# Download a native file

DevSpace can save a file attached or generated by an MCP host, such as ChatGPT,
directly into an open workspace. Enable the tool with `DEVSPACE_ARTIFACTS=1`.

## Workflow

```text
open_workspace
  -> download_artifact({ file, workspaceId, path })
  -> { path }
```

1. Open the project with `open_workspace`.
2. Pass the host-provided native `file`, the returned `workspaceId`, and an
   unused workspace-relative `path` to `download_artifact`.
3. Use the returned path with the ordinary DevSpace filesystem tools.

```text
download_artifact({
  file: <native file value supplied by the MCP host>,
  workspaceId: "ws_123",
  path: "public/images/generated-image.png"
})
```

DevSpace creates missing parent directories and refuses to overwrite an existing
file. After the download, normal tools can inspect, move, rename, replace, or
delete it.

## Safety and limits

The `file` input must be the native value supplied by the MCP host. DevSpace does
not accept pasted download URLs or local source paths. It validates the complete
file-object shape, trusted OpenAI download hosts, and redirects before streaming.
Malformed references, unknown fields, absolute paths, traversal, and symlinked
parents are rejected.

Downloads are streamed under `DEVSPACE_ARTIFACT_MAX_FILE_BYTES` and published as
owner-only files without overwriting an existing destination. The tool is
currently available on Linux. It is not registered on macOS, Windows, or BSD
because Node.js does not expose the required descriptor-relative filesystem
operations there.