Skip to main content
Glama
backblaze-labs

Backblaze B2 MCP Server

Official

Backblaze B2 MCP Server

CI CodeQL npm License: MIT TypeScript Node.js MCP API docs Coverage floors Runtime dependencies

MCP Registry Smithery LobeHub Glama

A Model Context Protocol server for Backblaze B2 Cloud Storage. It lets any MCP-compatible AI client (Claude, and others) operate B2 through a focused, safe set of tools, currently incubating in Backblaze-Labs.

This is the official Backblaze B2 MCP serverbackblaze-labs/b2-mcp, published as @backblaze-labs/b2-mcp on npm and listed in the Official MCP Registry as io.github.backblaze-labs/b2-mcp. Community forks and third-party wrappers are not maintained by Backblaze.

40 tools, assigned by backing category:

  • Native B2 SDK (@backblaze-labs/b2-sdk) (17) — B2 control-plane operations the S3 API has no equivalent for: buckets, application keys, Object Lock, event notifications, and Partner/Groups operations.

  • AWS S3 SDK (@aws-sdk/client-s3) (19) — the S3-compatible data plane: object upload/download/copy/list/delete, multipart, bucket reachability, lifecycle, and presigned URL paths.

  • Neither SDK (custom MCP code) (4) — repository-owned analytics over B2 reports and bounded live listings: storage growth, egress leaders, largest files, and abandoned uploads.

Availability is a per-tool annotation, separate from those backing categories: durable-secret-producing tools are sink-backed for local stdio runs and remain non-secret unavailable stubs on HTTP/serverless unless an explicit sink is configured.

Destructive actions are gated, durable B2 secrets stay out of the model's context in the default/file/off modes, and the unsafe B2_SECRET_SINK=inline escape hatch is explicit. The tool surface is deliberately lean (registration is capability-aware, so a key only ever sees tools it can use).


Quick start

Prerequisites: A supported Node.js runtime (22.22.2+, or 24 / 26) and a Backblaze B2 application key. A non-master key is all you need. The package engine range is ^22.22.2 || ^24 || ^26; CI runs on Node.js 22.23.1, 24, and 26.

The canonical package name is @backblaze-labs/b2-mcp and the canonical binary is b2-mcp (b2-mcp-server is a transition alias). The fastest setup runs it with npx, no clone or build.

S3-compatible and report tools derive their endpoint region from the authorized B2 account response. B2_REGION is only a fallback/default for paths that need a region before authorization, or when authorization is temporarily unavailable.

Connect Claude Desktop by editing its config file — claude_desktop_config.json, located per OS:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

  • Windows: %APPDATA%\Claude\claude_desktop_config.json

  • Linux: ~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "backblaze-b2": {
      "command": "npx",
      "args": ["-y", "@backblaze-labs/b2-mcp"],
      "env": {
        "B2_APPLICATION_KEY_ID": "your-application-key-id",
        "B2_APPLICATION_KEY": "your-application-key-secret"
      }
    }
  }
}

If you need an explicit fallback region before authorization, include B2_REGION in the same env block before restarting Claude Desktop:

{
  "B2_APPLICATION_KEY_ID": "your-application-key-id",
  "B2_APPLICATION_KEY": "your-application-key-secret",
  "B2_REGION": "us-east-005"
}

Restart Claude Desktop and the B2 tools appear. To persist local stdio logs from clients that do not expose child-process stderr, add "B2_LOG_FILE" to the same env block, set to an OS-appropriate absolute path (for example /var/log/b2-mcp.log on macOS/Linux or C:\\logs\\b2-mcp.log on Windows).

One non-master application key covers normal storage work: B2 native, S3, and key management. SDK-backed Partner/Groups tools require B2_MASTER_KEY_ID / B2_MASTER_KEY on an account authorized for the Partner API. B2's S3 endpoint rejects master keys, which is why the application key remains the primary credential. See Configuration for the full list.

Why your client may show fewer than 40 tools: registration is capability-aware, so a client only sees the tools its key can actually use. With a non-master key and no master key configured, the three Partner/Groups tools that require a master key (b2_list_groups, b2_list_group_members, b2_eject_group_member) are not surfaced, so tools/list reports 37. Add B2_MASTER_KEY_ID / B2_MASTER_KEY on a Partner-entitled account to get the full 40. A read-only key trims the surface further, and durable-secret tools appear as non-secret "unavailable" stubs unless a secret sink is configured. This is expected, not a missing-install problem.

Other clients: docs/CLIENTS.md has copy-paste setup for Cursor, VS Code, Cline, Windsurf, Zed, Continue, Goose, Claude.ai, and hosted (Streamable HTTP), plus a compatibility matrix.

git clone https://github.com/backblaze-labs/b2-mcp.git b2-mcp
cd b2-mcp
corepack enable pnpm
corepack prepare 'pnpm@11.20.0+sha256.34e198cb1e43237517ecedfd31f9ae26a6c0a3e5366ce58a2d05f4b21fb5f19a' --activate
pnpm install --frozen-lockfile
pnpm run build          # produces dist/, required before first run

Then set "command": "node" and "args": ["/ABSOLUTE/PATH/TO/b2-mcp/dist/index.js"] (or use the installed b2-mcp binary) in the config above.

Then just ask:

"List the buckets this key can access." · "Upload ./data.csv to reports/may-2026.csv." · "Give me a 1-hour download link for backups/latest.tar.gz." · "List files under logs/2026/."

Local stdio runs can create application keys through the sink-backed tools; the new key secret is written to ~/.b2-mcp/secrets.jsonl by default and is not shown in the MCP response on POSIX platforms. Windows currently rejects file sink paths because this implementation does not enforce owner-only ACLs there, so use B2_SECRET_SINK=off or explicit local inline mode on Windows. For hosted HTTP deployments, create and rotate keys outside the MCP flow unless you have deliberately configured a reviewed secret sink.

Related MCP server: MinIO MCP Server

B2 Skills pack

This repo bundles a client-side Backblaze B2 skills pack under skills/ (manifest: skills/pack.json). The MCP server is the action layer; these Markdown playbooks are the expertise layer for common workflows: backup/restore, least-privilege keys, Object Lock, lifecycle and cost hygiene, migration, and incident response.

The pack is optional but recommended for clients that support Markdown skills. Each skill keeps bulk object bytes off the model and MCP server, uses presigned/direct transfer paths for data movement, and pauses before destructive or irreversible steps that are also gated by B2_DESTRUCTIVE_POLICY.

Validate the pack locally. The Node validator is a structural guard for the declared pack, tool references, byte-path rules, and per-tool destructive gates; it is not a content-safety proof, so skills/** changes require CODEOWNERS review before publish. Each skill repeats the byte-path guardrails intentionally so standalone client imports keep the no-model/no-server object-byte rule.

pnpm run validate:skills

Load the pack in supported clients:

  • Claude Code: put each skills/b2-*/ directory under ~/.claude/skills/ or the client-supported project skills directory, then restart the session.

  • Claude.ai / Claude Desktop with Skills: create ZIP archives for the desired skills/b2-*/ directories, with each SKILL.md at the ZIP root, then open Settings -> Capabilities -> Skills and upload those ZIP files.

  • Other MCP clients with Markdown skills: register each skills/b2-*/SKILL.md file or containing directory according to that client's skills documentation.

The skills do not add server endpoints or new permissions. They only sequence the existing B2 MCP tools and reinforce the same byte-path and destructive-action guardrails enforced by the server.

Docker quick start

The published image defaults to the HTTP transport, reads configuration only from environment variables, and does not publish a mutable latest tag. Choose the version tag that matches the package release. Cosign signatures are published to a sibling GHCR repository so the package page's default pull command stays on a runnable image tag:

B2_MCP_VERSION=VERSION # replace with the release version you want
B2_MCP_IMAGE="ghcr.io/backblaze-labs/b2-mcp:${B2_MCP_VERSION}"
docker run --rm --name b2-mcp \
  --stop-timeout 20 \
  -p 127.0.0.1:3000:3000 \
  -e B2_HTTP_CREDENTIAL_MODE=server \
  -e B2_APPLICATION_KEY_ID=your-application-key-id \
  -e B2_APPLICATION_KEY=your-application-key-secret \
  -e B2_ALLOWED_HOSTS=localhost,127.0.0.1 \
  -e B2_DESTRUCTIVE_POLICY=block \
  -e B2_REGISTER_ALL_TOOLS=false \
  -e B2_SECRET_SINK=off \
  -e B2_ALLOW_INLINE_SECRETS=false \
  -e B2_ALLOW_LOCAL_FILES=false \
  "$B2_MCP_IMAGE"

For stdio clients inside a container, pass the transport explicitly and keep stdin open:

B2_MCP_VERSION=VERSION # replace with the release version you want
B2_MCP_IMAGE="ghcr.io/backblaze-labs/b2-mcp:${B2_MCP_VERSION}"
docker run --rm -i \
  --no-healthcheck \
  -e B2_APPLICATION_KEY_ID=your-application-key-id \
  -e B2_APPLICATION_KEY=your-application-key-secret \
  "$B2_MCP_IMAGE" stdio

See deploy/customer-hosted/README.md for hardened HTTP examples with signature verification, B2_ALLOWED_ORIGINS, rate limits, and in-flight request caps. The deployment index is docs/DEPLOY.md, and the OAuth-secured Vercel adapter runbook is deploy/vercel. Direct deployment guides are available for Vercel, Cloudflare Workers, Cloudflare Containers, Docker/OCI, Google Cloud Run, AWS ECS Fargate, Azure Container Apps, Render, Railway, and Fly.io. All hosted paths share the security and credential contract.

The image healthcheck applies to HTTP mode. For stdio containers, pass --no-healthcheck. For HTTP containers, set the listen port through PORT so the healthcheck probes the same port the server binds.


Configuration

Variable

Required

Default

Description

B2_APPLICATION_KEY_ID

stdio / HTTP server

Application key ID (non-master) — the workhorse for native B2 and S3-compatible tools

B2_APPLICATION_KEY

stdio / HTTP server

Application key secret

B2_MASTER_KEY_ID / B2_MASTER_KEY

falls back to app key

Master credential for SDK-backed Partner/Groups tools; required with Partner API entitlement for those operations

B2_REGION

us-west-004

Fallback/default S3-compatible endpoint region; authorized B2 responses override this for S3/report tools

B2_MCP_UA_SUFFIX

Optional operator token appended after the built-in b2-mcp/<version> product token on the outbound User-Agent (tag a deployment)

B2_MCP_OUTPUT_FORMAT

json

LLM-facing TextContent.text format for structured successes: compact json or opt-in toon

B2_MCP_TRANSPORT

stdio

CLI default transport when no stdio / http argument or --transport flag is passed; Docker images set this to http

B2_HTTP_HOST

HTTP only

Node listen default

Standalone Node HTTP listen host; set to 127.0.0.1 when binding behind a same-host reverse proxy

B2_LOG_FILE

stderr

Optional path for redacted structured JSON logs. When set, the file replaces stderr; stdout is never used for logs

B2_SECRET_SINK

stdio: file; HTTP: off

Durable-secret output mode: file, inline, or off. File mode supports b2_create_key and b2_create_group_member; b2_reserve_trial_create_account requires explicit inline mode because it has no file-mode recovery path

B2_SECRET_SINK_FILE

file override

~/.b2-mcp/secrets.jsonl on stdio

Append-only plaintext JSONL credential ledger for file sink mode. HTTP/serverless file mode requires this explicit absolute path and B2_ALLOW_LOCAL_FILES=true

B2_ALLOW_INLINE_SECRETS

HTTP inline only

false

Dedicated HTTP/serverless opt-in required before B2_SECRET_SINK=inline can return durable secrets in MCP responses

B2_APP_KEY_ID / B2_APP_KEY

deprecated

Legacy alias retained for compatibility; S3 tools use the authorized B2_APPLICATION_KEY_* credential scope

B2_HTTP_CREDENTIAL_MODE

HTTP only

headers

headers, server, or principal; unset preserves existing header-based clients. Set explicitly for hosted deployments

B2_PRINCIPAL_CREDENTIAL_MAP

HTTP principal

JSON map from verified MCP principal to a customer-managed credential reference

B2_CREDENTIAL_<REF>_APPLICATION_KEY_ID / _APPLICATION_KEY

HTTP principal

Env-backed secret-broker material for the mapped reference

Every outbound B2 API call (native B2 SDK and the S3-compatible data plane) carries a b2-mcp product token on its User-Agent so the traffic is attributable to this server. A published release emits b2-mcp/<version> (for example b2-mcp/0.1.2); a source checkout, CI, or a dev/prerelease build emits b2-mcp/dev. B2_MCP_UA_SUFFIX appends an optional operator token after that built-in product token and does not replace it.

