@aidalinfo/s3-mcp

MCP server for S3-compatible object storage (rustfs, Garage, MinIO, AWS S3) — built for agents that must share files through presigned URLs instead of public buckets.

Tools

| Tool | Mode | Purpose | |---|---|---| | s3_buckets | read | List buckets visible to the credentials | | s3_objects | read | List objects (prefix filter, pagination) | | s3_object_info | read | HEAD one object (size, type, mtime, etag) | | s3_get_text | read | Inline a text object (capped 100k chars, refuses binaries) | | s3_presign_get | read | Presigned GET URL — the canonical way to hand a file to a human | | s3_put_text | readwrite | Upload a text object | | s3_presign_put | readwrite | Presigned PUT URL for direct uploads | | s3_delete_object | readwrite | Delete one object (irreversible) |

S3_MODE=readonly hides the three write tools entirely.

Usage

claude mcp add s3 --scope user \
  -e S3_ENDPOINT=http://192.168.3.166:9290 \
  -e S3_ACCESS_KEY_ID=... -e S3_SECRET_ACCESS_KEY=... \
  -e S3_REGION=garage -e S3_DEFAULT_BUCKET=mon-bucket-private \
  -- npx -y @aidalinfo/s3-mcp

Configuration: see .env.example. Presigned TTLs are clamped by S3_PRESIGN_MAX_TTL (default 24 h), default 15 min — short TTLs by design.

Design notes

• Credentials should be scoped per consumer (dedicated user + policy limited to its buckets), never the shared admin key.
• Private buckets + presigned URLs are the intended pattern: nothing this server does requires a public-read bucket policy.