# Replilo

> Replilo puts any document behind a verified-email wall. You upload a file and
> get a short link; anyone who opens that link gives an email address and
> confirms it with a six-digit code before the download starts. Sharing a file
> is therefore also how you build a list of readers who are real and reachable.

Replilo is built to be driven by people through a web dashboard and by AI agents
through an MCP server, using the same accounts, the same documents and the same
links. Anything a person can do in the dashboard, an agent can do over MCP.

## How the wall works

- A short link looks like `https://replilo.com/s/<slug>`.
- The visitor submits an email address. Disposable domains are rejected against
  a mirrored public blocklist, and the domain's DNS is checked for MX and SPF
  records, so addresses that can't receive mail don't get through.
- A six-digit code is emailed. Entering it grants access, stores the visitor as
  a verified subscriber and starts the download.
- Access is remembered per link, so a returning reader downloads immediately.
- Links can carry an expiry date, a download cap, a custom slug, or be paused.

## For AI agents (MCP)

- Endpoint: `https://replilo.com/mcp` — Streamable HTTP, stateless, JSON replies.
- Auth, two ways:
  - `Authorization: Bearer rpl_…` with an API key created on the "AI agents"
    page of the dashboard. Use this from anything that can set a header.
  - OAuth 2.1 for clients that can't, such as claude.ai custom connectors. The
    server is its own authorization server: discovery at
    `https://replilo.com/.well-known/oauth-protected-resource/mcp`, dynamic
    client registration (RFC 7591), authorization code with PKCE (S256).
    In claude.ai, add `https://replilo.com/mcp` as a custom connector and
    approve the prompt — no key needed.
- Tools: `list_documents`, `create_upload_url`, `upload_document`,
  `delete_document`, `list_links`, `get_link`, `update_link`,
  `regenerate_link_slug`, `list_subscribers`, `list_downloads`,
  `get_storage_usage`.
- Uploading: call `create_upload_url` and send the file with
  `curl -sS -X POST -F "file=@<path>" <uploadUrl>`. This is the right path for
  any real file — it keeps the bytes out of the model's context entirely.
  `upload_document` takes base64 inline and is only suitable for small content
  an agent generated itself.

## Integrations

- Webhooks fire `subscriber.verified` and `document.downloaded`, signed with
  HMAC-SHA256 as `X-Replilo-Signature: t=<unix>,v1=<hex>` over `<t>.<raw body>`,
  and retried with exponential backoff until they land.

## Pages

- [Home](https://replilo.com/): what Replilo does, how the wall works, and the
  agent integration.
- [Blog](https://replilo.com/blog/): writing about gated downloads, email
  verification and agent workflows.
- [Email-gated downloads](https://replilo.com/blog/email-gated-downloads/): why
  a confirmed email beats a typed one, and how to put a wall in front of a PDF.

## Notes

- Accounts are free and created with an email address alone — no password, no
  card. Storage is capped at 100 MB per account.
- Signed-in areas (`/app`) and the gated download pages (`/s/…`) are excluded
  from crawling in `/robots.txt`; the documents behind them belong to the people
  who uploaded them.