S3-compatible and report tools use the s3ApiUrl returned by b2_authorize_account when a tool call authorizes; setting B2_REGION does not override that authorized region. On a cold authorization cache, the first S3/report call attempts B2 authorization to learn the authoritative region. That wait is bounded, and if authorization is temporarily unavailable, S3 tools fall back to the B2_REGION endpoint for that operation so the S3 data plane can still be attempted with the configured default. Once authorization succeeds, the derived S3 endpoint is cached for the server process lifetime; restart the process to pick up a later account-region migration. Authorized S3 endpoints remain restricted to HTTPS s3.<region>.backblazeb2.com hosts with no credentials, custom port, path, query, or fragment.

Security / policy (safe defaults; override as needed):

Variable

Default

Description

B2_DESTRUCTIVE_POLICY

stdio: confirm; HTTP: block

Gate on destructive tools: confirm requires MCP form elicitation approval on compatible 2026 clients, or confirm: true when elicitation is unavailable/disabled; elicit requires human elicitation approval and refuses when no human can be prompted (a model confirm: true does not satisfy it); block refuses before elicitation; allow skips both gates

B2_DESTRUCTIVE_ELICITATION

on

Set to off, false, or 0 to disable MCP form elicitation and rely only on B2_DESTRUCTIVE_POLICY

B2_MAX_KEY_DURATION_SECONDS

Optional maximum for b2_create_key; when set, non-expiring keys and longer durations are refused before any B2 create call

B2_ALLOW_KEY_MGMT_GRANTS

false

Explicitly allow b2_create_key to mint keys with listKeys, writeKeys, or deleteKeys

B2_ALLOW_UNSCOPED_KEYS

false

Explicitly allow b2_create_key to mint unscoped keys with write/delete capabilities

B2_ALLOWED_HOSTS / B2_ALLOWED_ORIGINS

none

HTTP transport: Host/Origin allowlists (DNS-rebinding protection) — set these for any internet-facing HTTP deployment

B2_HTTP_REQUEST_TIMEOUT_MS / B2_HTTP_HEADERS_TIMEOUT_MS

30000 / 10000

Standalone Node HTTP transport request timeout and headers timeout

B2_TRUST_PROXY_HEADERS

false

HTTP transport: trust X-Forwarded-For / X-Real-IP for unauthenticated admission keys only behind a trusted proxy

B2_MCP_RATE_LIMIT_RPS / B2_MCP_RATE_LIMIT_BURST

60 / 120

HTTP transport: per-credential request throttling

B2_MAX_SESSIONS / B2_MAX_SESSIONS_PER_KEY

1000 / 20

HTTP transport: global and per-credential concurrent in-flight request caps

B2_STDIO_CAPABILITY_TIMEOUT_MS

10000

Stdio bootstrap capability-discovery deadline; local expiry starts with a fail-closed tool surface

B2_CAPABILITY_CACHE_TTL_MS / B2_CAPABILITY_CACHE_MAX_ENTRIES

300000 / 10000

Bounded capability-discovery cache TTL and size. Cache identity is secret-bound; log labels are non-secret fingerprints

B2_S3_SAVE_TO_PATH_IDLE_TIMEOUT_MS

60000

Idle timeout while streaming s3_get_object results to saveToPath

A ready-to-copy .env.example lists the local environment variables, and deploy/customer-hosted/b2-mcp.env.example lists the hosted container baseline. HTTP-only file-access vars (B2_ALLOW_LOCAL_FILES, B2_FILE_ROOT) are covered in docs/DEPLOY.md.


Logging

b2-mcp emits one structured JSON log object per line. Logs default to stderr so the stdio transport's stdout channel stays reserved for MCP protocol frames.

Set B2_LOG_FILE=/absolute/path/to/b2-mcp.log to append those same redacted JSON lines to a file instead of stderr. The path must be absolute. The file is created with owner-only permissions when it does not exist; its parent directory must already exist and be writable. Existing log files must be regular files, must not be symlinks or hard links, and must be owned by the current user. Owned pre-existing files are tightened to owner-only permissions at startup. A bad path fails at startup with a clear B2_LOG_FILE error. Runtime write failures are reported to stderr, and subsequent structured log lines fall back to stderr. B2_LOG_FILE is currently supported only on POSIX platforms; Windows startup fails clearly because this implementation does not enforce owner-only ACLs.

File logging does not mirror to stderr by default. Because B2_LOG_FILE is an append-only file sink with no built-in rotation or retention, use operator-managed rotation before enabling it for a long-running process. Do not enable it on an internet-facing HTTP transport unless the host has a size and retention policy and a log shipper tails the file directly. For external logrotate, use rename/create rotation and send SIGHUP to the b2-mcp process after rotation so the file destination is reopened. Copytruncate is not recommended.


Package API Surface

The npm package intentionally supports only the root CommonJS entry (require("@backblaze-labs/b2-mcp")), which exposes startStdio(): Promise<void>, plus ./package.json for metadata. TypeScript consumers may compile against that same root CommonJS surface:

import b2Mcp = require("@backblaze-labs/b2-mcp");

const start: () => Promise<void> = b2Mcp.startStdio;

Programmatic TypeScript imports beyond that root entry are not a supported public API. The supported form is the CommonJS import = require interop shown above; ESM named imports such as import { startStdio } from "@backblaze-labs/b2-mcp" are not part of the contract. Deep imports such as @backblaze-labs/b2-mcp/dist/server.js are private implementation details and are closed by the package exports map. Use the CLI/bin entry or the root startStdio export instead.


CLI Reference

The source entry point and installed package binary share the same CLI:

Usage: b2-mcp [stdio|http] [options]

Options:
  --transport <stdio|http>  Transport to serve (default: B2_MCP_TRANSPORT or stdio)
  --port <port>             HTTP listen port (default: PORT or 3000)
  --host <host>             HTTP listen host (default: Node listen default)
  --version                 Print the package version
  --help                    Show this help

Examples:

b2-mcp --transport stdio             # or: npx -y @backblaze-labs/b2-mcp --transport stdio
b2-mcp http --host 127.0.0.1 --port 3000
node dist/index.js http --host 127.0.0.1 --port 3000  # equivalent from a source checkout

Tool result text format

MCP transport messages always remain JSON-RPC JSON. Structured successful tool results carry the lossless sanitized value in structuredContent, and the single LLM-facing text block in content[0].text is selected by B2_MCP_OUTPUT_FORMAT.

  • json (default): compact JSON text for clients that parse text content.

  • toon: opt-in TOON text using the repo-owned encoder for TOON spec 4.1.

Errors, validation failures, and concise one-line status messages stay plain text. TextContent has no media-type field, so the server advertises the selected text format in instructions instead of per-result prefixes or protocol extensions.

Example b2_list_buckets text in default compact JSON mode:

{"accountId":"account-123","buckets":[{"bucketId":"bucket-a","bucketName":"logs-2026","bucketType":"allPrivate"},{"bucketId":"bucket-b","bucketName":"public-assets","bucketType":"allPublic"}],"bucket_count":2,"total_bucket_count":2}

The same structured result with B2_MCP_OUTPUT_FORMAT=toon:

accountId: account-123
buckets[2]{bucketId,bucketName,bucketType}:
  bucket-a,logs-2026,allPrivate
  bucket-b,public-assets,allPublic
bucket_count: 2
total_bucket_count: 2

The canonical structuredContent value is identical in both modes.

Rollout note: TextContent has no media-type field. Keep the default json for rolling deployments and text-parsing clients. Opt into TOON only after clients prefer structuredContent or explicitly support TOON; otherwise a fleet with mixed B2_MCP_OUTPUT_FORMAT values can return either text shape.


Tools

The server exposes 40 tools (registration is capability-aware, so a given key sees only the subset it can use).

Native B2 SDK (17):

  • b2_authorize_account — Verify credentials and return account info

  • b2_list_buckets — List buckets (optional filters)

  • b2_create_bucket — Create a bucket

  • b2_delete_bucket — Delete an empty bucket

  • b2_update_bucket — Update type, CORS, lifecycle, encryption, replication, Object Lock

  • b2_get_bucket_notification_rules — Get webhook notification rules

  • b2_set_bucket_notification_rules — Set webhook notification rules

  • b2_list_keys — List application keys

  • b2_delete_key — Delete an application key

  • b2_create_key — Create an application key (one-time secret written to the configured sink)

  • b2_update_file_legal_hold — Set/clear legal hold on an object

  • b2_update_file_retention — Set/clear retention on an object

  • b2_list_groups — List partner groups (Partner API credential)

  • b2_eject_group_member — Remove a member from a partner group (Partner API credential)

  • b2_list_group_members — List group members (Partner API credential)

  • b2_create_group_member — Create a Partner group member (Partner API credential)

  • b2_reserve_trial_create_account — Reserve a trial account (Partner API credential)

AWS S3 SDK — data plane (19):

  • s3_put_object — Inline upload of a small (≤1 MiB) control-plane object

  • s3_get_object — Inline download of a small (≤1 MiB) control-plane object

  • s3_delete_object — Delete an object

  • s3_delete_objects — Bulk-delete objects

  • s3_head_object — Object metadata

  • s3_copy_object — Server-side copy

  • s3_list_objects_v2 — List objects

  • s3_list_object_versions — List object versions

  • s3_create_multipart_upload — Begin a multipart upload

  • s3_presign_upload_part — Mint a presigned PUT URL for a part

  • s3_complete_multipart_upload — Finish a multipart upload

  • s3_abort_multipart_upload — Abort a multipart upload

  • s3_list_parts — List uploaded parts

  • s3_list_multipart_uploads — List in-progress multipart uploads

  • s3_upload_part_copy — Server-side copy of a part

  • s3_get_presigned_url — Short-lived presigned PUT/GET bearer URL

  • s3_head_bucket — Check a bucket is reachable on the S3 endpoint

  • s3_get_bucket_location — Bucket region / location constraint

  • s3_put_bucket_lifecycle — Set S3 lifecycle rules

Custom MCP analytics (4):

  • b2_usage_growth — Rank accounts by stored-data growth between two dates

  • b2_egress_leaders — Top egress by account or bucket over a period

  • b2_largest_files — A bucket's largest objects via bounded live listing

  • b2_unfinished_uploads — Abandoned multipart uploads consuming storage

For availability nuances, the destructive-gate list, and durable-secret handling, see the detailed reference below.

Tool details and availability

40 total — 17 Native B2 SDK + 19 AWS S3 SDK + 4 Neither SDK/custom MCP tools. Prefix counts remain 21 native b2_* names + 19 data-plane s3_* names. Availability is orthogonal to backing: b2_create_key and b2_create_group_member are available when B2_SECRET_SINK=file or inline; b2_reserve_trial_create_account is available only with explicit inline mode because Reserve Trial has no provider-side recovery path after a file sink write failure. These names are non-secret compatibility stubs when unavailable. The inherited s3_* aliases use the AWS S3 SDK against B2's S3-compatible endpoint, with configuration derived from the official B2 SDK /s3 helper. Under stdio's default confirm policy, fifteen destructive, durable-secret-producing, or protection-weakening tool names require confirm: true or MCP form elicitation before execution: the explicit deletes (s3_delete_object, s3_delete_objects, s3_abort_multipart_upload, b2_delete_bucket, b2_delete_key), durable key creation (b2_create_key), PutObject presigning (s3_get_presigned_url with operation: "PutObject"), Partner group membership changes (b2_eject_group_member, b2_create_group_member), trial-account reservation (b2_reserve_trial_create_account), persistent outbound webhook replacement (b2_set_bucket_notification_rules), and the protection-removal or copy/delete policy paths (b2_update_file_retention when clearing/bypassing, b2_update_file_legal_hold when set off, b2_update_bucket when it makes a bucket public or weakens Object Lock/lifecycle/replication, and s3_put_bucket_lifecycle when a rule schedules deletion). HTTP defaults to block, so the same calls are refused unless the operator explicitly selects confirm or allow.

