: Bearer $TF_KEY"

Supported formats

Over 100 file types with correct MIME detection — including types not in standard MIME databases:

CategoryFormats
ML models.gguf .ggml .safetensors .onnx .pt .pth .pkl .ckpt .tflite .mlmodel .lora
Data science.parquet .arrow .feather .h5 .hdf5 .npz .npy .lance .duckdb .ipynb
Code.py .rs .go .ts .kt .swift .scala .cu .sol .vy .elm .zig
Archives.zip .tar .gz .bz2 .xz .7z .zst
3D / Design.glb .gltf .obj .stl .usdz .blend .fig .sketch .psd
Media.avif .webp .heic .jxl .opus .flac .webm .av1
Config.toml .hcl .tf .tfvars .nix .dhall .lock .env
Everything else.wasm .sqlite .db .pem .crt .p12 + all standard types

Any other format is accepted as application/octet-stream — nothing is blocked.


Plans

GuestFreeProTeam
Max file size10 MB500 MB50 GB100 GB
Uploads / day5205005,000
Max TTL24h48h30 days180 days
Storage——UnlimitedUnlimited
PriceFreeFree$12/mo$48/mo
Trial——3-day free trial3-day free trial

→ See full pricing


MCP server (Claude, Cursor, and any MCP-compatible agent)

transfa ships an MCP server that lets Claude, Cursor, and any MCP-compatible agent upload and share files autonomously — no shell commands, no infrastructure setup.

bash
npx -y transfa-mcp

Claude Desktop config

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "transfa": {      "command": "npx",      "args": ["-y", "transfa-mcp"],      "env": {        "TRANSFA_API_KEY": "your-api-key"      }    }  }}

The API key is optional — the server works in guest mode without one (10 MB / 24h limit).

Available MCP tools

ToolDescription
uploadUpload a file from the local filesystem. Returns agent_link (direct URL), human_link (share page), and sha256. Accepts run_id, step, consumer, intent for provenance.
file_infoGet metadata about an upload — filename, size, SHA-256, expiry, download count, provenance fields.
list_uploadsList recent uploads (requires API key).
delete_uploadDelete an upload immediately.
run_artifactsGet all files uploaded under a run_id — the full provenance manifest for a pipeline run or agent session.

Example agent workflow

When Claude has transfa as an MCP tool, it can:

  1. Generate a report → call upload → get a link → paste the link in the conversation
  2. Pass a file to another agent by sharing the agent_link
  3. Clean up with delete_upload when done

Python SDK

python
import transfa
# Uploadresult = transfa.upload("model.pt", ttl="24h", run_id="run-42", artifact=True)print(result.url, result.sha256)
# Download (SHA-256 verified)transfa.download(result.id, output="model.pt")
# Provenance manifest for a runmanifest = transfa.run_artifacts("run-42")
# Asyncasync with transfa.AsyncClient() as client:    result = await client.upload("model.pt")

See python/README.md for the full API reference.


Use with AI agents (script/subprocess)

transfa is also designed to be called from shell scripts, CI pipelines, and agents that prefer subprocess calls:

python
import subprocess, json
result = subprocess.run(    ["tf", "upload", "output.csv"],    capture_output=True, text=True)data = json.loads(result.stdout)print(data["url"])  # https://transfa.sh/f/xK9mRp

Or use the REST API directly — no SDKs, no auth flows, just HTTP.


Self-hosting

bash
git clone https://github.com/colapsis/transfa.gitcd transfacp .env.example .env          # fill in your keysnpm install --prefix servernpm install --prefix clinpm run build --prefix frontendpm2 start ecosystem.config.cjs

Requirements: Node.js 18+, nginx (for SSL/proxy)

See nginx/transfa.conf for a production-ready nginx config.

Environment variables

VariableDescription
PORTServer port (default: 3001)
BASE_URLPublic URL e.g. https://transfa.sh
STRIPE_SECRET_KEYStripe secret key for billing
STRIPE_WEBHOOK_SECRETStripe webhook signing secret
STRIPE_PRO_PRICE_IDStripe price ID for Pro plan
STRIPE_TEAM_PRICE_IDStripe price ID for Team plan

Security

Found a vulnerability? Please email [email protected] or see SECURITY.md.

Do not open a public issue for security reports.


License

MIT — © 2026 transfa contributors

Source: README.md at commit d665b06

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts