Filelayer runs on your own machine — the client starts it, so there is no endpoint to ping. 235 installs a week from npm. Last commit 2 Nov 2026.
User files for a SaaS, under one person's authority: list, share with an expiry, revoke.
What the code does
We read the source, 1 d ago · rules 995398eba69f
Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.
const r = spawnSync(
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
Nothing serious here today
Today is the operative word: we check Filelayer every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add core -e 'DATABASE_URL=<DATABASE_URL>' -e 'FILELAYER_AS=<FILELAYER_AS>' -e 'FILELAYER_ORG=<FILELAYER_ORG>' -- npx -y @filelayer/core{
"mcpServers": {
"core": {
"command": "npx",
"args": [
"-y",
"@filelayer/core"
],
"env": {
"DATABASE_URL": "<DATABASE_URL>",
"FILELAYER_AS": "<FILELAYER_AS>",
"FILELAYER_ORG": "<FILELAYER_ORG>"
}
}
}
}[mcp_servers.core]
command = "npx"
args = ["-y", "@filelayer/core"]
env = { DATABASE_URL = "<DATABASE_URL>", FILELAYER_AS = "<FILELAYER_AS>", FILELAYER_ORG = "<FILELAYER_ORG>" }{
"mcpServers": {
"core": {
"command": "npx",
"args": [
"-y",
"@filelayer/core"
],
"env": {
"DATABASE_URL": "<DATABASE_URL>",
"FILELAYER_AS": "<FILELAYER_AS>",
"FILELAYER_ORG": "<FILELAYER_ORG>"
}
}
}
}{
"servers": {
"core": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@filelayer/core"
],
"env": {
"DATABASE_URL": "<DATABASE_URL>",
"FILELAYER_AS": "<FILELAYER_AS>",
"FILELAYER_ORG": "<FILELAYER_ORG>"
}
}
}
}Put your own values in place of
<DATABASE_URL> (Your own PostgreSQL, where this library keeps file ownership, grants and the audit chain. Apply node_modules/@filelayer/core/schema.sql once before starting), <FILELAYER_AS> (The ONE subject this server speaks for, in your own id space. Fixed for the life of the process: no tool reads it as an argument and no tool can change it, which is the only reason exposing these tools to an agent is safe. Write it yourself or have your provisioning write it, never derive it from a conversation. Serving several people means starting several servers), <FILELAYER_ORG> (The organisation this server is scoped to, in your own id space).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
FILELAYER_DATA_DIR (A local directory for the bytes. Needs no bucket and no IAM user. Set this OR the S3_* block: with neither, the server refuses to start rather than falling back to memory, which would work in a demo and lose the first real file), S3_ENDPOINT (An S3-compatible endpoint, for example https://<account>.r2.cloudflarestorage.com. Setting it makes S3_BUCKET, S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY required), S3_BUCKET (The bucket. It must be private: this library decides who may be GIVEN a URL and has no say in who the object store will answer. `npx -p @filelayer/core filelayer doctor` reports whether yours serves unauthenticated reads), S3_REGION (Region, or `auto` for Cloudflare R2), S3_ACCESS_KEY_ID (Access key id for the bucket), S3_SECRET_ACCESS_KEY (Secret access key for the bucket), FILELAYER_MCP_AGENT_LABEL (How this agent names itself in the audit trail, recorded on every event these tools produce. It is what lets the chain separate "the partner opened this document" from "the partner's assistant opened this document"), FILELAYER_MCP_ALLOW_DESTRUCTIVE (Set to exactly `true` to register delete_file. Off by default because deleting is not recoverable and an agent that misreads a sentence deletes the wrong thing silently), FILELAYER_MCP_EXPOSE_AUDIT (Set to exactly `true` to register file_audit. Off by default because the trail is an organisation's whole history and a tool that returns it copies every file name, actor and denial into the model's context. Reading it is itself audited since 0.27.0, which was the previous reason; the default did not move), FILELAYER_MCP_RETURN_BYTES (Set to exactly `true` to register read_file. Off by default because a document returned by a tool is a document copied into a model's context; file_info plus a share link is usually what was actually needed), FILELAYER_BASE_URL (The base of the share URLs this instance mints. Without it, share links come back without a URL).
Alternatives to Filelayer
same job, measured the same waySend a file to a user or agent as a share link with expiry, max opens, approval, revoke and logs.
User-owned files and explicit AI Memories for authorized assistants with scoped access.
Print at a print shop with a short label instead of email or USB. Files expire on their own.
Scrape Hacker News stories, comments and user profiles as clean JSON with points, author…
One memory for your AI agents: scoped, expiring, revocable per-agent tokens and an audit log.
Expert witness and medico-legal directory records for the US and Australia, one row per person.
Grade a site's security headers with fixes and a badge; read logs or code for the defender.
Expose any folder of notes as an MCP server — list, read, search, and (opt-in) write files.
Filelayer — questions
Answers built from our own checks of this server.