Tool

Availability

Description

b2_authorize_account

Available

Verify credentials and return account info

b2_list_buckets

Available

List buckets (optional filters)

b2_create_bucket

Available

Create a bucket

b2_delete_bucket

Available

Delete an empty bucket

b2_update_bucket

Available

Update type, CORS, lifecycle, encryption, replication, Object Lock

b2_get_bucket_notification_rules

Available

Get webhook notification rules

b2_set_bucket_notification_rules

Available

Set webhook notification rules

b2_list_keys

Available

List application keys

b2_delete_key

Available

Delete an application key

b2_create_key

Sink-backed; HTTP default stub

Create an application key; file mode writes the one-time secret out of band

b2_update_file_legal_hold

Available

Set/clear legal hold on an object

b2_update_file_retention

Available

Set/clear retention on an object

b2_list_groups

Available with Partner API credential

List partner groups through the official B2 SDK

b2_eject_group_member

Available with Partner API credential

Remove a member from a partner group through the official B2 SDK

b2_list_group_members

Available with Partner API credential

List group members through the official B2 SDK

b2_create_group_member

Sink-backed with Partner credential

Create a Partner group member; file mode writes the one-time secret out of band

b2_reserve_trial_create_account

Inline only with Partner credential

Reserve a trial account; file mode is unavailable because no provider-side recovery exists

Durable-secret-producing operations split their result: the one-time applicationKey is written to the configured sink, while MCP output returns redacted metadata plus a secretSink pointer. Each request must include an idempotencyKey; retrying the same key with identical input returns the original sink pointer without creating a second credential or account. On POSIX platforms, stdio defaults to file at ~/.b2-mcp/secrets.jsonl. Windows rejects file sink paths because owner-only ACLs are not enforced by this implementation; configure B2_SECRET_SINK=off or explicit local inline mode there. HTTP/serverless defaults to off; enabling file there requires both B2_ALLOW_LOCAL_FILES=true and an explicit B2_SECRET_SINK_FILE. B2_SECRET_SINK=inline is an unsafe explicit opt-in that returns the secret into MCP output with a warning; HTTP/serverless also requires B2_ALLOW_INLINE_SECRETS=true. File sink records use stable JSONL metadata fields (ts, tool, recordId) plus idempotency metadata and a result payload. File mode also writes non-secret sidecar idempotency markers, plus <B2_SECRET_SINK_FILE>.idempotency.jsonl as an audit trail, so retry history survives when the plaintext ledger is rotated or vaulted. The ledger has no built-in rotation or pruning, so operators must rotate, prune, vault, or delete it under the same credential-retention policy used for live B2 keys while retaining the sidecars for the deployment's retry window. The SDK-backed Partner/Groups tools remain available only when a distinct master key is configured and the account is authorized for the Partner API.

Tool

Availability

Description

s3_put_object / s3_get_object

Available

Inline upload / download of small (<=1 MiB) control-plane objects; bulk data uses a presigned URL

s3_delete_object / s3_delete_objects

Available

Delete one / bulk-delete objects

s3_head_object

Available

Object metadata

s3_copy_object

Available

Server-side copy; acl is a no-op compatibility hint because B2 access follows bucket policy

s3_list_objects_v2 / s3_list_object_versions

Available

List objects / versions

s3_create_multipart_upload / s3_presign_upload_part / s3_complete_multipart_upload

Available

Multipart upload flow (large files); parts use short-lived presigned bearer URLs

s3_abort_multipart_upload / s3_list_parts / s3_list_multipart_uploads

Available

Manage multipart uploads

s3_upload_part_copy

Available

Server-side copy of a part

s3_get_presigned_url

Available

Short-lived presigned PUT/GET bearer URL (browser/CORS handoff)

s3_head_bucket

Available

Check bucket exists/reachable on the S3 endpoint

s3_get_bucket_location

Available

Bucket region / location constraint

s3_put_bucket_lifecycle

Available

Lifecycle rules incl. AbortIncompleteMultipartUpload

Tool

Availability

Description

b2_usage_growth

Available

Rank accounts by stored-data growth between two dates (daily usage reports; requires Usage Reports)

b2_egress_leaders

Available

Top egress by account or bucket over a period (daily usage reports; requires Usage Reports)

b2_largest_files

Available

A bucket's largest objects via live listing (bounded scan)

b2_unfinished_uploads

Available

Abandoned multipart uploads silently consuming storage (bounded live listing)

Scope follows the caller's key — a partner key sees its sub-accounts; a customer key sees only itself. The usage-report tools feature-detect the b2-reports-<accountId> bucket and return a clear "not enabled" message when Usage Reports aren't enabled on the account.


Security & self-hosting

Built-in safeguards (on by default): destructive-action gating (B2_DESTRUCTIVE_POLICY), MCP form elicitation for destructive tools on clients that advertise it for the 2026 protocol, sink-backed durable-secret creation for local stdio with hosted HTTP fail-closed defaults, central recursive response sanitization, explicit credential-provider modes, capability-aware tool registration that fails closed, rate limiting, and a values-redacted audit log (non-secret credential fingerprints only — never secrets, values, or file contents). The server never phones home.

Destructive actions have two layers. B2_DESTRUCTIVE_POLICY=block is the hard refusal and remains the required wall for internet-facing or untrusted-client HTTP deployments. Under confirm, capable 2026 MCP clients are asked for form elicitation first; clients without compatible elicitation, or servers with B2_DESTRUCTIVE_ELICITATION=off, fall back to the existing confirm: true retry. elicit is the stricter middle ground between confirm and block: it requires an accepted MCP form-elicitation response from a form-capable client and refuses (rather than falling back to a model confirm: true) whenever no such response can be obtained, for deployments that want human-in-the-loop friction on every destructive action without giving up the operation entirely. Because the response is relayed by the client, this is friction, not an independent authorization boundary. Under allow, both the confirm gate and elicitation are skipped for trusted single-user sessions. Elicitation responses are relayed by the MCP client, so they are useful human-in-the-loop friction but not an independent security boundary against a malicious or compromised internet-facing client.

Rollout note: elicitation changes compatible 2026 confirm clients from a one-request confirm: true flow to a two-request flow carrying server-minted requestState. Deploy all HTTP replicas with the same credentials and config. During an expand/contract rollout, an elicitation follow-up routed to a pre-elicitation pod fails safe with the old confirmation refusal; it does not execute an unapproved destructive operation.

Running it safely:

  • Use a supported deployment for hosted HTTPdeploy/customer-hosted contains the portable container, compose, and nginx/OAuth edge example. deploy/vercel contains the OAuth-secured Vercel runtime adapter. The deployment index links the current provider guides: Vercel, Cloudflare Workers, Cloudflare Containers, Docker/OCI, Google Cloud Run, AWS ECS Fargate, Azure Container Apps, Render, Railway, Fly.io, and shared security.

  • Use a least-privilege key — a non-master key is correct for normal storage operations. Local stdio can create scoped keys through the file sink; hosted HTTP deployments should create and rotate keys outside the MCP tool flow unless the file sink has been explicitly configured and reviewed. b2_create_key refuses key-management grants, unscoped write/delete grants, and over-long or non-expiring keys unless the corresponding policy override is set.

  • Presigned URLs are different from durable secretss3_get_presigned_url and s3_presign_upload_part return short-lived bearer capabilities with expiresIn / expiresAt. Treat the URL as sensitive until expiry, but it is not a long-lived B2 application key.

  • Local use → stdio (the Quick Start above). Credentials stay in your client config / environment.

  • Exposing HTTP → choose a credential mode. Unset mode remains headers for one-release compatibility with existing header clients; B2 credential headers must be present on every MCP request. Set B2_HTTP_CREDENTIAL_MODE=server to keep one B2 credential in the server process/customer secret manager, or principal to map verified MCP authInfo to customer-held credentials.

  • Caller auth stays at your edge. For principal mode, terminate TLS and validate OAuth before the SDK handler receives authInfo; strip any trusted identity headers at the edge and only re-add them inside an allowlisted proxy boundary.

  • MCP SDK v2 packages are pinned. HTTP and stdio use the official @modelcontextprotocol/server v2 package from github.com/modelcontextprotocol/typescript-sdk; opt-in TOON output uses a reviewed repo-owned encoder for spec 4.1, with @toon-format/toon@4.1.1 retained only as a dev/test decoder oracle.

  • Never commit credentials — use env vars / a secrets manager. .env* is gitignored.

Full hosted runbook (nginx, Let's Encrypt, hardened systemd, fail2ban, monitoring, and a security baseline checklist): docs/DEPLOY.md.

Authentication, credential custody, OAuth metadata, and B2 credential-mode details are documented in docs/AUTHENTICATION.md.


Development

pnpm run build              # clean + compile to dist/
pnpm run typecheck          # type-check src + tests (no emit)
pnpm test                   # typecheck, then fast unit tests
pnpm run test:contract      # deterministic MCP/package/schema contracts
pnpm run test:protocol      # modern + legacy MCP protocol behavior
pnpm run test:coverage      # deterministic source-covering suites + coverage summary
pnpm run test:diagnostics   # MaxListeners/open-handle warning diagnostics
pnpm run test:slow          # deterministic high-cost tests, isolated from unit
pnpm run test:package       # packed-package installation test
pnpm run verify             # fast no-credential quality gate
pnpm run test:live:b2-integration # live B2 tests; requires B2_APPLICATION_KEY_ID / B2_APPLICATION_KEY
pnpm run test:live:b2-contract    # live B2 request-shape checks; requires B2 credentials
pnpm run test:live:b2             # both protected live B2 suites
pnpm run evals                    # deterministic LLM eval harness; live provider cases skip by default
pnpm run evals:provider-comparison # opt-in Claude vs OpenAI comparison; requires provider keys and current dist/
pnpm start                        # stdio transport
pnpm run start:http --port 3000   # MCP 2026-07-28 HTTP transport
b2-mcp --help                     # installed package CLI help after publish/install
b2-mcp --transport http --port 3000 # installed package HTTP command after publish/install
pnpm run smoke:local        # deterministic local MCP smoke; no endpoint or B2 credentials
pnpm run smoke:client       # advisory SDK client smoke; requires existing dist/, no B2 calls
pnpm run smoke:inspector    # advisory locked Inspector CLI smoke; requires existing dist/

Compatible MCP Inspector release for isolated manual inspection: @modelcontextprotocol/inspector@2.4.0, which requires Node.js 22.19.0 or newer. Run it through pnpm run smoke:inspector so the command uses the committed lockfile and a sanitized temporary environment.

Documentation

License

MIT — © 2026 Backblaze, Inc.

Available Tools

40 tools
b2_authorize_accountA
Read-onlyIdempotent

Authorize with B2 and return account info including accountId, apiUrl, and downloadUrl. The server handles authorization automatically, but this tool is useful for verifying credentials and retrieving account details.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description states that the tool returns account info and lists the specific fields. It does not explicitly mention side effects, but the annotations indicate readOnlyHint and idempotentHint, which are consistent with a read operation. The behavior is generally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two sentences that convey the purpose and usage. It is focused and free of unnecessary detail, making it easy to read and understand.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description adequately explains what the tool returns (accountId, apiUrl, downloadUrl). It also provides context on how authorization is handled. There is no missing essential information for an agent to use this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty ({}), so there are no parameters to describe. The description does not add any parameter information, but since there are none, this is fully appropriate. Schema coverage is 100% with no gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: authorize with B2 and return account info including accountId, apiUrl, and downloadUrl. It specifies the action and the output, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides guidance on when to use the tool: it notes that the server handles authorization automatically, but the tool is useful for verifying credentials and retrieving account details. It doesn't explicitly mention alternatives, but the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_create_bucketA

Create a new B2 bucket. Bucket names must be globally unique, 6-63 characters, and contain letters, digits, hyphens, and periods (names are not case-sensitive and cannot start with 'b2-').

ParametersJSON Schema
NameRequiredDescriptionDefault
corsRulesNoCORS rules: <=100. allowedOrigins/allowedOperations require 1-100 non-empty strings; allowedHeaders/exposeHeaders allow <=100. Strings <=999 chars. Per-rule UTF-8 total <1,000. Names unique.
bucketInfoNoCustom metadata: <=10 pairs. Keys: 1-50 UTF-8 bytes, chars A-Z a-z 0-9 . _ ` ~ ! # $ % ^ & * ' | + -, no b2- prefix. Values total <=10,000 UTF-8 bytes.
bucketNameYesThe name for the new bucket. Must be globally unique.
bucketTypeYesallPublic allows unauthenticated downloads; allPrivate requires authorization.
lifecycleRulesNoLifecycle rules for automatic file management.
fileLockEnabledNoEnable Object Lock (file lock) on the bucket at creation. (Object Lock can also be enabled later on an existing bucket via b2_update_bucket.) Must be true before any retention or legal hold can be applied to files in this bucket.
defaultServerSideEncryptionNoDefault server-side encryption for new files in this bucket.

