Talavine
No middleman
Clipboard items and files travel directly between your devices over the LAN. Nothing is uploaded to us; there is no account to create and no relay to subpoena.
Architecture & security
How SwarmSpan works.
SwarmSpan moves your clipboard and files directly between your own computers, with no relay server and no account. This page is the honest, technical version of how that's built and where the trust boundaries are. It's written for the kind of person who reads the security section first.
Local-first, receiver-enforced.
There's no SwarmSpan cloud. Trust is established once between two of your devices and then enforced on each of them: the serving device always decides what leaves it.
The receiver owns its boundaries
Shared-folder scope, per-peer "always allow" trust, and Allow / Deny prompts all live on the device being asked. Even an agent request can't widen them.
Boundaries you own
The file-serving scope is narrow out of the box, and each machine's owner can turn the agent/MCP bridge off entirely (the Mac App Store build ships with it off).
A four-digit code, then a long-lived shared key.
Pairing is a one-time, local act. The short code only has to survive the few seconds of the handshake; what persists afterward is a strong per-peer secret.
- One device shows a codeA short numeric code is displayed on one machine and typed on the other. It never travels over the network in the clear.
- Both sides prove they know itA PBKDF2-derived value over the code is exchanged during the handshake, so each side proves knowledge of the code without sending it.
- A durable peer secret is establishedThe long-lived peer key mixes in random salts contributed by both machines, so the lasting trust isn't just a function of the guessable short code.
- Auto-discovery after thatA UDP discovery beacon lets paired devices find each other on the LAN and reconnect on their own. No IP addresses, no re-pairing each session.
Every envelope is authenticated.
Once paired, devices exchange compact envelopes over the LAN. Authenticity is checked on every message, not just at connection time.
Per-peer HMAC-SHA256
Each envelope carries an HMAC over its kind, nonce, sender, and body, keyed by the per-peer secret. A device that isn't paired, or a tampered packet, simply doesn't validate.
Nonce per message
The nonce is part of what's signed, which guards against trivial replay of a captured envelope.
History is local
Clipboard history lives in a local SQLite store on each device and survives reboots, even with nothing currently paired.
Streamed, verified, resumable.
File transfer is a separate subsystem from the clipboard, designed so multi-GB files move safely without buying their size in RAM.
Chunked to disk
Chunks stream to a .pbpart file at their byte offset and then atomically rename into place. Memory stays flat regardless of file size.
Integrity-checked
Chunks are verified in transit and the assembled file is SHA-256-checked, so you know it arrived intact, and an interrupted transfer resumes from the bytes already on disk.
Scoped to shared folders
Files inside a device's shared folders auto-serve to paired peers; anything else raises a prompt. Requested paths are canonicalized so traversal can't escape the shared folder.
Loopback-only, opt-in, and still receiver-bounded.
The most novel piece: an optional MCP bridge so an agent like Claude Code or Codex on one machine can move artifacts and assign structured work to the agent on the other, without weakening any of the above.
127.0.0.1 + bearer token
The control server listens only on loopback behind a bearer token stored in your local app data. It can't be reached from another machine.
No shell, no injection
When an inbound message summons a local agent, the message text is passed as a discrete argv argument, never interpolated into a shell string.
Can't bypass trust
The serving device still enforces its shared-folder scope, per-peer trust, and approval prompts. The MCP is a convenience layer over the same boundaries, not a way around them.
The bridge is off until you enable it under Settings → File sharing & MCP, then point your agent's MCP config at the installed SwarmSpan.Mcp binary.