srift-transfer

MCPcommunitylive

v4.3.2app.sriftMITUpdated 7d agonpm GitHub

Decentralized P2P file transfer + encrypted chat for AI agents. Military-grade AES-256. No accounts.

Endpoint healthlive

checked 14 days ago · 2740ms

100% of the last 3 checks reached this endpoint

Works in

ClaudeCursorCopilotChatGPTGemini

Inferred from the transports this listing declares (stdio, streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →

320Downloads/wk

1GitHub stars

7d agoLast update

Package

Authorapp.srift

LicenseMIT

Version4.3.2

Sourcenpm+mcp-registry

npmsrift-transfer

GitHubsrivardhan113/SRIFT-Open_Source

SBOMCycloneDX 1.6 ↓

Trust Status

B

60/100Good

✓Listed in Forge index+10/10

—Publisher identity verified+0/20

→ Publisher: run `forge publish` from the package repo to claim ownership

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

—npm Trusted Publishing (Sigstore)+0/5

→ Publish from GitHub Actions with --provenance so the attestation binds this package to this repo

—npm maintainer match+0/5

→ Earned once your identity is verified above and that login is an npm maintainer of this package

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusCommunity-indexed

PublisherUnverified

SignatureUnsigned

Domain—

Provenance—

Dependencies✓ 60 resolved+ · none vulnerable

Tool surface21 tools · none privileged

Security scan✓ Cleanv2.2.15 · 1mo agoHow well does this scan work?

EvalsNone

IndexedSep 9, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

21 tools · none privileged

Statically extracted from the published packagev2.2.15 · 1mo ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

srift_start_sessionCreate a new SRIFT secure session. Returns the 7-character session ID and a shareable URL. The host approves all future joins. E2EE keys derive locally from the session ID + optional roomSecret.

Create a new SRIFT secure session. Returns the 7-character session ID and a shareable URL. The host approves all future joins. E2EE keys derive locally from the session ID + optional roomSecret.

No input schema was published for this tool.

srift_join_sessionRequest to join an existing SRIFT session by its 7-character session ID. The host must approve before transfers/chat work.

Request to join an existing SRIFT session by its 7-character session ID. The host must approve before transfers/chat work.

No input schema was published for this tool.

srift_session_statusGet current session details: id, role (host/guest), connection state, pending join requests, peer count.

Get current session details: id, role (host/guest), connection state, pending join requests, peer count.

No input schema was published for this tool.

srift_close_sessionClose the active session. Flushes E2EE keys, disconnects signaling, clears chat history.

Close the active session. Flushes E2EE keys, disconnects signaling, clears chat history.

No input schema was published for this tool.

srift_approve_joinHost-only. Approve a pending guest join request by their temp user ID.

Host-only. Approve a pending guest join request by their temp user ID.

No input schema was published for this tool.

srift_reject_joinHost-only. Reject a pending guest join request.

Host-only. Reject a pending guest join request.

No input schema was published for this tool.

srift_kick_userHost-only. Disconnect and ban a peer from the active room.

Host-only. Disconnect and ban a peer from the active room.

No input schema was published for this tool.

srift_send_fileOffer a file to the connected peer in an existing session. The peer must accept with srift_accept_transfer. Returns a fileId for monitoring. Transport is auto-selected internally.

Offer a file to the connected peer in an existing session. The peer must accept with srift_accept_transfer. Returns a fileId for monitoring. Transport is auto-selected internally.

No input schema was published for this tool.

srift_accept_transferAccept a pending file offer from the peer and start downloading.

Accept a pending file offer from the peer and start downloading.

No input schema was published for this tool.

srift_list_transfersList all active and recent transfers with progress, speed, ETA, and status.

List all active and recent transfers with progress, speed, ETA, and status.

No input schema was published for this tool.

srift_quick_shareOne-shot helper: if no session is active, creates one; then seeds the file and returns a public DOWNLOAD URL (https://srift.app/d/<token>) the recipient can open in any browser or curl. No install needed on their side. Best for "AI wants to deliver a file to the user with zero ceremony".

One-shot helper: if no session is active, creates one; then seeds the file and returns a public DOWNLOAD URL (https://srift.app/d/<token>) the recipient can open in any browser or curl. No install needed on their side. Best for "AI wants to deliver a file to the user with zero ceremony".

No input schema was published for this tool.

srift_send_chatSend an end-to-end encrypted (AES-256-GCM) chat message to the connected peer.

Send an end-to-end encrypted (AES-256-GCM) chat message to the connected peer.

No input schema was published for this tool.

srift_chat_historyRead the locally-decrypted chat log for the current session.

Read the locally-decrypted chat log for the current session.

