NERVOSYS — AI & Robotics

Every agentic workflow eventually has to move a file — pull a dataset, push a report, sync a directory to a remote host. The tools available for that job were all built for humans typing commands one at a time: FTP, rsync, curl. None of them were designed to be driven by another program, and it shows — free-text output, inconsistent exit codes, no standard way to ask "what can you actually do."

Today we're announcing AFT (Agentic File Transfer), a command-line file transfer utility built for AI agents first and humans second — structured, machine-readable output and capability discovery as native features, not an afterthought bolted onto a human-facing CLI.

AFT is dual-licensed under AGPL-3.0-or-later, with a commercial option available from licensing@nervosys.ai.

The problem with FTP, rsync, and curl for agents

Traditional file transfer tools assume a human is reading the output and deciding what to do next. An agent calling one of these tools as a shell-out has to scrape stdout, guess at error conditions, and hard-code assumptions about what protocols and flags are supported. There is no way to ask the tool, at runtime, what it can do.

AFT solves this with a dedicated --agent mode: consistent JSON schemas on every operation, a capabilities command that enumerates supported protocols and flags, and a schema command that emits the full operation ontology for tool registration in an LLM's function-calling setup. An agent can introspect AFT before it ever calls it.

12+ protocols, one interface

All transfers — HTTP/HTTPS, FTP/FTPS, SFTP/SCP, S3, WebDAV, Azure Blob, Google Cloud Storage, SMB, and a proprietary AFTP binary protocol — implement a single ProtocolHandler trait with consistent semantics for download, upload, list, delete, rename, mkdir, and metadata. Write the agent logic once; it works identically whether the destination is an S3 bucket or an SMB share.

AFTP, AFT's own wire protocol, is a lightweight 10-byte framed transport with zstd compression, streaming SHA-256 verification, TLS/mTLS, and HMAC-SHA256 challenge-response auth — a purpose-built option when both ends run AFT.

Networking built for hostile links

BBR congestion control by default, requested via setsockopt, for better throughput on lossy or high-latency paths than CUBIC's loss-based backoff.
Fountain-coded UDP data plane (--fec) for extreme packet loss scenarios where TCP-based transfers stall or time out entirely.
Parallel chunked downloads via byte-range requests, with exponential backoff retry and resume detection.
Intermittent connection resilience — MOSH-inspired session persistence: the server tracks upload progress per session, so a client can drop off Wi-Fi mid-transfer, reconnect, and resume from where it left off instead of restarting from scratch.
Self-correction — every operation reports structured, deterministic JSON in --agent mode, so an agent can tell success from failure without scraping free text and can retry, resume, or fall back to another protocol on its own. It's the same feedback loop AFT uses internally: negotiate --fec down to plain TCP when a server doesn't support it, or BBR down to the kernel's default congestion control when it isn't available — adapting automatically instead of failing outright.

On shaped netem test links with 50 MB files: on a clean 200 Mbit/25 ms/0.1% loss link AFT completed in 2.8 seconds, fastest among the tools tested. On a lossier 50 Mbit/80 ms/2% loss link, AFT's BBR path finished in about 15 seconds while CUBIC-based tools timed out; --fec brought that down to about 13 seconds. On a severe 10 Mbit/200 ms/10% loss-plus-reordering link, only --fec fountain coding completed at all — around 103 seconds median, with bounded 150 MB peak memory. These are the regimes where rsync and curl simply stall.

Cryptography and security hardening

AFT supports post-quantum encryption using NIST FIPS 203 ML-KEM (Kyber1024) paired with AES-256-GCM, plus a trainable neural network cipher in OFB mode and hybrid encryption modes. FIPS 140-3 validated builds are available via --features fips, which swaps in the aws-lc-rs crypto backend.

Security hardening extends past the wire protocol: TLS 1.2+ enforcement with FIPS-compatible cipher suites, per-IP authentication rate limiting (a 60-second lockout after 5 failed attempts), structured JSON audit logging, credential scrubbing, SMB path sanitization, and DoD classification level enforcement via a dedicated dod:// protocol scheme. A DoD compliance audit (SECURITY.md) covers CVE patterns, MITRE ATT&CK mitigations, NIST FIPS 140-3, and a CMMC 2.0 Level 2 self-assessment.

Sync, and everything else a transfer tool needs

Beyond single-file get/put, AFT ships an rsync/rclone-class directory synchronization engine: concurrent transfers, multiple comparison modes (size, modtime, checksum), dry-run preview, selective deletion, and glob-based filtering. Move, rename, delete, mkdir, and existence checks are implemented consistently across every protocol handler, backed by SHA-256/SHA-512/MD5 verification and token-bucket rate limiting.

It's a single statically-compiled Rust binary, about 9 MB, with zero runtime dependencies — built with Tokio for non-blocking I/O, link-time optimization, and panic=abort. That means it runs the same way in an air-gapped network, off a USB drive, in a sandboxed container, or on the open internet.

Try it

# Clone and build
git clone https://github.com/nervosys/AgenticFileTransfer
cargo build --release

# Download / upload / copy
aft get https://example.com/file.tar.gz
aft put ./report.pdf https://upload.example.com/files/
aft copy ./src/ ./backup/src/

# Directory sync and integrity checks
aft sync ./project/ sftp://server/backup/project/
aft checksum ./file.tar.gz --algorithm sha256
aft get <url> --resume

# Agent mode
aft --agent get https://example.com/data.json -o /tmp/data.json
aft --agent capabilities  # discover features programmatically
aft --agent schema        # full ontology for tool registration

AFT: github.com/nervosys/AgenticFileTransfer — AGPL-3.0-or-later + commercial

For commercial licensing (closed-source SaaS, on-prem, embedded), contact licensing@nervosys.ai.

What's next

File transfer looks like a solved problem until an agent has to drive it — then every convenience built for a human at a terminal turns into ambiguity a program has to work around. AFT's bet is that a transfer tool with structured output and capability discovery as first-class features, not scraped stdout, is worth the dozen protocol handlers it takes to get there.

Per aspera ad astra.