Fula MCP Server

What It Is

The Fula MCP server lets AI assistants — like Claude, ChatGPT, Gemini, or Codex — read and write files in a collaboration folder you share with them, inside your Fula storage. Files the AI writes are encrypted in exactly the same end-to-end-encrypted format the FxFiles app uses, so they appear right alongside your own files in FxFiles.

The important part: the AI only ever gets access to the specific folder you share with it — the same way you would share a folder with another person. It never receives the key that decrypts your other files, and your master encryption key never leaves your device or is given to any AI or server.

MCP (Model Context Protocol) is the open standard AI assistants use to connect to external tools. The Fula MCP server is one such tool: it exposes a small set of "read / list / search / store / create-folder / remove" file operations, scoped to the one collaboration folder you shared.

Two Ways to Use It

There are two ways to connect an AI to a collaboration folder in your Fula storage. Pick the one that matches your AI assistant:

Local Binary Setup

The local server is published as an npm package, @functionland/fula-mcp. You never build anything — npx downloads a verified, prebuilt binary for your platform the first time it runs and caches it. Your AI client launches it automatically.

npx @functionland/fula-mcp

In every client below you paste a connection bundle into the FULA_MCP_CAPABILITY environment variable. You get that bundle from FxFiles when you share a folder with the AI — open a Collaborate folder, tap Share with AI Agent, and copy the Desktop configuration (see How to Connect). It grants access to that one shared folder — not your master key.

Click a client to expand its setup:

{
  "mcpServers": {
    "fula": {
      "command": "npx",
      "args": ["-y", "@functionland/fula-mcp"],
      "env": {
        "FULA_MCP_CAPABILITY": "<paste your connection bundle from FxFiles>"
      }
    }
  }
}

claude mcp add-json fula '{
  "type": "stdio",
  "command": "npx",
  "args": ["-y", "@functionland/fula-mcp"],
  "env": { "FULA_MCP_CAPABILITY": "<paste your connection bundle from FxFiles>" }
}'

[mcp_servers.fula]
command = "npx"
args = ["-y", "@functionland/fula-mcp"]

[mcp_servers.fula.env]
FULA_MCP_CAPABILITY = "<paste your connection bundle from FxFiles>"

codex mcp add fula --env FULA_MCP_CAPABILITY="<bundle>" -- npx -y @functionland/fula-mcp

{
  "mcpServers": {
    "fula": {
      "command": "npx",
      "args": ["-y", "@functionland/fula-mcp"],
      "env": { "FULA_MCP_CAPABILITY": "<paste your connection bundle from FxFiles>" }
    }
  }
}

Hosted Connector Setup (Web AIs)

Web-based AI assistants (Claude.ai, ChatGPT on the web) cannot launch a local program — they can only reach a server over the internet. For those, add the hosted Fula MCP connector:

https://mcp.cloud.fx.land/mcp

You add that URL as a custom connector in your AI, sign in with Google (use the same Google account you use in FxFiles), and the sign-in confirmation page shows your AI's Fula ID to copy. You then share a Collaborate folder with that Fula ID in FxFiles (see How to Connect).

Click your web AI to expand its setup:

How to Connect

You grant an AI access from inside the FxFiles app (or the web app at files.fx.land) by sharing a Collaborate folder with it. You stay in control: you choose the folder, and you can revoke access at any time.

1. Open FxFiles (app or web) and sign in as usual.
2. Go to Shared → Collaborate and tap New Collaborate to create a shared folder (or open an existing one).
3. Open that folder and tap the Share with AI Agent icon.
4. Paste the AI's Fula ID in the box:
   • Web AI (Claude.ai / ChatGPT): copy the Fula ID from the sign-in confirmation page — see Hosted Connector Setup.
   • Desktop / terminal AI: the same dialog gives you the Desktop configuration (the FULA_MCP_CAPABILITY value) to paste into your client — see Local Binary Setup.

That's it — the AI can now read and write files in that folder. Add files yourself and ask it to read them; ask it to write notes or results; or remove a file from the folder to revoke the AI's access to that file.

What the AI Can Do

The MCP server exposes a small, fixed set of file operations. The AI can only call these, and only within the collaboration folder you shared with it:

Security, Privacy & Data Protection

This section states what is guaranteed and what the honest limits are. We do not claim more than the design delivers.

Guaranteed: the AI can never reach your other files on its own

This is the one absolute guarantee, and it holds for both the local binary and the hosted connector: the AI can never reach files you did not share with it on its own — without an explicit action by you. It rests on two independent mechanisms — either one alone would block access to your other files; both must be defeated for any leak, and the second does not depend on the cryptography of the first:

• 1. The master key is never shared. The AI never receives the master key that decrypts your files. When you share a Collaborate folder with the AI, it is given access to only that folder's contents — the same way you would share the folder with another person — and nothing else. Your master key never leaves your device and is never given to the AI or to any server, so the AI cannot reach any file outside the folders you shared.
• 2. The storage gateway independently enforces scope. The AI's access token is restricted by the storage gateway itself to the shared folder and the operations it is allowed. Even if the encryption were somehow bypassed, the gateway still refuses any request outside that scope. Crucially, isolation between different users comes from the gateway opening storage per account (keyed to your hashed user id and the token's subject) — not merely from a path prefix.

Your shared folder — local binary

With the local binary, the connection bundle lives in your AI client's configuration file on your own computer. The server is stateless: it loads the bundle into memory at startup, never writes secrets to disk, and never logs them.

Your shared folder — hosted connector

The hosted connector — a Cloudflare Worker — is built so that a stolen database or disk reveals nothing useful: it stores each connection's secrets encrypted, with the encryption key held in a self-hosted OpenBao (a separate secrets vault on a server — a distinct trust domain from the Worker). The Worker must call OpenBao to decrypt in order to serve a request, and its OpenBao policy lets it only wrap/unwrap — never read or export the encryption key itself. (This holds as long as the OpenBao unseal/root keys are not kept on the same machine as the database.) For the default connector at mcp.cloud.fx.land this runs on Functionland's infrastructure; if you self-host the Worker, it runs entirely in your own trust domain.

Connection model & revoking access

You connect once, and it keeps working until you disconnect. The AI carries a short-lived session token (about an hour by default, and at most 24 hours if a server is configured for a longer lifetime) and cannot renew it on its own.

When you Disconnect a connection in FxFiles, two things happen: the pairing is removed (so the AI gets no new access from that moment), and the connection is revoked on the server. With the storage gateway enforcing revocation — the recommended, standard deployment — the gateway refreshes its revocation deny-list on a short interval and cuts the AI off within about 30 seconds, well before the session token would have expired on its own.

Encryption

• Every file is individually encrypted with its own random per-file key (a fresh data-encryption key per file), using authenticated encryption (AES-256-GCM by default; ChaCha20-Poly1305 is also supported).
• Per-file keys are wrapped to recipients, so a file the AI writes can be unwrapped by you (its owner) without exposing any other file's key.
• Metadata privacy. Filenames and paths are not stored in the clear: storage keys are obfuscated (hashed), and the index that maps your logical paths to stored objects is itself encrypted. An observer of raw storage does not learn your filenames or folder structure. (As with any storage service, the operator can still see coarse metadata such as file sizes and access timing — but not your content, filenames, or folder structure.)