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds no behavioral context beyond what the annotations already convey: it creates a resource, is not read-only, and is not idempotent. It does not mention authorization requirements, side effects on failure, or what happens if the bucket name already exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with the primary action front-loaded. The remaining sentence earns its place by capturing important bucket-name constraints that an agent must know before calling.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a complex 7-parameter schema with nested objects and no output schema, the description is narrow. It fully covers bucket naming constraints, but omits usage context, required authorization, expected return value, and relationship to sibling bucket operations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful parameter nuance beyond the schema for bucketName by specifying global uniqueness, 6-63 characters, allowed characters, case-insensitivity, and the prohibition on a 'b2-' prefix.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Create a new B2 bucket.' This clearly separates it from siblings like b2_delete_bucket and b2_update_bucket, and the modifier 'new' removes ambiguity about the operation's intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus alternatives, no prerequisites, and no mention of related tools such as b2_authorize_account or b2_update_bucket. The intended use is only implied by the verb 'Create.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_create_group_memberA
Destructive

Create a Backblaze account for a new Partner group member. In file sink mode, the one-time application key secret is written to the configured out-of-band secret sink and the MCP response contains only redacted metadata plus a secretSink pointer. In inline mode, the secret is returned with an explicit warning.

ParametersJSON Schema
NameRequiredDescriptionDefault
regionNoOptional data region for the new account.
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
groupIdYesThe Group ID that the new member will join.
memberEmailYesEmail address for the new group member account.
adminAccountIdYesThe accountId of the Group admin. Must be authorized for the Partner API.
idempotencyKeyYesCaller-generated idempotency key. Reuse the same value only when retrying the identical group-member creation request.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive and non-read-only behavior. The description adds meaningful operational context by disclosing how the one-time application key secret is handled in each mode: file sink mode returns redacted metadata plus a secretSink pointer, while inline mode returns the secret with an explicit warning. This goes beyond the structured fields and helps the agent anticipate side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no padding. The primary purpose is front-loaded, and the follow-up sentence efficiently explains the two operational modes and their output implications. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given six parameters, full schema coverage, annotations, and no output schema, the description covers the crucial behavioral distinction between file-sink and inline modes and what the response will contain. It does not enumerate every possible response field or error case, but for this tool it is sufficiently complete for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters. The description adds semantic context about secret handling and modes but does not provide additional meaning for individual parameters beyond what the schema already states. A baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Create a Backblaze account for a new Partner group member.' It clearly identifies the action and the target, and is distinct from siblings like b2_eject_group_member or b2_list_group_members. The extra mode detail reinforces the purpose without obscuring it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended use clear: this is for onboarding a new Partner group member. It does not explicitly name alternatives or state when not to use the tool, but the context is unambiguous and the sibling set includes related but distinct operations, so an agent can infer appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_create_keyA
Destructive

Create a B2 application key. In file sink mode, the one-time key secret is written to the configured out-of-band secret sink and the MCP response contains only redacted metadata plus a secretSink pointer. In inline mode, the secret is returned with an explicit warning.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoConfirm this durable credential creation. Required when the server destructive policy is 'confirm' (the default).
keyNameYesHuman-readable name for the new key.
bucketIdNoDeprecated single-bucket restriction. Use bucketIds for new integrations; do not provide both.
bucketIdsNoOptional bucket restrictions. Omit for account-wide access.
namePrefixNoOptional file-name prefix restriction for file capabilities.
capabilitiesYesB2 capabilities to grant to the new key.
idempotencyKeyYesCaller-generated idempotency key. Reuse the same value only when retrying the identical durable-key creation request.
validDurationInSecondsNoOptional key lifetime in seconds. Omit for no expiration.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond the annotations: it explains how the secret is handled in file sink mode versus inline mode, and what the MCP response contains in each case. This is valuable because the tool is destructive and non-idempotent, and the secret-handling behavior is not obvious from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose. Each sentence adds value, particularly the mode-specific secret-handling details, though terms like 'file sink mode' and 'inline mode' are introduced without explanation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does a decent job explaining response contents, but it leaves ambiguity about how an agent determines which mode (file sink vs inline) is active. Required parameters like confirm and idempotencyKey are covered by the schema, so the main gap is the mode-selection context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all eight parameters. The tool description itself does not add parameter-level detail, matching the baseline score for a fully documented schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Create a B2 application key.' This clearly distinguishes it from sibling tools like b2_delete_key and b2_list_keys, though it does not explicitly contrast against them in text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the tool name and first sentence: use when you need to create a B2 application key. However, there is no explicit guidance about when to prefer this over related key-management tools or any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_delete_bucketA
DestructiveIdempotent

Delete a B2 bucket. The bucket must be empty — all files and file versions must be deleted first.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
bucketIdYesThe ID of the bucket to delete.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the behavioral requirement that the bucket must be empty, which is a key runtime behavior. It doesn't repeat the destructive/idempotent hints already present in annotations, but the added empty-bucket condition goes beyond annotation info.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct and directly to the point, stating the action and one crucial precondition without any redundant wording. It effectively communicates the essential information in two short sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple nature of the operation and the presence of schema descriptions for parameters, the description adequately covers the core purpose and a key constraint. It doesn't explain return values, but no output schema exists, so that is not required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description itself does not elaborate on parameters, but the schema descriptions cover 100% of the parameters (bucketId and confirm). Since schema coverage is high, a baseline of 3 applies, and the description adds no extra parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Delete' and the resource 'a B2 bucket', along with a necessary precondition. The verb and object are unambiguous, leaving no doubt about the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a critical usage condition: the bucket must be empty before deletion. While it doesn't explicitly compare with alternative tools, the condition is highly informative for correct usage in typical scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_delete_keyA
DestructiveIdempotent

Permanently delete a B2 application key. This action is irreversible. Any system using the deleted key will lose access immediately.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
applicationKeyIdYesThe ID of the application key to delete.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true; the description adds meaningful consequences: deletion is irreversible and access is lost immediately. This exceeds the structured safety flags with real-world impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with no filler; the core action and irreversibility are front-loaded, and the access-loss consequence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter destructive action, the essential facts (what happens, reversibility, immediate effect) are present. It lacks usage/alternative context, but schema and annotations fill most operational details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so applicationKeyId and confirm are already documented. The description adds no parameter-level information, which is acceptable given the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Permanently delete a B2 application key'), and the irreversibility clarifies the scope. This clearly distinguishes it from sibling tools like b2_delete_bucket or b2_create_key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to choose this tool over alternatives, nor any conditions under which deletion should be avoided. It implies the action but doesn't provide decision context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_egress_leadersA
Read-onlyIdempotent

Rank top egress (downloaded bytes) by account or bucket over a period — default month-to-date. For 'who's downloading the most', 'where is egress concentrated'. Returns leaders with each one's share of total egress, from the daily usage reports. Scope follows the caller's key. Needs Usage Reports enabled.

ParametersJSON Schema
NameRequiredDescriptionDefault
byNoRank by 'account' (default) or 'bucket'.account
daysNoRolling window in days (1–90). Omit for current month to date.
limitNoLeaders to return (15).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive behavior, and the description adds substantial context beyond that: results are derived from daily usage reports, scope follows the caller's key, and Usage Reports must be enabled. This meaningfully prepares an agent for how the tool behaves in practice.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler: the primary action and default are front-loaded, followed by use cases and then important operational constraints. Every sentence adds information needed for correct selection and invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with three optional parameters and no required fields, this description is complete: it covers what is ranked, the possible grouping, the default time window, the output concept (leaders with egress share), the data source, authorization scoping, and a prerequisite. An agent can confidently invoke and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds extra meaning by clarifying that 'account'/'bucket' maps to the 'by' parameter, that omitting 'days' means month-to-date, and that the result focuses on each leader's share of total egress. It does not discuss the limit parameter, but the schema already covers that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Rank top egress') with a clear resource (downloaded bytes by account or bucket) and time scope (default month-to-date). It explicitly names the use cases ('who's downloading the most', 'where is egress concentrated'), which clearly separates it from sibling tools like b2_largest_files and b2_usage_growth.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when to use it: ranking egress leaders by account/bucket over a period, with a default month-to-date window. It also notes the prerequisite that Usage Reports must be enabled, but it does not explicitly state when not to use it or name alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_eject_group_memberA
DestructiveIdempotent

Eject a member from a Group. The account is NOT deleted — just removed (the member resets their password on next login). Optionally change their email on eject. Cannot be re-added via API (only the Group Management page).

ParametersJSON Schema
NameRequiredDescriptionDefault
emailNoNew email for the ejected account. If omitted, the existing email is kept. Must not already be a Backblaze account.
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
groupIdYesThe Group ID from which to eject the member.
adminAccountIdYesThe accountId of the Group admin. Must be authorized for the Partner API.
memberAccountIdYesThe accountId of the Group member to eject. Must be a member of the specified Group.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint true, but the description adds significant context: the account is not deleted, the member resets password on next login, and the action is irreversible via API. This goes beyond the annotation by clarifying what actually happens.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The purpose is front-loaded, followed by key constraints. Efficient and clearly structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the behavioral implications (account not deleted, password reset, irreversibility) and the option to change email. All parameters are documented in the schema. The description is sufficient for a destructive tool, though it could explicitly mention the confirm requirement (which is in the schema).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all parameters are already well-documented. The description adds a note about optionally changing email, but this is also covered in the schema. Baseline of 3 is appropriate since the schema carries the semantic load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (eject) and resource (member from a Group), and distinguishes from siblings like b2_create_group_member and b2_list_group_members. It is specific and not a tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides useful context on the effect (account not deleted, password reset) and a restriction (cannot be re-added via API), giving clear guidance on when to use it. However, it does not explicitly compare to alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_get_bucket_notification_rulesA
Read-onlyIdempotent

Get the event notification rules (webhooks) configured for a B2 bucket.

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketIdYesThe bucket ID to get notification rules for.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds the clarification that the rules are webhooks and are bucket-scoped, but does not describe return structure or edge cases like empty rule sets. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence states the action and object with no wasted words. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only getter with annotations carrying the safety profile and no output schema, the description is sufficient for an agent to invoke correctly. It clearly identifies what is being fetched, and the required bucketId is documented in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema's only parameter, bucketId, is fully described ('The bucket ID to get notification rules for.'), and schema description coverage is 100%. The description does not add parameter-level detail, but the schema carries the meaning, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Get' and names the resource 'event notification rules (webhooks) configured for a B2 bucket.' This clearly distinguishes it from the sibling b2_set_bucket_notification_rules, which writes rather than reads.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus b2_set_bucket_notification_rules or other siblings. The read-only verbs and annotations imply retrieval, but the description does not state prerequisites, exclusions, or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_largest_filesA
Read-onlyIdempotent

List a bucket's largest objects by size via a live listing. For 'largest files', 'what's taking up space in '. Give the bucket by name or bucketId; optional path prefix. Sorting by size requires a full listing, so on very large buckets the scan is bounded by max_scan and a time budget — it then returns the largest among the objects scanned with truncated=true; pass a prefix to focus on a subtree for a complete ranking. Returns name, size, and upload time — never contents.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoHow many of the largest files to return (default 10, max 100).
bucketYesBucket name or bucketId to inspect.
prefixNoOptional path prefix, e.g. "checkpoints/".
max_scanNoSafety cap on objects scanned (default 50,000, max 500,000). Buckets with millions of files cannot be fully sorted by size in one live call; the scan stops at this cap (or a time budget) and returns truncated=true. Narrow with prefix for an exhaustive ranking of a subtree.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint=true annotation, the description discloses a live listing, bounded scan by max_scan and a time budget, and truncated=true. This materially shapes agent expectations about results being approximate on large buckets, and it explicitly states that file contents are never returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the purpose, then explain the important scanning caveat and return contents. Every sentence earns its place with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description helpfully states the return fields (name, size, upload time) and the truncated=true behavior. It doesn't discuss auth, error cases, or how it relates to b2_usage_growth, but for a read-only listing tool the essential information is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters with descriptions, and the tool description adds meaningful guidance for prefix and max_scan, explaining the full-listing requirement, truncation behavior, and subtree ranking. This adds value beyond the schema without needing to do more.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource ('List a bucket's largest objects by size') and clarifies that it returns metadata, never contents. It does not contrast itself with sibling tools like b2_usage_growth or b2_list_buckets, so an agent must infer differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context with natural-language triggers ('largest files', 'what's taking up space') and instructs using a prefix for a complete subtree ranking. It does not explicitly name alternatives or when not to use this tool, though the 'never contents' caveat helps.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_list_bucketsA
Read-onlyIdempotent

