I tried to get Claude to upload an invoice PDF to Xero. It converted it to base64 and then tried to replay the entire base64 string (84 KB) by outputting it, as output tokens, into an MCP tool call.
I let it run to see if it would work... after 10 minutes, I stopped it, and honestly felt a bit dumb for having let it run that long.
There had to be a better way, and there is.
Codemode MCP Scaffold now provides a way for Claude (and other LLM agents that have their own execution sandbox with access to files — including local files) to manage attachments in both directions without dragging them through their context or writing them as output tokens.
The LLM makes a tool call to get a file upload slot, gets a handle ID and token, then uses that token to upload the file with curl or whatever. Then in its codemode execute call, it can get that file using the handle and token and programmatically manipulate it in that sandbox to upload it to the provider's API surface.
Similarly in reverse: if the API returns a file (either in raw bytes or base64), the scaffold will automatically stage it and give the LLM the reference and a token to download it with curl or its tool of choice.
Everything is encrypted on the backend storage (Cloudflare R2), and the token is not stored, so if the client can't provide a token then the MCP can't (not "won't") decrypt any files. Also, the tokens have a configurable short TTL, and are single-use for uploads (if you register a slot, once you claim it by uploading a file, uploading a second file with that token won't work). A cron worker cleans up expired tokens and files.
This enables some useful patterns like "get all my invoices from the last week from Gmail and upload them to Xero" — Claude is much better at filling in the structured fields than Xero or HubDoc.
New release available at https://github.com/victor-bajanov/codemode-mcp-public