How to Send a File From an AI Agent: A Secure MCP Tutorial

The default answers are all weak. Pasting the contents into a chat window or an email puts sensitive data into systems that keep it indefinitely and forward it freely. A raw presigned storage URL is better, but it has no expiry by design, can be opened any number of times, and leaves no record of who collected it or when. None of these were built to hand a regulated document to one person and then forget it ever existed.

A secure hand-off needs four things: the file is encrypted before it leaves the machine, the link works exactly once, the file is deleted after collection, and the whole exchange is logged. FileSeal’s Secure Send API gives an agent that channel in a single tool call, so the agent never has to implement encryption, expiry, or deletion itself.

Step 2 (MCP): Add the fileseal-send server

Register the fileseal-sendMCP server in your agent’s config. Set both the key and the base URL, otherwise the server points at localhost:

{
  "mcpServers": {
    "fileseal-send": {
      "command": "node",
      "args": ["mcp/fileseal-send/index.mjs"],
      "env": {
        "FILESEAL_API_KEY": "fsk_your_key_here",
        "FILESEAL_API_BASE_URL": "https://fileseal.uk"
      }
    }
  }
}

That is the whole integration. The server exposes three tools: secure_send to encrypt a file and create the send, send_status to check status and audit events, and revoke_send to cancel a send before it is opened. The server does the client-side encryption for you, so the agent just points at a file and gets back a link.

Step 2 (REST): Or send one request

Not using MCP? Encrypt the file client-side, base64-encode the ciphertext, and POST it. The response gives you the claim link, the expiry, and the seal id:

curl -X POST https://fileseal.uk/v1/sends \
  -H "Authorization: Bearer $FILESEAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "deliveryMode": "link",
    "expiryHours": 48,
    "files": [{
      "filename": "summary.pdf",
      "mimeType": "application/pdf",
      "ciphertextBase64": "<[12-byte IV][AES-GCM ciphertext], base64>"
    }]
  }'

Step 3: Relay the link

In the default link mode the response is the base claim URL, and the AES key lives in the link’s #k= fragment. The MCP tool assembles the full link for you; over REST you append the fragment yourself, so FileSeal never receives the key. Hand that link to the recipient through whatever channel you like. They click it once, the file decrypts in their browser, and it is gone from FileSeal straight after.