List B2 buckets for the authorized account. Optionally filter by bucket ID, name, or type. When the key is bucket-scoped and no bucketId/bucketName filter is supplied, requests are automatically narrowed to the authorized bucket IDs. Returns bucket ID, name, type, CORS rules, and lifecycle rules for each bucket. Capped to limit buckets (default 100, max 1000) to keep the response small for accounts with many buckets; if more exist the result is truncated with total_bucket_count and a note — raise limit or filter to target specific buckets.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of buckets to return (default 100, max 1000). The B2 API returns every bucket in one response; this caps how many are surfaced to keep the payload and token cost bounded. If the account has more buckets than the limit, the result is truncated with total_bucket_count and a note — raise limit (up to 1000) or filter by bucketName / bucketId / bucketTypes.
bucketIdNoFilter to a specific bucket by its ID
bucketNameNoFilter to a specific bucket by its name
bucketTypesNoFilter by bucket types. Defaults to all types.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already provide readOnlyHint and openWorldHint, indicating a safe, non-destructive operation. The description adds valuable behavioral details beyond the annotations: it explicitly states that requests are automatically narrowed to authorized bucket IDs when bucket-scoped, that results are truncated if exceeding the limit, and it describes the return fields (ID, name, type, CORS rules, lifecycle rules). This enhances transparency beyond what the annotations alone convey, though it does not fully describe edge cases like error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately concise, but it is well-structured with two main sentences: one stating the core action and filters, another explaining the cap and truncation. It front-loads the primary purpose and includes necessary details without excessive verbosity. It could be slightly tightened (e.g., merging repeated 'filter' mentions), but it remains clear and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description compensates by explicitly listing the returned fields (ID, name, type, CORS rules, lifecycle rules). It also covers important context such as the automatic authorization narrowing and the truncation behavior, which are essential for a user to understand the tool's behavior in a real-world B2 account scenario. The description is complete for the complexity of a simple list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides descriptions for all four parameters with 100% coverage, including default values and enums for bucketTypes. The description reinforces these by explaining the purpose of the limit (to keep response small) and the consequence of exceeding it (truncation with a note). This adds semantic value, particularly around the limit parameter, going slightly beyond the schema's own descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists B2 buckets for the authorized account, using a specific verb ('List') and resource ('B2 buckets'). It distinguishes itself from other list tools by mentioning optional filters (by bucket ID, name, or type) and the automatic narrowing to authorized bucket IDs when bucket-scoped. This makes its purpose unambiguous and distinct from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on when to use the tool: it is the primary listing operation, and it explains that the response is capped and how to handle truncation (raise the limit or add filters). While it does not explicitly mention alternative tools (e.g., b2_list_keys or s3_list_objects_v2), the context is clear enough for typical usage. It falls just short of explicit 'when-not-to-use' guidance, hence a 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_list_group_membersA
Read-onlyIdempotent

List active (ACCEPTED) Group members for a specific Group. Returns up to 1,000 members per call; use nextEmail for pagination. Includes B2 storage stats per member.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupIdYesThe groupId whose members to list.
startEmailNoPagination cursor — the first member email to return. If no exact match, starts from the next email alphabetically.
adminAccountIdYesThe accountId of the Group admin. Must be authorized for the Partner API.
maxMemberCountNoMaximum number of members to return (1-1000). Defaults to 100.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds value by disclosing pagination limits (up to 1,000 per call), the use of nextEmail for continuation, and that storage stats per member are included. These details go beyond annotations and help the agent understand response volume and pagination flow. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The core purpose is front-loaded, followed by essential behavioral details (pagination limit and response content). Every word earns its place; it is compact and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list operation with no output schema, the description provides sufficient context: it defines the resource scope, pagination mechanism, and return content (members with storage stats). It does not enumerate member fields, but that is not essential for invocation. Combined with annotations covering safety, the description is complete enough for correct use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (all 4 parameters have descriptions). The description does not add new semantic meaning beyond the schema—it restates pagination and the 1,000 limit, which are already in parameter descriptions (maxMemberCount maximum and startEmail as cursor). With high schema coverage, baseline 3 is appropriate; no additional parameter context is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific verb ('List'), resource ('Group members'), and scope ('for a specific Group'). It also specifies the active (ACCEPTED) state, distinguishing it from siblings like b2_list_groups (lists groups) and b2_create_group_member (adds a member). The tool's purpose is unambiguous and clearly differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating it lists accepted members for a specific group, and mentions pagination behavior. However, it does not explicitly name alternatives or state when not to use this tool versus others like b2_list_groups. There is no explicit when/when-not guidance, though the purpose is clear enough for basic selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_list_groupsA
Read-onlyIdempotent

List active Groups administered by a Group admin account. Returns up to 100 groups per call; use nextGroupId for pagination. Requires the account to be authorized for the Partner API.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoFilter by Group name. Returns all Groups with this exact name.
startGroupIdNoPagination cursor — the groupId to begin listing from.
maxGroupCountNoMaximum number of Groups to return (1-100). Defaults to 100.
adminAccountIdYesThe accountId of the Group admin. Must be authorized for the Partner API.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral detail beyond that: it specifies a 100-group limit, pagination via nextGroupId, and the authorization requirement. These are not in the annotations and help the agent understand expected behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero wasted words. The main action is front-loaded, and the critical details (limit, pagination, authorization) are included without redundancy. It is a model of efficient writing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with no output schema, the description covers the key points: the scope ('active Groups'), the cap and pagination mechanism, and a prerequisite (authorization). It does not describe the response shape, but that is a minor gap given the tool's simplicity and the presence of a pagination hint.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented. The description's mention of 'Returns up to 100 groups' and 'use nextGroupId for pagination' loosely relates to maxGroupCount and startGroupId but does not add new semantic meaning beyond the schema. Per the rubric, a baseline of 3 is appropriate when the schema carries the full burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a clear resource ('active Groups'), and adds the qualifier 'administered by a Group admin account,' which distinguishes it from sibling tools like b2_list_group_members (which lists members) and b2_list_buckets. It is unambiguous and immediately conveys the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the required context (Group admin account, Partner API authorization) and implies the tool is for listing groups, but it does not explicitly name alternatives or state when not to use it. The distinction from b2_list_group_members is inferable but not spelled out, so guidance is present but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_list_keysA
Read-onlyIdempotent

List the application keys associated with the B2 account. Does not return the actual key secrets — only key IDs, names, capabilities, and restrictions.

ParametersJSON Schema
NameRequiredDescriptionDefault
maxKeyCountNoMaximum number of keys to return (1-1000).
startApplicationKeyIdNoPagination cursor from a previous response's nextApplicationKeyId.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, and non-destructive behavior. The description adds valuable behavioral context by explicitly stating that key secrets are not returned and exactly which fields are included (IDs, names, capabilities, restrictions). This goes beyond the schema and informs the agent about data sensitivity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with zero redundancy. The primary purpose is front-loaded, and the important caveat about key secrets is placed immediately after, giving the agent the most decision-relevant information efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward list tool with no required parameters, the description covers the key details: what is listed, what is returned, and what is deliberately excluded. Pagination mechanics are handled by the schema's parameter descriptions, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both maxKeyCount and startApplicationKeyId fully described in the schema itself. The description adds no additional parameter-level detail, but the schema already provides sufficient semantics for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('application keys associated with the B2 account'), making the tool's function immediately clear. It also distinguishes itself from sibling tools like b2_create_key and b2_delete_key by focusing on listing rather than mutation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly identifies this as a listing operation for application keys, which gives the agent enough context to select it over creation or deletion siblings. It does not explicitly state 'use this instead of X', but the read-only listing intent and the security-focused caveat provide clear situational context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_reserve_trial_create_accountA
Destructive

Reserve a B2 trial account through the Partner API. Available only in explicit inline mode because Reserve Trial has no provider-side recovery path if a file sink write fails after account creation.

ParametersJSON Schema
NameRequiredDescriptionDefault
termYesTrial duration in days (7-30).
emailYesEmail address for the new B2 Reserve trial account.
regionNoOptional data region for the new account.
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
storageYesTrial storage amount in TB (1-50).
idempotencyKeyYesCaller-generated idempotency key. Reuse the same value only when retrying the identical reserve-trial account creation request.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already flag the operation as destructive and not read-only. The description adds a valuable behavioral caveat beyond those annotations: account creation has no provider-side recovery path if a file sink write fails. This helps the agent appreciate the irreversibility and failure implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the purpose, the second adds a crucial caveat. Minor jargon such as 'file sink' slightly reduces clarity, but every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a fully described schema, clear annotations, and a focused purpose statement, the description is largely complete for invocation. The failure-recovery caveat materially improves completeness for a destructive operation, though no output/return behavior is described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and every parameter already has a meaningful description, including the confirm flag's destructive-policy dependency. The tool description itself adds no parameter-specific guidance, so it neither duplicates nor needs to compensate for the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('Reserve'), the resource ('a B2 trial account'), and the channel ('through the Partner API'). This is distinct from the sibling create/update tools and leaves no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear condition of use ('Available only in explicit inline mode') and explains the reason behind it, which helps an agent decide *how* to call it. However, it does not name alternatives or explicitly state when not to use this tool versus another sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_set_bucket_notification_rulesA
DestructiveIdempotent

Set event notification rules (webhooks) for a B2 bucket. Replaces any existing rules.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoConfirm replacing persistent outbound webhook notification rules. Required when the server destructive policy is 'confirm' (the default).
bucketIdYesThe bucket ID to set notification rules for.
eventNotificationRulesYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this destructive and idempotent; the description adds useful specificity by stating that any existing rules are replaced. It does not go as far as noting the conditional confirm requirement, but the schema covers that, so the added behavioral insight is sufficient for a scoring of 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the key action and destructive effect front-loaded. No filler or redundant restating of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a clear mutating operation with detailed schema and annotations, but it omits when-to-use guidance and the confirm/destructive-policy context that would make it fully self-contained, especially given the absence of an output schema describing the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds only a webhook hint and the replacement consequence; it does not explain bucketId, confirm, or rule construction. With schema description coverage at 67% and rich per-property documentation in the schema, the description neither meaningfully compensates nor detracts from what the agent can already read.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific operation: setting event notification webhook rules for a B2 bucket, and adds the non-obvious behavior that existing rules are replaced. This distinguishes it from sibling b2_get_bucket_notification_rules without needing to open the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool vs alternatives, no prerequisites, and no mention that b2_get_bucket_notification_rules is the read counterpart. The description only states what the tool does, leaving the agent to infer selection context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_unfinished_uploadsA
Read-onlyIdempotent

Find abandoned multipart uploads that silently consume storage in a bucket. For 'bucket bloat', 'stuck/incomplete uploads', 'wasted storage'. Returns count, oldest upload age, and wasted bytes. Give the bucket by name or bucketId. Live listing, bounded by max_uploads and an internal time budget — on a very bloated bucket it returns a truncated result (and wasted_gb may be a lower bound) and recommends a lifecycle rule.

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketYesBucket name or bucketId to inspect.
max_uploadsNoSafety cap on how many unfinished uploads to scan (default 1000, max 10,000). A bucket bloated with abandoned uploads would otherwise trigger an unbounded walk plus a per-upload parts fan-out that times out. If the cap or an internal time budget is hit, the result is truncated and wasted_gb may be a lower bound — add a lifecycle rule to auto-cancel unfinished large files.
older_than_daysNoOnly count uploads started more than this many days ago (optional).

