Transfa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Transfa (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <a href="https://transfa.sh"><img src="https://transfa.sh/brand/logo-wordmark.png" height="52" alt="transfa" /></a> </p>
<p align="center"> <strong>Dead-simple file sharing for developers and AI agents.</strong><br/> Upload with one command. Share with a link. No account required. </p>
<p align="center"> <a href="https://www.npmjs.com/package/transfa"><img src="https://img.shields.io/npm/v/transfa?color=0ea5e9&label=npm" alt="npm version" /></a> <a href="https://www.npmjs.com/package/transfa"><img src="https://img.shields.io/npm/dm/transfa?color=8b5cf6&label=downloads" alt="npm downloads" /></a> <img src="https://img.shields.io/badge/node-%3E%3D18-brightgreen" alt="node version" /> <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License" /></a> <a href="https://transfa.sh"><img src="https://img.shields.io/badge/hosted-transfa.sh-ff6b6b" alt="Hosted service" /></a> </p>
$ tf upload model.gguf
✓ Uploaded model.gguf (4.2 GB) → https://transfa.sh/f/xK9mRp
SHA-256 a3f8c2...d91b
Expires in 7 daysMost file-sharing tools are built for humans clicking through UIs. transfa is built for the terminal — designed to be called from shell scripts, CI pipelines, and AI agents (Claude, GPT, Cursor, etc.) that need to move files without friction.
.gguf, .safetensors, .parquet, .ipynb, and moreNode.js / CLI
npm install -g transfaPython SDK
pip install transfaMCP server (Claude, Cursor, any MCP-compatible agent)
npx -y transfa-mcpOr use the raw install script:
curl -fsSL https://transfa.sh/install | sh# Upload a file (no account needed)
tf upload photo.jpg
# Upload with custom TTL and password
tf upload secret.zip --ttl 24h --password hunter2
# Upload and pipe the URL to clipboard
tf upload bundle.tar.gz | grep url | awk '{print $2}' | pbcopy
# Download a file
tf download https://transfa.sh/f/xK9mRp
# List your uploads
tf list
# Delete an upload
tf delete xK9mRpUpload build artifacts, coverage reports, and any CI output straight from your workflow:
- uses: colapsis/transfa-action@v1
id: upload
with:
file: ./dist/report.pdf
api-key: ${{ secrets.TRANSFA_API_KEY }}
- run: echo "${{ steps.upload.outputs.agent-link }}" >> $GITHUB_STEP_SUMMARYAll five outputs are available after the step: id, agent-link, human-link, sha256, expires-at.
See colapsis/transfa-action for the full input reference and more examples (password-protected links, self-hosted instances, single-download limits).
transfa is fully REST. Every operation the CLI does, you can do with curl or any HTTP client.
curl -X POST https://transfa.sh/api/upload \
-H "Authorization: Bearer $TF_KEY" \
-F "[email protected]" \
-F "ttl=7d"{
"id": "xK9mRp",
"url": "https://transfa.sh/f/xK9mRp",
"download_url": "https://transfa.sh/api/download/xK9mRp",
"filename": "model.gguf",
"bytes": 4512345678,
"sha256": "a3f8c2...d91b",
"expires_at": "2026-05-21T12:00:00.000Z"
}Upload options (form fields or headers):
| Field | Header | Description |
|---|---|---|
ttl | X-Transfa-TTL | Expiry: 1h, 24h, 7d, 30d |
password | — | Password-protect the download link |
max_downloads | — | Burn after N downloads |
filename | X-Transfa-Filename | Override the stored filename |
# Direct download (no auth required)
curl -L https://transfa.sh/api/download/xK9mRp -o model.gguf
# Password-protected
curl -L "https://transfa.sh/api/download/xK9mRp?password=hunter2" -o secret.zipcurl https://transfa.sh/api/download/info/xK9mRp{
"id": "xK9mRp",
"filename": "model.gguf",
"bytes": 4512345678,
"sha256": "a3f8c2...d91b",
"mime_type": "application/octet-stream",
"download_count": 3,
"has_password": false,
"expires_at": "2026-05-21T12:00:00.000Z",
"active": true
}curl https://transfa.sh/api/upload \
-H "Authorization: Bearer $TF_KEY"curl -X DELETE https://transfa.sh/api/upload/xK9mRp \
-H "Authorization: Bearer $TF_KEY"Over 100 file types with correct MIME detection — including types not in standard MIME databases:
| Category | Formats |
|---|---|
| ML models | .gguf .ggml .safetensors .onnx .pt .pth .pkl .ckpt .tflite .mlmodel .lora |
| Data science | .parquet .arrow .feather .h5 .hdf5 .npz .npy .lance .duckdb .ipynb |
| Code | .py .rs .go .ts .kt .swift .scala .cu .sol .vy .elm .zig |
| Archives | .zip .tar .gz .bz2 .xz .7z .zst |
| 3D / Design | .glb .gltf .obj .stl .usdz .blend .fig .sketch .psd |
| Media | .avif .webp .heic .jxl .opus .flac .webm .av1 |
| Config | .toml .hcl .tf .tfvars .nix .dhall .lock .env |
| Everything else | .wasm .sqlite .db .pem .crt .p12 + all standard types |
Any other format is accepted as application/octet-stream — nothing is blocked.
