Let AI clear your full Mac into a vault it cannot read.

Ask Claude or Cursor to move your photos and documents off the machine, find duplicates and tidy what is left. Files are encrypted on your computer before they go — ShieldFive only ever holds ciphertext.

Create a free vaultHow to connect it

Open source · npm @shieldfive/mcp · in the MCP registry

Claude · shieldfive

You

My Mac is full. Move my 2019 photos to ShieldFive.

Assistant

Opening ShieldFive so you can choose what I may reach…

Connected: Photos, read and add, 25 GB allowance, 7 days.

Plan: 48 files, 3.2 GB → Photos/2019. Each is uploaded and read back before its original leaves your Mac. Go ahead?

You

Yes.

Assistant

Moved 48 files. Every copy read back and matched.

The originals are in the local trash folder: empty it to free 3.2 GB. Nothing was deleted.

→ every change undoable · nothing deleted

What it actually does.

Every tool works on names and bytes the server on your computer encrypted or decrypted itself. Nothing is searched or compared on ShieldFive.

Clear your Mac, iPhone backup or a drive

Approve one plan and it moves up to 50 files at a time. Each is encrypted here, uploaded, then read back out of the vault and compared byte for byte. Only a file that matches has its original moved to a trash folder on your disk — never deleted. Empty that folder when you are happy, and the space is yours.

→ move to vault · verified

Find what is duplicated

Same-size files are decrypted in memory and compared by hash, so a duplicate is a duplicate by content — never by name — and the saving it reports is real.

→ duplicates

Say where the space went

Totals, the biggest folders and files, and a breakdown by type, across the folders the connection covers.

→ space

Tidy folders

Rename, move, create folders and move things to the Bin. Each change is previewed before it happens and undoable afterwards.

→ organize

Read a file when you ask

Text comes back fenced and marked as your data, not as instructions. That does not make a model immune to text inside a file, so a connection is limited to the folders and actions you chose, and nothing it can do is permanent.

→ read

Four steps, and nothing to copy.

No key to paste, no token to keep somewhere safe. The connection is handed to the server on your machine and stored in your keychain.

01
Add the server to your assistant
One config block, or one command for Claude Code. It runs on your computer, from npm.
02
Ask it to tidy your vault
The server opens ShieldFive in your browser. There is nothing to copy and no key to paste.
03
Choose what it may reach
The folders; read only, read and organize, or also add files up to an allowance you set; and an expiry of up to 90 days.
04
Authorize
The connection goes straight back to your own machine and into your system keychain. Revoke it whenever you like.

Claude Desktop

claude_desktop_config.json

{
  "mcpServers": {
    "shieldfive": {
      "command": "npx",
      "args": ["-y", "@shieldfive/mcp"]
    }
  }
}

Claude Code

claude mcp add shieldfive \
  -- npx -y @shieldfive/mcp

Connect without a conversation

npx -y @shieldfive/mcp login

Cursor and other MCP clients take the same block as Claude Desktop.

What a connection can, and cannot, do.

The limits are enforced by ShieldFive on every request, not by the assistant’s good behaviour.

It can

  • Add new files, up to the upload allowance you set, if you grant that
  • Reach the folders you ticked — the Bin is always excluded, Media only if you say so
  • Work for as long as you chose, then stop on its own
  • Move things to a folder inside your Bin that belongs to that connection alone
  • Be revoked mid-sentence: the next request it makes fails

It cannot

  • Delete anything permanently — the server has no such tool at all
  • Change or replace a file you already have: it can only add new ones
  • Remove a file from your computer before its copy in the vault has been read back and matched — and even then it moves it to a trash folder, never deletes it
  • Touch a folder outside its scope, however it is asked

Worth saying plainly: whatever the assistant reads goes to whoever runs that assistant, exactly like anything else in the conversation. Revoking stops the next request; it cannot take back what has already been read. For how this compares with the assistants built into Google Drive, OneDrive and Dropbox, see can AI assistants read your cloud files?

Everyone ships an MCP server now. Not everyone can keep the files private.

The large providers published official servers within weeks of each other in 2026. What differs is where your files get decrypted, and how much of your account the assistant is handed.

Dropbox, Box, Google Drive, OneDrive

Official servers, shipped 2026

The provider holds the keys, so its servers read the files to answer the assistant. Nothing is lost by that — they could already read them.

→ decrypted on their servers

Proton Drive, MEGA

No official server

Neither vendor publishes an MCP server, so there is no vendor-scoped way to give an assistant part of the account.

→ no vendor server

ShieldFive

First-party server, open source

Decryption happens in the server on your own computer. Ours only ever holds ciphertext, and the connection reaches the folders you chose and nothing else.

→ scoped · expiring · revocable · logged

Checked September 2026 against each vendor’s own documentation and the public MCP registries. If one of them ships something that changes this, the page changes with it.

Questions people ask first.

Does ShieldFive see my files when an AI assistant reads them?
No. The MCP server runs on your computer and decrypts there. ShieldFive stores and serves ciphertext and holds no key that opens it. That is the same zero-knowledge model the apps use; connecting an assistant does not change it.
Does the AI company see my files?
Whatever the assistant reads goes to whoever runs the assistant, exactly like anything else you put in that conversation. That is why a connection is limited to the folders you pick and expires. A local model keeps everything on your machine.
Can it delete the files off my computer?
No. When you approve a move it shows you the files first, then takes them one at a time: upload, read the copy back out of the vault, compare it byte for byte to the file on disk. Only a file that matches has its original moved — into a .shieldfive-mcp-trash folder beside it, with a record of which vault file holds its copy. Nothing on your disk is deleted; you free the space by emptying that folder. If any file fails, it stops and leaves that file and the rest where they were.
How much can it move at once?
Up to 50 files per approval, each up to 512 MB, within the upload allowance you set when you authorize the connection. The allowance is checked before anything moves; a bigger clear-out is several approvals.
Can the assistant delete my files?
No. Permanent deletion is not available to the server. Trashing moves items into a folder inside your own Bin that belongs to that connection, and changes can be undone from Settings → AI assistants.
What happens when I revoke a connection?
The next request it makes fails. The server re-checks the connection against ShieldFive on every call, so revocation is not a cache waiting to expire. It cannot take back anything the assistant has already read.
Which assistants work?
MCP clients that run a local server: Claude Desktop, Claude Code, Cursor, and local models through an MCP-compatible client. The server is published on npm as @shieldfive/mcp and listed in the MCP registry.
Do Proton Drive or MEGA have this?
Not from the vendor, as of September 2026. ShieldFive publishes its own, and the access it hands out is limited to the folders you choose.

Put your files somewhere an assistant can help
without reading everything.

Free to start, 10 GB, no card. The MCP server is open source and works on every plan.

Create a free vault

Encrypted in your browser before upload · EU hosting