Give two agents on two machines the same encrypted folder. P2P, no cloud, only read bytes move.
MCP Server: io.github.KeibiSoft/keibidrop
This MCP server, io.github.KeibiSoft/keibidrop, supports encrypted file sharing between two agents on two machines. It uses a P2P approach with no cloud component; only file bytes are transferred. The project centers on a virtual/shared-folder model and focuses on privacy and end-to-end encryption.
🛠️ Key Features
Two-agent, two-machine encrypted folder sharing
P2P networking with NAT traversal
End-to-end encryption and privacy-oriented design
Virtual-folder / network-filesystem behavior via FUSE (WinFSP mentioned)
Cross-platform support (topics list includes Windows-oriented tooling)
Technologies/topics include Rust, Go, Slint UI, and Post-quantum-security
🚀 Use Cases
Instant shared-file access without upload/download waiting
Secure collaboration or transfer flows for DFIR-oriented workflows (dfir topic)
⚡ Developer Benefits
Works in a model-context-protocol (MCP) setup
Emphasizes peer-to-peer filesystem integration and encrypted transfer
⚠️ Limitations
Intended for P2P operation (“no cloud” and two-agent sharing); the catalog data does not specify scalability beyond that scope.
We host our own F-Droid repository. Open fdroid.keibisoft.com on your phone, scan the code, and check the fingerprint before you add it.
To add it by hand, use https://fdroid.keibisoft.com/fdroid/repo in F-Droid under Settings, Repositories. The fingerprint to check is on the same page.
Build from source
bash
git clone https://github.com/KeibiSoft/KeibiDrop.git
cd KeibiDrop
make build-kd # CLI daemon
make build-cli # Interactive CLI
make build-rust # Desktop UI (needs Rust + Slint)
Quick start
Same network (LAN):
Both peers launch KeibiDrop
Devices discover each other automatically
One click to connect
Share files
Over the internet:
Both peers launch KeibiDrop
Copy your fingerprint and send it to your peer (Signal, Telegram, anything)
Paste each other's fingerprints and connect
Share files
Save a peer as a contact to skip the fingerprint exchange next time. On the same network, saved contacts connect with one click using pseudonyms.
It works through firewalls automatically. If direct connection fails, KeibiDrop falls back to an encrypted relay. No port forwarding, no router configuration.
KeibiDrop reads ~/.config/keibidrop/config.toml. Environment variables override the config.
Setting
Env var
Default
Relay server
KD_RELAY
https://keibidroprelay.keibisoft.com/
Bridge relay
KD_BRIDGE
bridge.keibisoft.com:26600
Save folder
KD_SAVE_PATH
~/KeibiDrop/Received/
FUSE mount
KD_MOUNT_PATH
~/KeibiDrop/Mount/
Inbound port
KD_INBOUND_PORT
26431
Disable FUSE
KD_NO_FUSE
false
Security
Post-quantum hybrid key exchange prevents future quantum computers from decrypting recorded traffic. Forward secrecy via periodic re-keying limits exposure if a session key is ever compromised.
By default, identity persists across sessions (so saved contacts keep working), encrypted with a per-install master key stored in the OS keychain (macOS Keychain Services, Linux Secret Service, Windows Credential Manager). Headless setups fall back to ~/.config/keibidrop/.master.key (mode 0600). Optional passphrase protection via Argon2id for users who back up config to the cloud. Incognito mode switches to ephemeral keys: a fresh keypair each session, anonymous, unlinkable, nothing written to disk.
Mount an evidence share read only across NAT and extract the artifact set you need, with no inbound port, native on Windows, and no kernel driver on the evidence machine. There is a write-up and a DFIR page.
Two terminals. Left: a container on a NAS prints its code and Peer connected. Right: a laptop adds the box as a contact, connects, lists the shared folder and hashes one photo through the mount
A session needs both machines online, and a NAS, a mini PC or a home server is online all the time. The container in docker/ runs the serving side on that box from plain Docker with the stock kernel. Your laptop mounts the folder from anywhere and reads on demand, so only the bytes a program reads cross the wire. In that run the box, a container on a server in Timisoara, served 161 files to a laptop in Bucharest; the laptop paired once, listed the folder and hashed one photo. Setup is one compose file, in the guide. An Unraid template is in docker/unraid/.
Photographers and editors
The raws and the footage stay on the box at the studio. The laptop mounts the folder, Lightroom or Resolve opens the files from the mount, and each file moves only when it is opened; a 1 MiB read out of a big file moves one 16 MiB block. The catalog stays on the laptop, as the post-production page and the video and audio guide describe. Set the share read only when the box is the archive and the laptop must change nothing.
Agents, and the data they work on
Two agents pairing over MCP: the laptop offers a 2,184 file dataset in place, the gpu box lists it and reads shards off the mount
Two agents, one per machine, each driving a KeibiDrop peer through the MCP server. The laptop offers a folder where it sits. The gpu box mounts it, lists 2,184 files six folders deep, and checksums 24 shards. In that run 88,581 bytes crossed the network out of 6,784,286 on disk, because that is what it opened. The whole thing, pairing included, took 12.5 seconds.
Build it with make build-kdmcp, then kdmcp install prints the config snippet for your MCP client. Sending stays off until KD_SHARE_ROOT names one directory to send from, so a receiving agent cannot be talked into shipping files out.