| Guest | Free | Pro | Team | |
|---|---|---|---|---|
| Max file size | 10 MB | 500 MB | 50 GB | 100 GB |
| Uploads / day | 5 | 20 | 500 | 5,000 |
| Max TTL | 24h | 48h | 30 days | 180 days |
| Storage | — | — | Unlimited | Unlimited |
| Price | Free | Free | $12/mo | $48/mo |
| Trial | — | — | 3-day free trial | 3-day free trial |
transfa ships an MCP server that lets Claude, Cursor, and any MCP-compatible agent upload and share files autonomously — no shell commands, no infrastructure setup.
npx -y transfa-mcpAdd to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"transfa": {
"command": "npx",
"args": ["-y", "transfa-mcp"],
"env": {
"TRANSFA_API_KEY": "your-api-key"
}
}
}
}The API key is optional — the server works in guest mode without one (10 MB / 24h limit).
| Tool | Description |
|---|---|
upload | Upload a file from the local filesystem. Returns agent_link (direct URL), human_link (share page), and sha256. Accepts run_id, step, consumer, intent for provenance. |
file_info | Get metadata about an upload — filename, size, SHA-256, expiry, download count, provenance fields. |
list_uploads | List recent uploads (requires API key). |
delete_upload | Delete an upload immediately. |
run_artifacts | Get all files uploaded under a run_id — the full provenance manifest for a pipeline run or agent session. |
When Claude has transfa as an MCP tool, it can:
upload → get a link → paste the link in the conversationagent_linkdelete_upload when doneimport transfa
# Upload
result = transfa.upload("model.pt", ttl="24h", run_id="run-42", artifact=True)
print(result.url, result.sha256)
# Download (SHA-256 verified)
transfa.download(result.id, output="model.pt")
# Provenance manifest for a run
manifest = transfa.run_artifacts("run-42")
# Async
async with transfa.AsyncClient() as client:
result = await client.upload("model.pt")See python/README.md for the full API reference.
transfa is also designed to be called from shell scripts, CI pipelines, and agents that prefer subprocess calls:
import subprocess, json
result = subprocess.run(
["tf", "upload", "output.csv"],
capture_output=True, text=True
)
data = json.loads(result.stdout)
print(data["url"]) # https://transfa.sh/f/xK9mRpOr use the REST API directly — no SDKs, no auth flows, just HTTP.
git clone https://github.com/colapsis/transfa.git
cd transfa
cp .env.example .env # fill in your keys
npm install --prefix server
npm install --prefix cli
npm run build --prefix frontend
pm2 start ecosystem.config.cjsRequirements: Node.js 18+, nginx (for SSL/proxy)
See nginx/transfa.conf for a production-ready nginx config.
| Variable | Description |
|---|---|
PORT | Server port (default: 3001) |
BASE_URL | Public URL e.g. https://transfa.sh |
STRIPE_SECRET_KEY | Stripe secret key for billing |
STRIPE_WEBHOOK_SECRET | Stripe webhook signing secret |
STRIPE_PRO_PRICE_ID | Stripe price ID for Pro plan |
STRIPE_TEAM_PRICE_ID | Stripe price ID for Team plan |
Found a vulnerability? Please email [email protected] or see SECURITY.md.
Do not open a public issue for security reports.
MIT — © 2026 transfa contributors
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.