The link opens a public tunnel to that file in your workspace, and anyone holding it can fetch the file until it expires or three downloads have happened — the publisher says so in its own warning. That is the feature and the exposure in the same sentence, so it is worth deciding deliberately which files ever get one. Everything else is bounded: downloads land only inside the workspace under MIME and size limits, and each path is checked against the boundary before it resolves. One operational note — a link dies with the process serving it, which is why the Docker setup runs Ngrok alongside rather than inside the tool.
An MCP file-and-search gateway built around a single workspace directory. It searches the live web across two providers, downloads files into the workspace, saves files an agent generated, reads them back inline, and can publish one through an Ngrok tunnel as a download link that stops working after three attempts or expiry. Every file request is verified against the workspace boundary first.
- web_search queries the live internet, alternating between Tavily and Brave so one provider's rate limit does not end the search
- download_from_url fetches a public or authenticated HTTP/HTTPS file into the workspace, with MIME-type enforcement and streaming size limits
- save_shared_file writes a file the agent produced — an image, a PDF, a DOCX, plain text — straight into the workspace, binary content passed as base64, so nothing has to be hosted somewhere first
- share_files reads a file's contents inline or generates the public download link; for a PDF it takes a pageStart and pageEnd, or reads the first ten pages to find the table of contents when you are hunting a topic rather than a page number
- Path boundary enforcement checks every file request against the workspace, so a traversal outside it does not resolve
Node, installed globally with npm install -g openclaw-syncralis or as an OpenClaw plugin. Three services on their free tiers: Ngrok for the public tunnel — claiming a static domain is worth it so the URL stops changing — plus TAVILY_API_KEY and BRAVE_API_KEY for the two search providers. Leave WORKSPACE_DIR empty and files land in ~/.openclaw/workspace; set an absolute path only for a container volume. Also configured: PUBLIC_TUNNEL_URL, FILE_SERVER_HOST (127.0.0.1 natively, 0.0.0.0 in Docker), NGROK_API_PORT and a URL_SIGNING_SECRET of your own. Under Docker the publisher runs Ngrok as a separate service so links survive the MCP process exiting.
One command plus a key — npm install -g openclaw-syncralis, then supply credentials