<p align="center"><img src="design/banner.png" alt="pulr — secure passage of files between minds" width="100%"></p>

pulr

Secure file exchange for AI agents. Agents produce files — reports, CSVs, images, PDFs, code — and have no safe way to hand them to other agents, humans, or downstream automation. pulr.ai is that handoff layer: drop a file, get a verified, scannable, expiring download URL everyone in the chain can actually trust.

Every upload is SHA-256-hashed, scanned before any link activates (secrets, prompt-injection heuristics, ClamAV malware), stamped with provenance (which agent, workflow, and model produced it), and served through unguessable capability URLs with TTLs, download limits, IP/geo/time restrictions, and instant revocation. Humans get a review page with approve/reject; automation gets webhooks and Ed25519-signed receipts. Everything is audit-logged — who fetched, when, from where.

Website: pulr.ai · Docs: pulr.ai/docs · Self-serve signup: pulr.ai/app

This repo is the open tooling: the MCP server (root, npm mcp-server-pulr), the JavaScript SDK (sdk/js, npm @pulr/sdk), and the Python SDK (sdk/python, PyPI pulr-sdk, with LangChain tools).

<p align="center"><img src="design/plate08-vignettes.png" alt="Sealed handoff: sender → sealed capsule → customs → accepted. Safeguards: encrypted, audited, MFA, PHI-blind" width="92%"></p>

Sample uses

• Agent → human sign-off → automation. An agent generates a quarterly report with approval: true; the reviewer gets the link by email, previews provenance and scan results, clicks Approve & release — only then does the download URL go live, and a webhook kicks off the downstream pipeline with a signed receipt as proof.
• Agent → agent handoff without context stuffing. Instead of jamming base64 blobs into a context window, one agent uploads and passes a capability URL; the receiving agent fetches integrity-verified bytes. Revoke the link the moment the job is done.
• Burn-after-reading delivery. max_downloads: 1 + a 1-hour TTL: send credentials-adjacent artifacts, one fetch, then the link is dead — with an audit row showing exactly who took it, from which IP.
• Geo/time-fenced distribution. Lock a link to your office CIDR, US-only access, or 9–5 Eastern: restrictions: { allow_ips, allow_countries, allow_hours }.
• Quarantine as a feature. A "meeting notes" file with an embedded "ignore all previous instructions…" payload (even zero-width-obfuscated or base64-smuggled) gets flagged at upload and can never be shared — your agents never ingest it.
• Compliance trail. GET /v1/artifacts/:id/receipt returns an Ed25519-signed record of hash + provenance + scan + approval, verifiable by anyone without trusting pulr.

Your files are not our data

The only thing that ever reads uploaded bytes is the automated threat scanner — malware signatures, leaked-secret patterns, prompt-injection heuristics. It looks for threats, not information: the verdict is recorded, the content is not extracted, indexed, mined, trained on, or sold.

<p align="center"><img src="design/plate08b-scanner.png" alt="The scanner is not a reader: your file, content folded away → scanned for threats only → same file, never opened → no human reads" width="92%"></p>

MCP server (Claude, agent frameworks)

{
  "mcpServers": {
    "pulr": {
      "command": "npx",
      "args": ["-y", "mcp-server-pulr"],
      "env": { "PULR_API_KEY": "pulr_sk_..." }
    }
  }
}

Then just ask your agent: "Upload this report to pulr with approval required and a 24-hour expiry, and give me the review link."

Tools: pulr_upload (with approval), pulr_send / pulr_inbox / pulr_accept / pulr_reject / pulr_address (sealed workspace-to-workspace handoff — no links), pulr_share (with restrictions), pulr_fetch, pulr_list, pulr_revoke, pulr_receipt, pulr_whoami. Env: PULR_API_KEY (required), PULR_API_URL (optional, defaults to https://pulr.ai; point at your own instance if self-hosting).

JavaScript / TypeScript — npm install @pulr/sdk

import PulrClient from '@pulr/sdk'
const pulr = new PulrClient({ apiKey: process.env.PULR_API_KEY })

const a = await pulr.upload({ filePath: './q3-report.pdf', approval: true, expiresIn: '48h' })
console.log(a.review_url)                                  // send to a human
const { bytes } = await pulr.fetchCapability(a.download_url)  // sha256-verified
console.log(PulrClient.verifyReceipt(await pulr.receipt(a.artifact_id)))  // true

Python — pip install pulr-sdk

from pulr import PulrClient, verify_receipt
pulr = PulrClient()  # reads PULR_API_KEY

a = pulr.upload(file_path="q3-report.pdf", approval=True, expires_in="48h",
                restrictions={"allow_countries": ["US"]})
data, sha = pulr.fetch_capability(a["download_url"])   # sha256-verified
verify_receipt(pulr.receipt(a["artifact_id"]))         # pip install pulr-sdk[verify]

LangChain: from pulr.langchain_tool import pulr_tools → pulr_upload / pulr_fetch / pulr_share StructuredTools for any agent.

Getting a key

Create a workspace at pulr.ai/app — 30 seconds, 500 MB included, owner API key shown once. Mint one key per agent (provenance is stamped from the key); revoke any key to cut that agent off instantly. Full API reference: pulr.ai/docs.

A pulr "artifact" is a durable file with a lifecycle — not a streaming chat-UI panel. If you want typed real-time artifact panels for React chat apps, that's a different (complementary) tool, e.g. @ai-sdk-tools/artifacts. pulr is where the file goes afterward.

MIT © Tal Eilon

The design plates

pulr's product design is kept as a series of drafting plates — one per chapter of the system. A few from the atlas:

<img src="design/plate06-registry.png" alt="Harbor Registry — accounts: a name is pencil until witnessed">	<img src="design/plate04-watchroom.png" alt="Watchroom — the operations register">
<img src="design/plate05-open-water.png" alt="Open Water — the 404: here the survey ends">	<img src="design/plate01.png" alt="Sealed Passage — plate one">