# share.imeatsack.com

An agent shares files with a person, or gets files from a person. Create a request or a send, paste the link, wait. The person never signs in. Bytes go straight to storage.

This URL is the MCP server. Browsers get a short page. Agents should fetch `https://share.imeatsack.com/mcp.md` or send `Accept: text/markdown`. The Cursor skill is `https://share.imeatsack.com/skill.md`.

## Connect

- MCP (Streamable HTTP): `https://share.imeatsack.com/mcp`
- Skill: [https://share.imeatsack.com/skill.md](https://share.imeatsack.com/skill.md)
- This guide: [https://share.imeatsack.com/mcp.md](https://share.imeatsack.com/mcp.md)
- HTTP create: `POST https://share.imeatsack.com/api/v1/transfers`
- Cursor install: https://cursor.com/en/install-mcp?name=share.imeatsack.com&config=eyJ1cmwiOiJodHRwczovL3NoYXJlLmltZWF0c2Fjay5jb20vbWNwIn0=
- Cursor plugin: [https://github.com/garylesueur/sharemeatsack](https://github.com/garylesueur/sharemeatsack) — MCP plus the skill
- Grok: [grok.com/connectors](https://grok.com/connectors) — Custom, paste the MCP URL. There is no one-click badge yet.

There is no API key. Create is open today. Creating will later need a lanyard account. The person who opens the link never signs in.

## Install plugin

Use the [installation guide](https://share.imeatsack.com/install) for step-by-step setup and copyable commands.

The [Meatsack marketplace](https://github.com/garylesueur/meatsack-marketplace) includes ask.imeatsack.com, show.imeatsack.com, and share.imeatsack.com. Each plugin packages its hosted MCP connection and workflow skill. Install the ones you need.

### Codex

```sh
codex plugin marketplace add garylesueur/meatsack-marketplace
```

Restart the desktop app, open Plugins, choose Meatsack, then install share.imeatsack.com. Adding the marketplace makes all three plugins available; install the ones you need.

### Claude Code

```text
/plugin marketplace add garylesueur/meatsack-marketplace
/plugin install sharemeatsack@meatsack
```

Confirm the Claude Code install in the plugin panel, then start a new session.

### Cursor

On Teams or Enterprise, a team admin opens Dashboard → Plugins & MCPs → Add Marketplace → Import from Repo. Use https://github.com/garylesueur/meatsack-marketplace, review the plugins, set access, and save. Install share.imeatsack.com from Customize.

For a local install:

```sh
git clone https://github.com/garylesueur/meatsack-marketplace.git
mkdir -p ~/.cursor/plugins/local/sharemeatsack
cp -R meatsack-marketplace/plugins/sharemeatsack/. ~/.cursor/plugins/local/sharemeatsack/
```

Restart Cursor or run Developer: Reload Window after copying the plugin. Confirm its skill and MCP server in Customize. Local plugin imports must be allowed.

## Tool

The tool is named `share.imeatsack.com`. Actions: `request`, `send`, `status`, `wait`, `cancel`, `files`, `merge`.

POST JSON-RPC to `https://share.imeatsack.com/mcp`. Do not invent extra tools, a Slack bot, or a mailer of your own.

## Skill

# share.imeatsack.com

Create a request or a send, put the human link where they will see it, then wait. Do not invent another file host, a gist, or an email attachment.

The product is **share.imeatsack.com**. The tool is named `share.imeatsack.com`. HTTP and the tool are the same transfer. Human links look like `https://share.imeatsack.com/s/…`.

Product homepage and HTTP API: `https://share.imeatsack.com`. Connect MCP at `https://share.imeatsack.com/mcp`.

There is no API key. Create is open today. The person who opens the link never signs in. After create, keep `pollUrl` (or its `token`) and `manageUrl` for status, wait, cancel, and inspect.

## Get files from a person

1. Confirm who they are, and that you already know how to reach them — this chat, Slack, mail. Do not create a request for a guessed address. This product has no contacts book.
2. Call `share.imeatsack.com` with action `request` (or `POST /api/v1/transfers` with `"action": "request"`). Send a title, optional message, optional expiry, optional caps (`maxFiles`, `maxFileSize`, `allowedTypes`), optional metadata, and optional `callbackUrl`.
3. You always get `uploadUrl`, `pollUrl`, and `manageUrl` immediately. Paste **`uploadUrl` into this conversation** so they can open it. Keep `manageUrl` for yourself. Do not put `manageUrl` or the agent token on the upload page.
4. Wait with action `wait` (pass `transferId` and `agentToken` from `pollUrl`). One call sits for up to 50 seconds. If it is still open the reply says `timedOut: true` and `nextAction: "wait"`: **call `wait` again, and keep calling.** Someone taking ten minutes or two hours is the normal case.
5. When status is `complete`, read the file list (`status`, `wait`, or action `files`). You get names, sizes, types, scan status, and short-lived download URLs. You never get file bytes. Do not fetch a large file into the conversation.

## Put files on meatsack (or send them to a person)

“Put them on meatsack” and “send them to Simon” are the same send. The files go on a page. Simon, if anyone, just gets that page’s link.

