Veilfile — private, ephemeral artifact hosting for AI agents

When a coding agent in CI or a cloud session produces a screenshot, log bundle, or HAR file for review, it needs a private URL to put it at — not a public repo. Veilfile is the sanctioned place: upload via API key (or MCP), get back an unguessable, expiring URL. Uploads are scanned for secret shapes and flagged (never blocked, never logged).

• API: POST /api/v1/artifacts (multipart, Authorization: Bearer vlf_…) → {id, url, expires_at, size_bytes, secret_flags[]}. GET /a/<token> serves the file (the 256-bit token is the auth). List/revoke endpoints included.
• MCP: hosted Streamable HTTP server at POST /mcp (upload_artifact, list_artifacts, revoke_artifact), same vlf_ keys.
• Dashboard: session-auth React app at /app/ — API keys (raw key shown once), usage vs plan caps, artifact table with secret-flag badges + revoke, Stripe billing portal.
• Landing page: / (public). Agent docs: /llms.txt, docs/API.md.

See SPEC.md for the product spec.

Plans

Quickstart (local dev)

# Backend
python3 -m venv venv && ./venv/bin/pip install -r backend/requirements.txt
export DJANGO_DEBUG=True DJANGO_SECRET_KEY=dev-only-key
./venv/bin/python backend/manage.py migrate
./venv/bin/python backend/manage.py createsuperuser   # dashboard login
./venv/bin/python backend/manage.py runserver          # :8000

# Frontend (separate terminal; proxied /api -> :8000)
cd frontend && npm install && npm run dev               # :5173

Sign up at http://localhost:8000/accounts/signup/ (or log in), open /app/, create an API key, then:

curl -H "Authorization: Bearer vlf_..." \
     -F "file=@screenshot.png" \
     http://localhost:8000/api/v1/artifacts/

Environment variables

No secrets are committed to this repo. Copy the names below into a local .env (gitignored) or your host's env config. Stripe stays in TEST mode until live keys are connected.

Without Stripe vars, checkout/portal return 503 billing_not_configured and the dashboard shows a friendly note; everything else works.

Tests

cd backend && DJANGO_DEBUG=True DJANGO_SECRET_KEY=dev-only-key \
  ../venv/bin/python manage.py test
# 73 tests: drop_core (34) + drop_billing (17) + drop_mcp (22)

cd frontend && npm run build   # must succeed; assets resolve under /static/

Ops

• TTL sweeper (daily cron): python backend/manage.py sweep_expired deletes expired artifacts (files + rows). Idempotent.
• Storage: Render's disk is ephemeral — production must use DROP_STORAGE=s3 (Cloudflare R2).
• MCP registries: launch checklist in docs/REGISTRIES.md.

Project layout

backend/
  config/          Django settings/URLs (env-driven)
  drop_core/       Workspace, APIKey (vlf_), Artifact, plans, storage,
                   secret scan, agent API, key mgmt, sweeper
  drop_billing/    Stripe checkout/portal/webhook (live, tax-inclusive, Managed Payments)
  drop_mcp/        Streamable HTTP MCP server (POST /mcp)
  templates/       login/logout/signup pages
frontend/          React + Vite (base: '/static/'); / landing, /app/ dashboard
docs/              API.md, llms.txt (served at /llms.txt), REGISTRIES.md
Dockerfile         multi-stage node -> python build, WhiteNoise + gunicorn
render.yaml        Render deploy blueprint

Launch checklist

1. Create Cloudflare R2 bucket + API token (S3-compatible).
2. Create Stripe products/prices (Team $4, Scale $12, tax-inclusive) with product tax codes; note the price IDs.
3. Deploy on Render (see render.yaml); set env vars incl. DROP_BASE_URL.
4. Point Stripe webhook at https://<host>/api/v1/billing/webhook; set STRIPE_WEBHOOK_SECRET.
5. Add daily cron: python backend/manage.py sweep_expired.
6. List the MCP server per docs/REGISTRIES.md.