cloudup

Cloudup Plugin for Claude Code

Upload images to Cloudup directly from Claude Code, paying per upload with x402 micropayments. Agents can capture screenshots (e.g. via Playwright) and embed shareable URLs in PR comments, issues, and chat replies.

What's in the plugin

• MCP server (cloudup) — wraps tellyworth/mpp-remote pointed at Cloudup staging
• Hook (hooks/cloudup.mjs) — adds a single-call upload(path) tool via mpp-remote's hook API. Wraps the three-step begin_upload → S3 PUT → complete_upload ceremony, picks the SKU automatically (prefers the embed SKU's 2-year retention for images, falls through to quick or large by size or when stream_id is set), and enforces MIME magic-byte sniffing plus $HOME / $TMPDIR / /tmp path confinement before any byte transfer
• Skill (uploading-to-cloudup) — teaches the agent when to reach for the upload tool
• Slash commands — /cloudup <path> for uploads, /cloudup-setup for one-time key provisioning

Setup

Requires Node.js ≥ 18 (the upload hook uses global fetch and streaming PUT, both Node 18+). On Node 16 the hook crashes with ReferenceError: fetch is not defined mid-upload.

1. Install the plugin

In a Claude Code session:

/plugin marketplace add Automattic/cloudup-claude-code
/plugin install cloudup@cloudup-claude-code

2. Provision a wallet

Four paths; /cloudup-setup walks you through A, B, or D interactively. C is the build-agent escape hatch.

Path A — Privy agent wallet (recommended)

The plugin asks Privy's agent-wallet service to sign each x402 payment. The signing key lives in Privy; your machine only holds a per-user authorization keypair in the OS keychain (managed by the Privy CLI itself).

Install the CLI once:

npm i -g @privy-io/agent-wallet-cli

Then run /cloudup-setup in Claude Code, pick Privy agent wallet, and it walks you through paw login (browser-based) and prints the Ethereum address of your new wallet.

Path B — Locally generated key (macOS, laptop)

A fresh secp256k1 key generated on your machine and stored in the macOS Keychain. You hold the key — no third-party custody, but also no recovery if the laptop is lost. macOS only today.

Run /cloudup-setup in Claude Code and pick Locally generated key. It runs scripts/cloudup-key.sh generate, which generates the key, stores it under Keychain service cloudup / account wallet, and prints the derived address to fund. Manage the stored key with the same script:

scripts/cloudup-key.sh status     # is a key stored?
scripts/cloudup-key.sh address    # print the wallet address
scripts/cloudup-key.sh remove     # delete the key from Keychain
scripts/cloudup-key.sh set        # import an existing key (interactive paste, see Path D)

The script has no show subcommand by design — printing a raw private key from a CLI is a great way to leak it into shell history, scrollback, or (worst case) a Claude Code transcript that gets sent off-box. If you really need the raw key (e.g. to copy to another laptop), call the Keychain directly: security find-generic-password -s cloudup -a wallet -w.

Path D — Bring your own key (macOS, laptop, shared/exported key)

Use this when you already have a private key you want to use — typically a team-shared test wallet that someone has funded centrally, or a key you exported from another laptop. The key lives in the macOS Keychain alongside the Path B key (same slot), so the wrapper and management subcommands treat both identically.

Run /cloudup-setup in Claude Code and pick Bring your own key. It tells you to open a separate terminal and run:

scripts/cloudup-key.sh set

With no argument, set delegates to the macOS Keychain helper (security add-generic-password ... -U -w), which prompts silently for the key on the TTY. You paste your 0x-prefixed private key, hit Enter, and it's stored under service cloudup / account wallet. The key never enters argv (so it won't show in ps), shell history, the Claude transcript, or any log file.

cloudup-key.sh set refuses to run without a TTY — so attempting to invoke it from Claude's bash tool (! …) errors out by design. Always run it in a regular terminal window.

Programmatic callers that already have the key in memory (CI scripts, tests) can still pass it as an argument: cloudup-key.sh set 0xabc…. That accepts brief argv exposure as the caller's trade-off and is not appropriate for interactive paste.

Path C — CLOUDUP_WALLET_KEY env var (CI, headless, TeamCity)

Paths A and B both require interactive setup that doesn't work on a build agent: paw login is browser-based, and macOS Keychain doesn't exist. For headless contexts, set:

export CLOUDUP_WALLET_KEY=0x...   # a fresh secp256k1 key you generated