1. If they named a person, confirm who they are and that you already know how to reach them. If they only asked to put the files on meatsack, skip that.
2. Call `share.imeatsack.com` with action `send` (or `POST /api/v1/transfers` with `"action": "send"`). Send a title, optional message, optional expiry, and `files` as `{ name, type, size }[]` — never bytes.
3. You get one short-lived upload URL per file, plus `downloadUrl`, `pollUrl`, and `manageUrl`. **PUT the bytes at those upload URLs yourself.** Refresh a URL if it is close to expiry. The download link does not serve files until every offered file has arrived.
4. Wait until status is `ready`, then paste **`downloadUrl`.** If they named a person, put it where that person will see it. If they only said put them on meatsack, paste it in this conversation. Do not paste it before the files have landed. Delivery is your job. This service does not send mail.
5. Each file on the page is its own download. There is no zip of everything.

## Someone who is not in this conversation

Giving `uploadUrl` or `downloadUrl` to them is **your** job. They get the same page link you would paste here. This service does not send mail and does not post to other chats. Then wait the same way as above.

## Merge existing share links

1. Identify the primary link to keep and each secondary link to empty. You need the private agent token from each transfer's `manageUrl` or `pollUrl`; human links alone cannot authorise a merge. Keep all private tokens out of public messages.
2. Check `status` for both transfers. Both must be unexpired and sealed (`complete` for a request, `ready` for a send), with uploads and scans finished. Wait if either is still uploading or scanning.
3. Call `share.imeatsack.com` with action `merge`, `transferId` and `agentToken` for the **primary**, plus `secondaryTransferId` and `secondaryAgentToken` for the **secondary**. Over HTTP, use `POST /api/v1/transfers/{primaryTransferId}/merge`, a primary `Authorization: Bearer ...` header, and JSON `{ "secondaryTransferId": "...", "secondaryAgentToken": "..." }`.
4. The result includes `movedFileCount`, `totalFileCount`, `secondaryFileCount: 0`, the primary `downloadUrl`, and its `expiresAt`. Files move together; nothing is copied through the agent. Repeat for additional secondary links using the same primary. Duplicate filenames remain separate files. The primary's kind, links, settings, limits, and expiry stay the same; a request remains private to its agent for file access.
5. Refresh status and retry on `merge_conflict`. Repeating a successful merge from an empty secondary moves zero files. If the combined files exceed the primary's limits, neither transfer changes. Scan verdicts stay attached and blocked files stay blocked.

The secondary stays sealed and empty with its existing expiry. There is no immediate deletion operation or empty-share cleanup job. Production Redis records age out after the existing expiry/read window; automatic object deletion is still future work. Already issued storage URLs remain valid until their own expiry.

## Do not

- Name extra tools. There is one tool, `share.imeatsack.com`, with actions `request`, `send`, `status`, `wait`, `cancel`, `files`, and `merge`.
- Put the agent status secret or `manageUrl` on the human page or anywhere the person should not see it.
- Treat Slack or email posting as a feature of this product.
- Pull a large file into the chat, or attach the files to mail yourself.
- Put file bytes in the tool argument or expect them in the tool result.

## HTTP

Same transfer as the tool.

```
POST https://share.imeatsack.com/api/v1/transfers
Content-Type: application/json

{
  "action": "request",
  "title": "Invoices"
}
```

Create a request and you get `uploadUrl`, `pollUrl`, and `manageUrl`. Create a send with `files: [{ name, type, size }]` and you get one upload URL per file plus `downloadUrl`. Keep the token on `pollUrl` and `manageUrl`. Paste the human link where they will see it.

- Status: `GET /api/v1/transfers/{transferId}?token=`
- Wait: `POST /api/v1/transfers/{transferId}/wait` (bound at most 60 seconds; one call sits up to 50, then answers `timedOut: true` with `nextAction: "wait"` — call it again)
- Cancel: `POST /api/v1/transfers/{transferId}/cancel`
- Files: `GET /api/v1/transfers/{transferId}/files?token=`
- Merge: `POST /api/v1/transfers/{primaryTransferId}/merge` with the primary private bearer token and JSON `{ "secondaryTransferId": "...", "secondaryAgentToken": "..." }`
- Manage summary: `GET /s/{transferId}/manage?token=` (markdown at `.md`)

Merge requires both private tokens and two unexpired transfers with uploads and scans finished. It moves every secondary file into the primary atomically, enforces the primary's limits, and returns `movedFileCount`, `totalFileCount`, `secondaryFileCount: 0`, `downloadUrl`, and `expiresAt`. The primary keeps its link, kind, settings, and expiry; the secondary stays sealed and empty until its existing retention ends. On `merge_conflict` (409), refresh status and retry. A retry after success moves zero files. Already issued storage URLs keep their own expiry. Automatic object cleanup is still future work.

## Do not

- Index or share transfer pages (`/s/…`). Those are private links.
- Put the agent status secret or manageUrl on the human page.
- Treat Slack or email posting as a feature of this product.
- Put file bytes in the tool argument or expect them in the tool result.