Transfer selected engineering files

Available in hosted CLI 0.6.14 / MCP 0.2.14. Install from the connect guide; older npm registry versions do not include these commands. The engineering API is deployed, with explicit owner grants and separate selected-file authorization.

Your agent can move selected technical files from an existing local project into Maglev’s engineering review. Preparation stays local. Proposing sends metadata. Uploading sends only the exact files approved by the project owner. Supplier disclosure and production approval are separate permissions.

Prepare a selection

Use an existing API project UUID and a canonical project directory. Directory aliases, symlinks, your home directory and the filesystem root are rejected. Inspect each selected file’s content and permission to upload it; filenames cannot identify every secret.

Create selected.json with relative paths and explicit kinds:

{
  "files": [
    { "path": "enclosure-rev-b.step", "kind": "cad" },
    { "path": "inspection-rev-b.txt", "kind": "spec" }
  ]
}

Supported kinds are cad, drawing, gerber, prd, spec and product_description. Kind labels are supplied by you; they do not prove geometry or document interpretation.

After installing the hosted CLI:

maglev engineering transfer prepare PROJECT_ID \
  --directory /absolute/project/path --input selected.json --json

For an installed candidate, use maglev instead of node packages/cli/bin/maglev.mjs. The output includes transferId, paths, hashes and status: prepared_local. This command sends nothing and needs no API key. It saves private local metadata before returning the ID. It does not create an API project.

Only selected files are read. This adapter accepts STEP/STP, IGES/IGS, STL, OBJ, DXF, DWG, SolidWorks part/assembly, Gerber, PDF, text/Markdown and PNG/JPEG files as opaque bytes. It excludes hidden or sensitive paths, NDA/legal/correspondence, generated directories, archives and BOM imports. BOM review stays in the existing project workflow. It does not recursively upload a directory or parse CAD.

Choose 1-10 nonempty files, at most 2 MiB each and 10 MiB total. The server also counts existing retained files, so it may reject a selection that would exceed the project’s package limit.

Propose and authorize

Set MAGLEV_API_URL to the service running the preview, then use its existing live login or environment key. Keep the same API and proposing key throughout the transfer.

maglev engineering transfer propose TRANSFER_ID --confirm --json

--confirm explicitly sends the saved file manifest, including relative paths and hashes. It does not upload file bytes. The response normally says pending_owner.

An organization owner opens the intended founder project’s Engineering review page and finds Files from your agent. They verify the agent project/key IDs, file list and destination, choose the upload window and select Allow selected uploads. Matching project names do not establish a connection. The API key cannot grant itself permission.

maglev engineering transfer status TRANSFER_ID --json
maglev engineering transfer upload TRANSFER_ID --confirm --json

Uploading first reads server authorization and the committed receipts, verifies all selected local files again, then sends unreceived entries sequentially. Each entry is re-read and hash checked immediately before sending. If a later file changes or a request fails, earlier uploads may already be retained; the command fails with the transfer ID so you can inspect the partial result.

Resume after interruption

Use the saved ID instead of preparing another transfer:

maglev engineering transfer status TRANSFER_ID --json
maglev engineering transfer upload TRANSFER_ID --confirm --json

The server receipt identifies files already received. The client skips those entries and continues the same manifest. It does not retry network writes automatically. Changed bytes require a new proposal and owner review. Expired/revoked permission, another key, another API origin or an incompatible response stops the operation.

Local records live under the private MAGLEV_CONFIG_DIR or ~/.maglev, named engineering-transfer-UUID.json. They contain paths, hashes, API/project IDs and receipts, not source bytes or API keys. Keep them private and retain the original directory while resuming. If preparation’s output was lost, its filename contains the saved UUID. Moving or deleting records can remove the client’s recovery context; it does not remove retained server files.

received is a historical server receipt, not proof of current remote-byte integrity, current engineering review or a supplier offer. New files invalidate earlier engineering review. Review the complete retained package, BOM and intent, then renew the agent access grant. Old pricing rules may no longer apply.

Use the same flow through MCP

This candidate’s project setup configures MAGLEV_TRANSFER_ROOT as the canonical selected directory. For an existing/manual MCP configuration, set that environment variable on the Maglev server and restart it. Without it, transfer tools refuse local and remote transfer operations. Other tools keep their existing behavior. A different configuration is preserved rather than overwritten by setup.

The tools are:

Tool	Input and effect
prepare_engineering_transfer	projectId and selected files; reads only those files inside the configured root and saves metadata locally, without HTTP
propose_engineering_transfer	transferId, confirm: true; sends the manifest, never file bytes
get_engineering_transfer	transferId; refreshes the historical receipt for this local project
upload_engineering_transfer	transferId, confirm: true; sends remaining authorized bytes and saves receipts

The MCP caller cannot choose an arbitrary filesystem root or provide file bytes through the tool arguments. Preserve the user’s existing consent and host permissions when choosing files. Use explicit confirmation only when the user authorized that transfer. Owner approval in Maglev still applies.

What this does not complete

No native CAD interpretation, BOM upload, multi-part quoting, NDA signing, supplier disclosure, purchase, capacity reservation or complete firm quote is implied. Production schema and private-storage primitives have been verified, and the API and hosted clients are released. Real supplier rule calibration, a complete customer-file production journey and the sub-minute complete-offer target remain separate validation work.