CLI and MCP

@deltabreen/share is the command-line tool. It encrypts on your machine and drives the upload protocol for you, so a file or secret is sent with one command. Nothing to install: run it with npx. Needs Node 18.3 or newer and an account on any plan, Free included; SHARE_API_KEY for scripts needs Studio.

Sign in

npx @deltabreen/share login          # OAuth through the browser
npx @deltabreen/share whoami         # confirm who you are
npx @deltabreen/share logout

For scripts, set SHARE_API_KEY=sbk_… to skip sign-in, and SHARE_BASE_URL to point at another server.

Send files

npx @deltabreen/share send ./contract.pdf \
  --to daniel@firm.com \
  --message "here you go" \
  --expires 3 \
  --one-time \
  --password - \
  --label "Q4 contract"

--to emails the link (Pro and above); whether the email can go is checked before anything is uploaded. --expires is in days (7 unless you say), --downloads N sets a download limit and --one-time deletes the file after its first download. --password - asks for a password at a hidden prompt (or reads SHARE_LINK_PASSWORD); the recipient needs it as well as the link. --note is encrypted with the file, --confirm-email makes the people you email confirm their address before it opens, and --replies lets them send files back (both Pro and above).

With --to, the link is emailed and you get the link back without its key, so the key never lands in your terminal or an assistant's context. Add --show-link to print the full link anyway.

Give several files or a folder (send ./photos ./notes.pdf) and they go as one link. The recipient can preview or download each file on its own, or download everything at once. Symbolic links inside a folder are skipped.

If a send is cut off part way, it is kept: share resume lists unfinished sends, and share resume <id> sends only what is missing, as long as the files have not changed. share abort <id> drops one. Until it finishes, the send's key waits in a private file beside the CLI's config.

Send for signature

npx @deltabreen/share sign ./engagement.pdf \
  --to client@example.com,partner@firm.com \
  --in-order \
  --message "Please sign by Friday" \
  --label "Engagement letter"

share sign encrypts the PDF on your machine with where each person signs (Pro and above). It waits as a draft: the review page opens in your browser, you check the document and the fields, change anything that is wrong, and press Send there. Nobody is asked to sign before that, and an unsent draft is deleted after seven days. The link it prints has no key: it opens in any browser where you unlocked your encryption password, or add --show-link to print it with the key.

Where the fields go: tags written in the PDF, such as {{signature:1}}, {{initials:2}}, {{date:1}}, {{text:1:Company}} and {{checkbox:1}}, counting signers from 1 in --to order (write them in white or tiny text, so they do not show); else --fields, a file of page coordinates in points from the bottom left of the page as it is shown; else a signature and a date for each signer at the end of the last page. Tags are found on Node 22.13 or later.

[{ "signer": 1, "type": "signature", "page": "last", "x": 72, "y": 90 },
 { "signer": 1, "type": "date", "page": "last", "x": 270, "y": 90 }]

--send sends at once, without the check in the browser, for your own scripts. --in-order, --expires (days), --remind-every (days) and --label work as on the new signature request page. Assistants are told never to pass --send, and the local prepare_signature_request tool always makes a draft.

ID checks

npx @deltabreen/share id-check maeve.doyle@client.test --sanctions --address
npx @deltabreen/share id-checks                 # this month's, newest first
npx @deltabreen/share id-check <id>             # where one stands

id-check emails the person a link; add --sanctions and --address for those parts, --keep-copy to keep a copy of the ID, and --link to print the link instead of emailing it. The command line shows each check's status and its page, never the person's details. A command line signed in before ID checks existed asks you to sign in again.

Send a secret

# from a file, deleted after sending (safest — value never hits the command line)
npx @deltabreen/share secret --file secret.txt --rm --to daniel@firm.com --only-named

# from a pipe
printenv TOKEN | npx @deltabreen/share secret --stdin --to daniel@firm.com

# inline (only for something already typed)
npx @deltabreen/share secret "the value" --views 3 --expires 7

Flags: --views N (how many times it can be opened, default 1, at most 100), --only-named (only the --to addresses can open it, after an emailed code), plus --message, --expires, --password, --label. --rm only deletes a small, plain .txt note; when unsure, leave it out.

Manage

npx @deltabreen/share list                 # what you sent
npx @deltabreen/share get <id>             # one share
npx @deltabreen/share activity <id>        # who opened and downloaded it
npx @deltabreen/share status <id>          # per person it was emailed to
npx @deltabreen/share extend <id> --max    # more time, same link
npx @deltabreen/share revoke <id>          # delete it; the link stops working

Add --json to any command for machine-readable output.

Exit codes: 0 done, 1 failed, 2 an option was not understood, 3 sent but not emailed. With 3 the link is printed, so nothing is lost: pass it on another way rather than sending again.

Receive files and answers

npx @deltabreen/share inbox                       # files sent to your file requests
npx @deltabreen/share receive <item-id> --out ~/Downloads
npx @deltabreen/share request get <request-id> --entry <entry-id> --field password --out pw.txt

Files people send to your file requests are encrypted for your workspace. share inbox lists them and share receive decrypts one on your machine, asking for your encryption password at a hidden prompt (or reading SHARE_ENCRYPTION_PASSWORD). share request get opens an answer to a form request the same way and writes it to a file, not the screen; the request's id is in its address in the app.

Links kept for your team

npx @deltabreen/share unlock

Run share unlock once on a computer, with your encryption password, and links you send from it are kept for your team and your other devices, as links sent from the app are. --no-keep keeps one link on this computer only.

MCP server

npx @deltabreen/share mcp runs a local stdio MCP server with send_file, send_status, send_secret, list_shares, get_receipts, get_delivery_status, extend_share, revoke_share, list_received, receive_file, prepare_signature_request, list_signature_requests, get_signature_request, remind_signer, cancel_signature_request, whoami and login, so an assistant on your machine sends files, and prepares PDFs for signature, without a key ever entering its context. A send that takes longer than a tool call answers with an id that send_status finishes. See the Connect page for setup in each client and the online connection.