No input schema was published for this tool.

srift_read_stateReturn the raw .srift-state.json contents (session + active transfers snapshot). Useful for one-shot polling without subscribing to SSE.

Return the raw .srift-state.json contents (session + active transfers snapshot). Useful for one-shot polling without subscribing to SSE.

No input schema was published for this tool.

send_file_to_userWorkflow: create a session, seed a file, hand the user a share URL.

Workflow: create a session, seed a file, hand the user a share URL.

No input schema was published for this tool.

filePathAbsolute path to the file you want to deliver

Absolute path to the file you want to deliver

No input schema was published for this tool.

receive_file_from_userWorkflow: open a session and wait for the user to drop files into it.

Workflow: open a session and wait for the user to drop files into it.

No input schema was published for this tool.

saveDirWhere to save incoming files

Where to save incoming files

No input schema was published for this tool.

start_collab_sessionWorkflow: open a long-lived E2EE chat + file room with the user.

Workflow: open a long-lived E2EE chat + file room with the user.

No input schema was published for this tool.

sessionNameLabel for the room

Label for the room

No input schema was published for this tool.

srift-mcp-serverNo description published

This tool published no description. Forge does not invent one.

20 of 21 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Decentralized P2P file transfer + encrypted chat for AI agents. Military-grade AES-256. No accounts.

Keywords

mcp

Alternatives

Comparing tool surfaces…

Tools exposed

21 tools · none privileged · observed 2026-09-09 by static extraction. A tool surface is what one scan read on one day, not a live capability list.

srift_start_session
srift_join_session
srift_session_status
srift_close_session
srift_approve_join
srift_reject_join
srift_kick_user
srift_send_file
srift_accept_transfer
srift_list_transfers
srift_quick_share
srift_send_chat
srift_chat_history
srift_read_state
send_file_to_user
filePath
receive_file_from_user
saveDir
start_collab_session
sessionName
srift-mcp-server

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-09-09 — observed resolution, not a publisher declaration.

60 packages resolved · 5 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

ws8.21.3
cors2.8.62 dependencies
- object-assign4.1.1
- vary1.1.2
uuid14.0.2
dotenv17.4.2
express5.2.1+10 not drawn18 dependencies
- qs6.16.0+2 not drawn
- depd2.0.0
- etag1.8.1
- once1.4.0+1 not drawn
- send1.2.1+5 not drawn6 dependencies
  - debug4.4.3+1 not drawn
  - encodeurl2.0.0
  - etag1.8.1shown above
  - fresh2.0.0
  - mime-types3.0.2+1 not drawn
  - statuses2.0.2
- vary1.1.2shown above
- debug4.4.3shown above+1 not drawn
- fresh2.0.0shown above
- cookie0.7.2
- router2.2.0+2 not drawn3 dependencies
  - debug4.4.3shown above+1 not drawn
  - depd2.0.0shown above
  - parseurl1.3.3
- accepts2.0.0+1 not drawn1 dependency
  - mime-types3.0.2shown above+1 not drawn
- type-is2.1.0+2 not drawn1 dependency
  - mime-types3.0.2shown above+1 not drawn
- parseurl1.3.3shown above
- statuses2.0.2shown above
- encodeurl2.0.0shown above
- mime-types3.0.2shown above+1 not drawn
- proxy-addr2.0.7+2 not drawn
- body-parser2.3.0+6 not drawn3 dependencies
  - qs6.16.0shown above+2 not drawn
  - debug4.4.3shown above+1 not drawn
  - type-is2.1.0shown above+2 not drawn

The crawl stopped at the depth-4 limit. Anything below that level was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

11 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

below the depth cap: 11

es-errors ^1.3.0 — required by side-channel-list@1.0.1below the depth cap
object-inspect ^1.13.4 — required by side-channel-list@1.0.1below the depth cap
call-bound ^1.0.2 — required by side-channel-map@1.0.1below the depth cap
es-errors ^1.3.0 — required by side-channel-map@1.0.1below the depth cap
get-intrinsic ^1.2.5 — required by side-channel-map@1.0.1below the depth cap
object-inspect ^1.13.3 — required by side-channel-map@1.0.1below the depth cap
call-bound ^1.0.2 — required by side-channel-weakmap@1.0.2below the depth cap
es-errors ^1.3.0 — required by side-channel-weakmap@1.0.2below the depth cap
get-intrinsic ^1.2.5 — required by side-channel-weakmap@1.0.2below the depth cap
object-inspect ^1.13.3 — required by side-channel-weakmap@1.0.2below the depth cap
side-channel-map ^1.0.1 — required by side-channel-weakmap@1.0.2below the depth cap

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.