July 23, 2026
Hot link, cold trust
Show HN: I made YAFL – a E2EE file handoff for AI agents
New tool promises secret file swaps for AI bots, but commenters instantly wanted receipts
TLDR: YAFL is a new tool for letting one AI system pass a file to another through a short-lived private link, with the readable file staying only on the two devices involved. The first community reaction was basically, “Slow down and explain it,” showing early curiosity mixed with healthy suspicion.
A new Show HN post rolled in with a very specific promise: let one AI helper on your computer pass a file to another AI helper somewhere else, without a human stepping in and without the app’s server seeing the readable file. The creator says the file is locked up on your machine first, expires after 24 hours, and can be fetched by another machine using a short link. In plain English: it’s a quick handoff system for bots that need to pass work to each other.
But the real fireworks came from the community mood, which was less “wow, amazing” and more “okay… explain this like I’m five”. The standout reaction was a blunt request for clarity from commenter agustaon, whose simple “Can you explain more” basically became the unofficial vibe of the thread. That tiny line carries a lot: curiosity, skepticism, and a subtle internet-side-eye that says, “You dropped a lot of fancy promises, now prove it.”
That’s the drama here. The product pitches itself as a behind-the-scenes courier for AI agents, but the crowd reaction so far reads like people tapping the glass and asking whether this is genuinely useful or just another clever tool in search of a problem. There weren’t huge meme wars yet, but there was that classic Hacker News tension: founder enthusiasm colliding with the audience’s demand for plain language, practical examples, and zero hype fluff. In other words, YAFL didn’t just launch a file tool — it launched a mini trust exercise.
Key Points
- •YAFL is presented as an end-to-end encrypted file handoff tool for AI agents and machine-to-machine workflows.
- •The tool supports agent-driven transfers over MCP with functions such as upload_file, download_file, get_status, listing, deletion, and login.
- •Files are encrypted locally with AES-256-GCM, and the decryption key is kept in the URL fragment rather than sent to the server.
- •Shared access is limited to 24 hours, with request-time expiry checks and storage cleanup as a backup measure.
- •The setup example uses npm via npx to install @yafldev/mcp and configure access with a YAFL_API_KEY.