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, so the baseline burden is lower. The description adds meaningful behavior beyond annotations: it is a live listing bounded by max_uploads and an internal time budget, may truncate results on bloated buckets, and wasted_gb may be a lower bound. It also discloses that the tool recommends a lifecycle rule.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler: use case, return metrics, invocation, and truncation caveat are each given distinct content. The most important scoping information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description tells the agent what will be returned: count, oldest upload age, and wasted bytes. It also covers the key failure mode and mitigation recommendation. Combined with rich annotations, this is complete enough for correct invocation and result interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters little parameter-level meaning beyond restating that the bucket can be given by name or bucketId, which duplicates the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Find abandoned multipart uploads that silently consume storage in a bucket.' It also includes use-case keywords like 'bucket bloat' and 'wasted storage', which help distinguish it from generic listing tools such as s3_list_multipart_uploads and from size-focused siblings like b2_largest_files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear invocation contexts: 'bucket bloat', 'stuck/incomplete uploads', and 'wasted storage'. It does not explicitly name alternative tools or state when not to use this tool, so it stops short of full exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_update_bucketA
DestructiveIdempotent

Update the settings of an existing B2 bucket, including type, CORS rules, lifecycle rules, encryption, and replication configuration.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoConfirm a destructive change (making the bucket public, weakening Object Lock/lifecycle, or changing replication). Required when the server destructive policy is 'confirm' (the default); non-destructive updates do not need it.
bucketIdYesThe ID of the bucket to update.
corsRulesNoCORS rules: <=100. allowedOrigins/allowedOperations require 1-100 non-empty strings; allowedHeaders/exposeHeaders allow <=100. Strings <=999 chars. Per-rule UTF-8 total <1,000. Names unique.
bucketInfoNoCustom metadata: <=10 pairs. Keys: 1-50 UTF-8 bytes, chars A-Z a-z 0-9 . _ ` ~ ! # $ % ^ & * ' | + -, no b2- prefix. Values total <=10,000 UTF-8 bytes.
bucketTypeNo
ifRevisionIsNoConditional update — only update if the bucket revision matches this value.
lifecycleRulesNo
fileLockEnabledNoEnable Object Lock on the bucket. Unlike S3's PutObjectLockConfiguration (which only enables lock at bucket creation), the B2 native API allows enabling Object Lock on an existing bucket here. Requires the writeBucketRetentions capability.
defaultRetentionNoDefault Object Lock retention for newly uploaded objects. Requires Object Lock enabled on the bucket. Send { mode: null, period: null } to clear.
replicationConfigurationNo
defaultServerSideEncryptionNo

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already identify this as destructive and non-read-only, but the description itself adds no behavioral context beyond 'update.' It does not mention confirmation requirements, destructive consequences, or how updates apply. The confirm parameter appears only in the schema, not the tool description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with the verb and resource front-loaded and no filler. Every phrase contributes to understanding what the tool operates on and what it can change.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter tool with nested objects and no output schema, the one-line description is adequate for basic tool selection but leaves important caveats—destructive confirmation, Object Lock requirements, and update semantics—to the schema and annotations. It is not incomplete enough to block use, but it is not fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 64%, so the schema carries most parameter documentation. The description adds a useful high-level category list, but it omits key parameters like confirm, fileLockEnabled, defaultRetention, bucketInfo, and ifRevisionIs, so it only partially compensates for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Update') with a clear resource ('existing B2 bucket') and lists major setting categories (type, CORS rules, lifecycle rules, encryption, replication). This clearly separates it from siblings like b2_create_bucket, b2_delete_bucket, and b2_set_bucket_notification_rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'existing B2 bucket' implies an update use case, and the listed settings suggest when to choose this tool. However, there is no explicit guidance about when not to use it or which sibling to prefer for related tasks such as notification rules or lifecycle-only updates.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_update_file_retentionA
DestructiveIdempotent

Set or modify the retention policy on a specific file version in B2. Supports governance and compliance retention modes. In compliance mode, the retain-until date can only be extended. Requires the writeFileRetentions capability.

ParametersJSON Schema
NameRequiredDescriptionDefault
fileIdYesThe B2 file ID of the file to update.
confirmNoConfirm this irreversible/protection-removing operation. Required when the server destructive policy is 'confirm' (the default).
fileNameYesThe name of the file (required by the B2 API alongside fileId).
fileRetentionYesRetention policy to apply, or { mode: null, retainUntilTimestamp: null } to clear. This is the flat shape B2's write API expects — do NOT include the read-only isClientAuthorizedToRead/value wrapper that b2_get_file_info returns.
bypassGovernanceNoIf true, allows overriding governance-mode retention. Requires bypassGovernance capability.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as destructive and non-read-only; the description adds useful behavior beyond that, such as 'In compliance mode, the retain-until date can only be extended' and the required writeFileRetentions capability. There is no contradiction with annotations. It could include more side-effect detail, but the provided context is meaningful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences carry the essential information: purpose, mode support, compliance constraint, and capability requirement. Every sentence earns its place with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description plus the richly documented schema cover the core operation, prerequisites, mode restrictions, required parameters, and the confirm behavior. There is no output schema, but for a mutation tool this is acceptable. A minor gap is that the description does not explicitly summarize clearing behavior, though the schema covers it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds extra parameter-relevant meaning: the compliance mode only allows extending retain-until, and the capability requirement affects whether certain operations are permitted. This goes beyond what the schema's property descriptions state.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Set or modify the retention policy on a specific file version in B2,' naming the action, the resource, and the scope precisely. It also names the two supported retention modes, distinguishing this from legal-hold and bucket-level operations. This is specific and non-tautological.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly establishes when the tool is applicable—when a B2 file version's retention policy needs to be set or modified—and adds the capability prerequisite. It does not explicitly name alternative tools, but the operation scope and sibling names make the intended use unambiguous. The schema covers the confirm flag for destructive operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

b2_usage_growthA
Read-onlyIdempotent

Rank accounts by how much STORED data grew or shrank between two points in time, from the daily B2 usage reports (uses stored_gb, the end-of-day snapshot). For 'which customers grew the most/least', 'who's moving data off'. Compares the latest snapshot against one month/quarter/year earlier and fetches only those two days, so it stays fast even on large report buckets. Returns the two dates compared and per-account start vs current GB and % growth (new accounts flagged). Scope follows the caller's key (a partner key sees all its sub-accounts). Needs Usage Reports enabled.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoCustom trailing window in days that overrides `period` (e.g. 7 for week-over-week).
limitNoMax accounts (default 50).
orderNoRanking. Default most_grown.most_grown
periodNoCompare the latest snapshot against one month, quarter, or year ago. Default month.month

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool read-only, idempotent, and non-destructive. The description adds substantial behavioral context beyond that: it uses end-of-day stored_gb snapshots, fetches only two days for efficiency, returns the compared dates and per-account start/current GB plus % growth, flags new accounts, and explains that scope follows the caller's key. This gives the agent a clear picture of what the call does and what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence adds value: purpose, use cases, data semantics, performance behavior, return contents, scoping, and a prerequisite. It is front-loaded with the core action and remains readable despite its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explains what the response contains (dates compared, per-account start vs current GB, % growth, new account flags). It also covers prerequisites, scope, and performance characteristics. For a read-only reporting tool with four optional parameters, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with all four parameters documented in the input schema itself. The tool description reinforces the period-window concept but does not add much new parameter-level meaning beyond what the schema already says. Baseline 3 is appropriate when the schema carries the parameter documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Rank accounts by how much STORED data grew or shrank'), names the data source (daily B2 usage reports, stored_gb snapshots), and gives concrete use cases ('which customers grew the most/least', 'who's moving data off'). This clearly differentiates it from siblings like b2_egress_leaders or b2_largest_files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: it is for growth/shrinkage ranking between two points, compares latest snapshot against month/quarter/year earlier, and notes the prerequisite that Usage Reports must be enabled. It does not explicitly name alternative tools or state when not to use it, but the intended scenarios are well specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_abort_multipart_uploadA
DestructiveIdempotent

Abort an in-progress S3-compatible multipart upload and release all associated storage.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
bucketYesThe bucket name.
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
uploadIdYesThe UploadId to abort.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true, so the description is not required to restate destructiveness. It adds useful behavioral context by specifying that the operation aborts an in-progress upload and releases associated storage, making the consequence concrete beyond the bare annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly constructed sentence that communicates the action, scope, and consequence with no redundant words. It is front-loaded and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive operation, the description plus annotations and 100% schema parameter coverage provide enough information to invoke the tool correctly. It would benefit from a brief note about irreversible consequences or the distinction from s3_complete_multipart_upload, but those are either covered by annotations or inferable from the sibling tool names.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and every parameter, including the important confirm flag, already has a meaningful schema description. The tool description itself adds no parameter-specific detail, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Abort') with a clear resource ('in-progress S3-compatible multipart upload') and an outcome ('release all associated storage'). This clearly distinguishes it from related operations like s3_complete_multipart_upload or s3_create_multipart_upload.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'in-progress' implies this tool is for canceling an unfinished multipart upload rather than completing it, which gives some usage context. However, it does not explicitly state when to choose this over s3_complete_multipart_upload or s3_delete_object, nor does it mention any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_complete_multipart_uploadA
Idempotent

Finalize an S3-compatible multipart upload. Provide the ETags of all uploaded parts in order.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
partsYesAll uploaded parts in ascending part number order.
bucketYesThe bucket name.
uploadIdYesThe UploadId.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only (false), idempotent (true), and non-destructive (false) hints. The description adds the behavioral requirement that parts must be provided in ascending order, which is useful, but it does not disclose other traits such as error behavior or effects of retries. This is acceptable given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences: the first states the action, the second states the critical input requirement. Zero filler, front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complete parameter schema, the no-output-schema case, and annotations covering safety and idempotency, this description provides sufficient context for an agent to invoke the tool correctly. It could be slightly richer on error cases or return values, but nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already well-documented. The description's mention of ETags and ordering adds a minor contextual layer but does not introduce new information beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Finalize' with the resource 'S3-compatible multipart upload', clearly distinguishing it from create/abort operations. It also adds a key requirement ('Provide the ETags... in order') that solidifies its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: the tool finalizes an upload, which presupposes that all parts have been uploaded. It does not explicitly mention alternatives like abort_multipart_upload or state conditions for when to use this over other tools, but the context makes the primary use case clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_copy_objectA
Idempotent

Copy an object within B2 or between B2 buckets via B2's S3-compatible CopyObject API. The acl input is retained as a no-op S3 compatibility hint; B2 access follows the destination bucket policy.

ParametersJSON Schema
NameRequiredDescriptionDefault
aclNoAccepted as a no-op S3 compatibility hint; B2 access follows the destination bucket policy.
metadataNoNew metadata (only used with REPLACE).
sourceKeyYesThe source object key.
contentTypeNoNew content type (only used with REPLACE).
sourceBucketYesThe source bucket name.
destinationKeyYesThe destination object key.
sourceVersionIdNoCopy a specific version of the source object.
destinationBucketYesThe destination bucket name.
metadataDirectiveNoCOPY copies metadata from source; REPLACE uses the provided metadata.COPY

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond the annotations: the acl parameter is called out as a no-op S3 compatibility hint, and B2 access is tied to the destination bucket policy. This helps the agent understand side effects and authorization behavior that the annotations do not convey. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. It front-loads the core operation and scope, then places the important acl caveat and access-policy note. Every sentence earns its place and the structure is easy for an agent to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with full schema coverage and useful annotations, the description is reasonably complete: it clarifies bucket scope and the acl no-op. It does not describe the return value or error behavior, but the absence of an output schema and the schema's thorough parameter documentation keeps this from being a major gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameter meanings. The description repeats the acl no-op behavior that the schema already states, adding no new param-level insight. Baseline 3 is appropriate because the schema does the heavy lifting and the description does not need to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the operation: 'Copy an object within B2 or between B2 buckets via B2's S3-compatible CopyObject API.' It names a specific verb, resource, and scope, and the phrase 'CopyObject API' distinguishes it from sibling upload/part-copy tools without requiring schema inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for the operation and its cross-bucket scope, but it never explicitly tells the agent when to choose this over alternatives like s3_put_object or s3_upload_part_copy. Usage is implied by the semantics of 'copy' rather than stated with exclusions or sibling comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_create_multipart_uploadA

Initiate an S3-compatible multipart upload for a large file in B2. Returns an UploadId to use with s3_presign_upload_part, which mints per-part URLs the client uploads directly to B2.

ParametersJSON Schema
NameRequiredDescriptionDefault
aclNo
keyYesThe object key for the final assembled file.
bucketYesThe destination bucket name.
metadataNoCustom metadata for the object.
contentTypeNoMIME type of the object.
serverSideEncryptionNoServer-side encryption. B2 supports SSE-B2 (AES256) only — not SSE-KMS.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey non-read-only and non-idempotent behavior. The description adds useful operational context by clarifying that this call only initiates the upload, returns an UploadId, and does not upload data itself. However, it omits the important lifecycle fact that the initiated upload persists as unfinished state until completed or aborted, so it adds some but not rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry purpose, scope, return value, and companion-tool routing without any filler. The key information is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Combined with the schema, the description is sufficient for the immediate call: it implies required bucket/key, optional metadata, and the meaning of the returned UploadId. The main gap is lifecycle guidance—an initiated multipart upload should eventually be completed or aborted—and there is no output schema to fill that in, making the overall description informative but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is about 83%, and the schema already explains bucket, key, metadata, contentType, and serverSideEncryption. The tool description adds no parameter-specific meaning beyond 'large file' and the returned UploadId, so it stays at the schema-coverage baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific action ('Initiate an S3-compatible multipart upload') on a clear resource ('a large file in B2') and immediately names the companion sibling tool, s3_presign_upload_part, distinguishing this initiation step from per-part URL minting. There is no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear usage context: use this when the file is large and when a multipart strategy is intended, and pass the returned UploadId to s3_presign_upload_part. However, it does not explicitly say when not to use it, such as recommending s3_put_object for small objects, or mention that completion/abort steps must follow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_delete_objectA
Destructive

Delete an object from a B2 bucket. Optionally specify a version ID to delete a specific version.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key to delete.
bucketYesThe bucket name.
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
versionIdNoVersion ID of the specific version to delete.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive and non-read-only behavior. The description adds minimal extra context by noting that version ID selects a specific version, but it does not disclose consequences like irreversibility or behavior in versioned buckets. This is acceptable but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and resource. Every word earns its place; no filler or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive 4-parameter tool with annotations and full schema coverage, this is minimally sufficient. However, it omits behavior on missing objects, versioning edge cases, and the bulk-delete alternative. Without an output schema, a bit more context would round it out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description does not add meaning beyond what the schema already provides. The version-ID mention in the description only restates the schema field description, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Delete'), a clear resource ('an object from a B2 bucket'), and the optional version-ID behavior. It is immediately distinguishable from the sibling s3_delete_objects by the singular object scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. In particular, the sibling tool s3_delete_objects provides bulk deletion, and the description does not mention that distinction or any other selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_delete_objectsA
Destructive

Delete multiple objects from a B2 bucket with bounded SDK concurrency (up to 1000 objects).

