Encrypts and uploads exactly the file at the given local path (absolute, or relative to the current working directory). Reads only that one file — never scans directories, never accesses any other file. Returns a shareable link (24h expiry, 100MB cap) with the decryption key embedded in the URL f...
AI agents use upload_file to create or update resources in Yafldev — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Yafldev environment.
| Parameter | Type | Required | Description |
|---|---|---|---|
path | string | Yes | Absolute or cwd-relative path to the local file to upload |
password | string | — | Optional password to protect the link. Composed into the decryption key on the client via a fresh salt — never transmitted to the API. When set, the returned li |
Parameters from the server's own tool schema.
The tool creates a new resource (encrypted file upload) on a remote server and generates a shareable link, which is a reversible write operation. While encryption and client-side key handling provide security properties, the core function is data creation/transmission.
From the tool's definition Tool description explicitly states it 'uploads' a file and 'returns a shareable link', indicating data creation and modification on a remote system.
Risk signalsAccepts file system path (path) · Handles credentials or secrets (password)
Attacks that exploit this kind of access
Encrypts and uploads exactly the file at the given local path (absolute, or relative to the current working directory). Reads only that one file — never scans directories, never accesses any other file. Returns a shareable link (24h expiry, 100MB cap) with the decryption key embedded in the URL fragment; the key is never sent to the API. It is categorised as a Write tool in the Yafldev MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
upload_file accepts 2 parameters: path, password. Required: path. The full parameter table on this page comes from the server's own tool schema.
Register the Yafldev MCP server in PolicyLayer and add a rule for upload_file: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Yafldev. Nothing to install.
upload_file is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the upload_file rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for upload_file. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
upload_file is provided by the Yafldev MCP server (@yafldev/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
upload_file is one line of Yafldev's registry record.
The record carries the whole server: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.
Teams ship this data inside their own products. See what a licence covers →