ParametersJSON Schema
NameRequiredDescriptionDefault
quietNoIf true, only return errors (not successes) in the response.
bucketYesThe bucket name.
confirmNoConfirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default).
objectsYesArray of objects to delete.
bypassGovernanceNoIf true, bypass governance-mode Object Lock retention when deleting specific versions. Requires bypassGovernance capability.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, so the destructive nature is covered. The description adds the 'bounded SDK concurrency' detail, but does not add further behavioral context such as irreversibility, versionId effects, or interaction with the confirm parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with the verb first, the target resource next, and a useful bound trailing; no filler or repetition of schema fields. It earns its place and is immediately scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive batch tool, the schema covers quiet, confirm, objects, and governance, while the description adds the concurrency and batch-size framing. The lack of an output schema is mitigated by the quiet parameter documentation, though a one-line note about response behavior would have made it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all five parameters and their fields. The description only restates the maxItems bound of 1000 objects, adding no new semantic detail beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete action ('Delete multiple objects') plus the exact resource ('B2 bucket') and an explicit scope bound ('up to 1000 objects'). It is immediately distinguishable from the sibling s3_delete_object, which covers the single-object case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'multiple objects' and the explicit 1000-object upper bound provide a clear context for batch deletion versus the single-object sibling. It does not explicitly name s3_delete_object or state when not to use the tool, so it stops just short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_get_bucket_locationA
Read-onlyIdempotent

Get the region (location constraint) of a B2 bucket via the S3-compatible API. No native b2_* equivalent — used to verify region/endpoint pairing.

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketYesThe bucket name.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool read-only, idempotent, and non-destructive, lowering the disclosure burden. The description adds useful context about the S3-compatible API and its verification purpose, but does not describe the return payload or failure behavior. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the operation and resource, and every clause adds value. The parenthetical and dash clause pack in API family and purpose without any filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only, idempotent tool with complete schema coverage and rich annotations, the description covers the essential context: API family, purpose, and lack of native alternative. It does not explicitly state the return value, but the operation name and purpose make it mostly inferable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single required bucket parameter, so the schema fully documents the input. The description mentions 'B2 bucket' and 'location constraint' but adds no parameter-level meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb ('Get') and resource ('region (location constraint) of a B2 bucket'), and distinguishes itself from b2_* siblings by explicitly stating there is no native equivalent. This makes it clearly identifiable among the many S3 and B2 tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear use case ('verify region/endpoint pairing') and notes that no native b2_* equivalent exists, guiding the agent away from the b2_* family. It does not explicitly name alternatives like s3_head_bucket, so the guidance is useful but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_get_objectA

Read a SMALL object inline (≤1 MiB, returned base64) — for manifests, sidecars, and configs the agent must inspect — or stream any size to a local path with saveToPath. For real object data, generate a GetObject URL with s3_get_presigned_url and download directly from B2 (bytes never pass through the server or the model context).

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
rangeNoByte range, e.g. 'bytes=0-1048575'.
bucketYesThe bucket name.
versionIdNoSpecific version of the object to retrieve.
saveToPathNoIf provided, save the file to this local path.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the 1 MiB inline cap, base64 return encoding, streaming behavior via saveToPath, and that the presigned URL path keeps object bytes out of the server/model context. This goes well beyond the sparse annotations and gives an agent a clear behavioral model with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences front-load the primary behavior and decision rule, then route to the sibling tool. Every clause earns its place and there is no repetition of schema or annotation content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter tool with no output schema and sparse annotations, the description covers the key facts an agent needs: size limits, return encoding, local streaming, and the correct sibling for real object data. Required parameters remain obvious from the schema, and no critical behavior is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description adds meaningful usage semantics for saveToPath ('stream any size to a local path') and clarifies that inline reads are limited to small objects returned as base64. It does not elaborate on range or versionId, but those are already adequately described in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Read a SMALL object inline' with concrete constraints (≤1 MiB, returned base64) and explicitly contrasts with s3_get_presigned_url. An agent can immediately distinguish this tool from sibling object-access tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use the inline path (manifests, sidecars, configs), when to use saveToPath for any size, and when to use s3_get_presigned_url for real object data. The exclusion is clear and names the exact sibling alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_get_presigned_urlA
DestructiveIdempotent

Generate a short-lived presigned URL bearer capability for one B2 object — GetObject (download) or PutObject (upload). The response includes the URL, operation, expiresIn, and expiresAt; treat the URL as sensitive until it expires. This is the preferred path for moving real object data: bytes flow directly between the client/worker and B2 and never pass through the MCP server. Note: presigned POST (browser form uploads) is NOT supported by B2; use a PutObject URL instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
bucketYesThe bucket name.
confirmNoConfirm minting a PutObject presigned URL bearer capability that can create or overwrite object data. Required when operation is PutObject and the server destructive policy is 'confirm' (the default).
expiresInNoURL expiry in seconds (default: 3600 = 1 hour, max: 604800 = 7 days).
operationYesThe operation the URL allows: GetObject to download or PutObject to upload.
versionIdNoFor GetObject: the specific version ID to target.
contentTypeNoFor PutObject: restrict the upload to this content type.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description adds valuable behavioral context: the URL is a bearer capability, it is short-lived, it should be treated as sensitive until expiry, and B2 does not support presigned POST. The destructive nature of PutObject URLs is consistent with destructiveHint=true, and readOnlyHint=false matches the upload capability. No contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the core behavior, the operational advantage and sensitivity guidance, and the critical B2 limitation. The most important information is front-loaded, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description usefully states that the response includes URL, operation, expiresIn, and expiresAt. It also covers the key operational context (direct byte flow, sensitivity, unsupported POST flow) and the tool's role relative to siblings. An agent has enough information to call this tool correctly and interpret its result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage of all seven parameters, including descriptions, defaults, enums, and constraints, so the description does not need to restate parameter details. The description does add contextual meaning by labeling the URL a bearer capability and mentioning the response fields, but this is not parameter-level semantics. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (Generate), a precise resource (short-lived presigned URL bearer capability for one B2 object), and the two allowed operations (GetObject download / PutObject upload). It also distinguishes itself from sibling tools by explaining that bytes flow directly between client and B2 and never through the MCP server.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly positions this as 'the preferred path for moving real object data,' giving the agent a direct criterion for choosing it over s3_get_object or s3_put_object. It also explicitly warns that presigned POST is unsupported and instructs to use a PutObject URL instead, but it does not enumerate other alternative tools or when to avoid this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_head_bucketA
Read-onlyIdempotent

Check whether a B2 bucket exists and is reachable on the S3-compatible endpoint with the current credentials. Use this to validate S3-surface reachability (the native b2_list_buckets confirms existence but not S3 reachability).

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketYesThe bucket name to check.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds valuable behavioral context: it operates on the S3-compatible endpoint, checks both existence and reachability, and depends on current credentials. This goes beyond what the annotations convey, though it could mention explicit error/status outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler. The primary purpose is first, followed by a precise usage directive. Every phrase earns its place and nothing needs to be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter, read-only tool with full annotations and complete schema coverage, this description supplies all necessary context: what it checks, what credentials it uses, and when to prefer it over a sibling. No missing information blocks an agent from selecting or invoking it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the only parameter, 'bucket', is already described as 'The bucket name to check.' The description reinforces this by referencing the bucket but does not add new semantic details such as name format or restrictions. Baseline 3 is appropriate given full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Check whether') and resource ('B2 bucket') with the precise scope: exists and is reachable on the S3-compatible endpoint with current credentials. It also distinguishes itself from b2_list_buckets, removing any ambiguity with sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly gives the use case: 'Use this to validate S3-surface reachability' and directly names the alternative (b2_list_buckets) that does not cover S3 reachability. This tells an agent exactly when to choose this tool over a similar sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_head_objectA
Read-onlyIdempotent

Get metadata for a B2 object without downloading it. Returns content type, size, last modified, ETag, and custom metadata.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
bucketYesThe bucket name.
versionIdNoSpecific version of the object.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the read-only safety profile is established. The description adds value beyond those by disclosing that the operation returns metadata only and by listing the response fields (content type, size, last modified, ETag, custom metadata), which is genuinely useful given there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero filler: the core purpose and differentiator are front-loaded in the first sentence, and the response summary follows directly. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple metadata-retrieval tool with rich annotations and fully documented parameters, the description is nearly complete, and it partially compensates for the missing output schema by enumerating the returned metadata fields. Minor gaps remain around failure behavior (e.g., 404 for a missing object) and versionId semantics, but these are not blocking for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — bucket, key, and versionId each already carry descriptive entries, so the baseline 3 applies. The description adds no parameter-specific detail, but none is required given that the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get metadata for a B2 object') and the key differentiator 'without downloading it', which distinguishes it from s3_get_object and s3_head_bucket. The second sentence enumerates the response contents, making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'without downloading it' provides clear context for when to choose this tool over the object-download sibling: when only metadata is needed and the body is not. However, no alternative is named explicitly and no exclusionary conditions are stated, so it stops short of the strongest routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_list_multipart_uploadsA
Read-onlyIdempotent

List all in-progress S3-compatible multipart uploads for a bucket.

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketYesThe bucket name.
prefixNoOnly list uploads for keys with this prefix.
delimiterNo
keyMarkerNoPagination cursor.
maxUploadsNo
uploadIdMarkerNoPagination cursor.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile with readOnlyHint, idempotentHint, and destructiveHint=false. The description adds useful context by specifying 'in-progress' and 'S3-compatible', but it does not disclose that results are paginated through maxUploads/keyMarker/uploadIdMarker, despite saying 'List all'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the verb and resource. It is as short as possible while still conveying the tool's scope and S3 compatibility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description never explains the response shape or how pagination works, so an agent cannot fully anticipate what the tool returns. The presence of two 'Pagination cursor' parameters implies paging, but the description gives no guidance on how to traverse pages to actually list 'all' uploads.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no parameter-level meaning beyond the schema; 'for a bucket' merely recontextualizes the required bucket parameter. With 67% schema coverage, the missing delimiter and maxUploads semantics are not compensated for by the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') with a clear resource ('in-progress S3-compatible multipart uploads') and a clear scope ('for a bucket'). It distinguishes itself from sibling s3_list_parts, which lists parts of a specific upload, and from b2_unfinished_uploads by emphasizing S3 compatibility.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The action itself implies when to use it (when in-progress multipart uploads need enumeration), but it gives no explicit alternatives or exclusions. It does not tell the agent to prefer s3_list_parts for a single upload or to use abort/complete operations for finalization, so routing relies on inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_list_objects_v2A
Read-onlyIdempotent

List objects in a B2 bucket via the S3-compatible ListObjectsV2 API. Supports prefix filtering, delimiter-based folder listings, and pagination.

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketYesThe bucket name.
prefixNoOnly return objects whose keys start with this prefix.
maxKeysNo
delimiterNoUse '/' to list like a folder tree.
startAfterNoReturn objects after this key (exclusive S3 StartAfter semantics).
continuationTokenNoPagination token from a previous response.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the read-only, idempotent, non-destructive behavior, so the description does not need to repeat safety traits. It adds useful functional detail about filtering, delimiter folder views, and pagination, but it does not disclose truncation behavior or the need to follow continuation tokens.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One well-structured sentence that front-loads the primary action and resource, then lists the key capabilities. Every clause adds information, and there is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with rich annotations and a well-documented schema, gives an agent enough to invoke the tool correctly. It covers filtering, folder-style listing, and pagination; the only notable gap is not explicitly explaining that results can be truncated and require a continuation token, though the word 'pagination' hints at this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high at 83%, providing a solid baseline. The description goes further by giving semantic meaning to key parameters: 'prefix filtering' maps to prefix, 'delimiter-based folder listings' maps to delimiter, and 'pagination' maps to continuationToken. Only maxKeys lacks prose explanation, though the schema defines its bounds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Begins with the specific verb-object pair 'List objects in a B2 bucket' and names the exact S3-compatible ListObjectsV2 API. This clearly identifies the operation and distinguishes it from siblings like s3_list_object_versions and s3_list_parts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use cases by mentioning prefix filtering, delimiter-based folder listings, and pagination, but it never states when to choose this tool over alternatives such as s3_list_object_versions or s3_list_parts. There is no explicit when-to-use or when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_list_object_versionsA
Read-onlyIdempotent

List all versions of objects in a versioned B2 bucket, including delete markers.

ParametersJSON Schema
NameRequiredDescriptionDefault
bucketYesThe bucket name.
prefixNoOnly list versions for objects with this prefix.
maxKeysNo
delimiterNo
keyMarkerNoPagination cursor — key from a previous response.
versionIdMarkerNoPagination cursor — version ID from a previous response.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive behavior. The description adds useful context beyond that by revealing the response includes delete markers and that the bucket must be versioned. It does not describe pagination, error behavior, or response shape, but those are secondary for a safe read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loaded with the verb and object, and the 'including delete markers' qualifier is placed at the end where it does not interfere with the primary action. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description plus schema covers the core behavior and parameter meanings, but there is no mention of output structure, pagination behavior, or how the tool behaves on an unversioned bucket. Since there is no output schema and the tool has 6 parameters, these gaps leave some uncertainty for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (bucket, prefix, keyMarker, and versionIdMarker are described; maxKeys and delimiter are not), and the description contributes no parameter-level meaning. An agent gets no help from the description for the undocumented maxKeys and delimiter parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List'), identifies the exact resource ('all versions of objects in a versioned B2 bucket'), and adds a distinguishing detail ('including delete markers') that separates it from siblings like s3_list_objects_v2. This makes the tool's scope immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case: an agent needs this tool when it wants every version or delete markers rather than just current objects. However, it never explicitly names alternatives like s3_list_objects_v2 or states when not to use this tool, leaving the routing decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_list_partsA
Read-onlyIdempotent

List the parts that have been uploaded for an in-progress S3-compatible multipart upload.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
bucketYesThe bucket name.
maxPartsNo
uploadIdYesThe UploadId.
partNumberMarkerNoPagination cursor.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the description does not need to restate safety. It adds the useful context that the upload must be in-progress, but it does not disclose pagination behavior, response shape, or any error conditions, so it stays at the baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence communicates the operation, resource, and required state with no redundant wording. Every word contributes to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list operation, the description plus schema annotations cover the essential invocation details: the operation, the target resource, and the in-progress state. It does not describe the return object, but a list operation of this kind is still sufficiently callable without that detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 80% of parameters, documentating bucket, key, uploadId, and partNumberMarker, leaving only maxParts without a description. The description does not add meaning to any parameter beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List'), a clear resource ('parts'), and a scoping condition ('an in-progress S3-compatible multipart upload'). This clearly distinguishes it from sibling tools like s3_list_multipart_uploads, which list uploads rather than parts, and from s3_upload_part_copy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in-progress' provides clear context that this tool is for active multipart uploads, implying it is not for completed uploads. It does not explicitly name alternatives or exclusions, but the intended use case is clear enough without additional guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_presign_upload_partA
Idempotent

Generate short-lived presigned PUT URL bearer capabilities for parts of an S3-compatible multipart upload, so the client/worker uploads each part DIRECTLY to B2. The response includes expiresIn/expiresAt; treat each URL as sensitive until it expires. Flow: s3_create_multipart_upload → s3_presign_upload_part → PUT each part to its URL (capture the ETag from each response header) → s3_complete_multipart_upload with those ETags. Parts except the last must be ≥5 MiB.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe object key.
bucketYesThe bucket name.
uploadIdYesThe UploadId from s3_create_multipart_upload.
expiresInNoURL expiry in seconds (default: 3600 = 1 hour, max: 604800 = 7 days).
partNumbersYesPart numbers to presign (each 1–10000). Mint all parts at once, or only the missing ones to resume.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals that URLs are short-lived bearer capabilities, that the response contains expiresIn/expiresAt, and that each URL should be treated as sensitive until expiry. It also clarifies that the upload happens directly to B2 by the client/worker rather than by this tool. This adds meaningful behavior beyond the annotations and does not contradict them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence contributes: purpose, security/expiry behavior, the full multipart flow, and a size constraint. It is front-loaded with the core function before the workflow details. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by stating the key response fields (expiresIn/expiresAt) and the required flow with ETags. It covers prerequisites, sequencing, and the part-size rule. The exact response shape mapping part numbers to URLs is not spelled out, but enough context is present for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all five parameters. The description adds workflow-level context and the ≥5 MiB part-size rule, but does not add detailed parameter-level semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: generating short-lived presigned PUT URLs for parts of an S3-compatible multipart upload. It distinguishes itself from siblings like s3_get_presigned_url by specifying PUT and multipart parts, and clarifies the tool does not perform the upload itself ('client/worker uploads each part DIRECTLY').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It embeds the tool in a concrete workflow, naming the preceding and following calls and the ETag handoff. It also states a hard constraint ('Parts except the last must be ≥5 MiB'). It does not explicitly name alternative tools or when not to use them, so this is clear context without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_put_bucket_lifecycleA
DestructiveIdempotent

Set S3 lifecycle rules on a B2 bucket; pass rules: [] to clear the S3 lifecycle configuration. Supports AbortIncompleteMultipartUpload, Expiration, and NoncurrentVersionExpiration. B2 does not support Transition/storage-class rules.

ParametersJSON Schema
NameRequiredDescriptionDefault
rulesYesRules to set; [] clears the configuration.
bucketYesThe bucket name.
confirmNoRequired under 'confirm' when rules is [] or rules expire objects. Not needed for abort-incomplete-upload-only rules.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark this as destructive and idempotent. The description adds valuable behavioral detail: passing rules: [] clears the entire lifecycle configuration, and B2 does not support Transition/storage-class rules. This helps an agent avoid invalid or unintended calls.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short, information-dense sentences with no filler. The primary action is front-loaded, followed by clearing behavior and supported/unsupported rule types.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the schema already documents all parameters and the annotations cover safety behavior, the description adds the essential B2-specific context. The only minor gap is that it does not explicitly state that setting non-empty rules replaces any existing lifecycle configuration, but this is largely implied by the 'set' and 'clear' semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful semantics beyond the schema by explaining that rules: [] clears the configuration and by enumerating the supported lifecycle actions. The confirm parameter is not described in the description, but the schema already covers it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Set S3 lifecycle rules on a B2 bucket.' It also names the supported rule types and the key B2-specific limitation around Transition/storage-class rules, which distinguishes this tool from general S3 mutation tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: this is the tool for lifecycle configuration on a B2 bucket and it clarifies what rule types are supported. It does not explicitly name sibling tools as alternatives or state when not to use this tool, but the scope is specific enough that the intended use case is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_put_objectA
Idempotent

Upload a SMALL object inline (≤1 MiB) to a B2 bucket — for manifests, sidecars, and tiny configs. Provide base64-encoded content or a local file path. For real object data, generate a PutObject URL with s3_get_presigned_url and upload directly to B2 (bytes never pass through the server), or use the multipart tools for large objects.

ParametersJSON Schema
NameRequiredDescriptionDefault
aclNoAccepted as a no-op S3 compatibility hint; B2 bucket policy is unchanged.
keyYesThe object key (file path within the bucket).
bucketYesThe destination bucket name.
contentNoBase64-encoded content to upload.
filePathNoAbsolute local path to the file to upload.
metadataNoCustom metadata key-value pairs.
contentTypeNoMIME type of the object.
storageClassNoAccepted as a no-op S3 compatibility hint; B2 storage class is unchanged.
serverSideEncryptionNoServer-side encryption. B2 supports SSE-B2 (AES256) only — not SSE-KMS.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only status, idempotency, and destructiveness. The description adds useful behavioral context beyond annotations: the 1 MiB size limit, the inline nature of the upload, and the fact that presigned URLs keep bytes from passing through the server. It does not detail overwrite/versioning behavior, but the annotations lower the burden here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three compact sentences with no filler. The purpose and size constraint are front-loaded, followed by parameter options and routing to alternatives. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given high schema coverage, present annotations, and no output schema, the description covers the core decision space well: size threshold, inline vs. presigned, and multipart alternative. It could be slightly more explicit that content or filePath must actually be supplied despite only bucket and key being marked required in the schema, but the imperative 'Provide base64-encoded content or a local file path' substantially mitigates that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters. The description adds marginal value by clarifying that content is base64-encoded and that either base64 content or a local file path can be provided, but it does not need to compensate for missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Upload'), a specific resource ('a SMALL object inline (≤1 MiB) to a B2 bucket'), and the intended use cases ('manifests, sidecars, and tiny configs'). It distinguishes this tool from s3_get_presigned_url and multipart upload tools, so an agent can tell them apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (SMALL inline objects ≤1 MiB) and when not to ('For real object data, generate a PutObject URL... or use the multipart tools for large objects'). It names the specific alternative tools and the condition that selects between them, leaving little to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

s3_upload_part_copyA
Idempotent

Copy a part from an existing B2 object into an in-progress S3-compatible multipart upload. Use this to efficiently assemble large objects from existing parts without re-uploading data.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesThe destination object key.
bucketYesThe destination bucket name.
uploadIdYesThe UploadId from s3_create_multipart_upload.
copySourceYesThe source object in 'bucket/key' format, e.g. 'my-bucket/path/to/file.dat'. URL-encode special characters in the key.
partNumberYesThe part number (1–10000).
copySourceRangeNoByte range to copy from the source, e.g. 'bytes=0-104857599' for the first 100MB.
copySourceVersionIdNoVersion ID of the source object to copy from.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false, idempotentHint=true, and destructiveHint=false, so the safety profile is established. The description adds contextual detail about assembling large objects without re-uploading, but does not disclose additional behavioral specifics such as failure modes, authentication requirements, or source-destination constraints. It neither contradicts nor substantially enriches the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The action is front-loaded and the use-case rationale follows immediately. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description and schema together are sufficient for invoking the tool, but since there is no output schema, the description does not explain what the response contains (e.g., the part ETag needed to complete the multipart upload). It also does not explicitly sequence the upload workflow, though uploadId referencing s3_create_multipart_upload implies it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter already has meaningful documentation. The tool description itself adds no parameter-level semantics beyond the schema, which puts this at the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Copy') and resource ('a part from an existing B2 object into an in-progress S3-compatible multipart upload'). This clearly distinguishes it from related siblings like s3_copy_object (whole object copy) and s3_put_object (new data upload).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second sentence tells the user when to use this tool: to efficiently assemble large objects from existing parts without re-uploading data. It provides clear context for the multipart upload workflow, though it does not explicitly name alternative tools or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.7/5.0
Disambiguation3/5

Most tools target a distinct resource and action, but there is notable overlap between native B2 and S3-compatible surfaces (e.g., b2_update_bucket and s3_put_bucket_lifecycle, b2_unfinished_uploads and s3_list_multipart_uploads). Detailed descriptions help, but an agent could reasonably confuse the intended tool in several cases.

Naming Consistency4/5

The b2_ and s3_ prefixes establish a clear pattern, and most tools follow verb_noun naming. Minor deviations include analytic tools like b2_largest_files, b2_egress_leaders, and b2_usage_growth that use noun-style names, plus s3_presign_upload_part versus s3_get_presigned_url.

Tool Count2/5

Forty tools is a heavy surface, well beyond the 25-tool threshold where a tool set becomes difficult to navigate. The breadth is justified by dual B2/S3 APIs and partner/analytics features, but the count still imposes significant cognitive load and redundancy.

Completeness4/5

The set covers bucket CRUD, object operations, multipart uploads, presigned URLs, lifecycle, notifications, keys, retention/legal hold, partner group management, and usage analytics. Minor gaps exist—such as no explicit create/update/delete for groups and only a put for S3 lifecycle—but the workflows are largely complete.

Maintenance

ActivityActive
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server that provides a bridge between MCP-compatible clients and MinIO object storage. It exposes MinIO operations as MCP tools for seamless bucket management and object operations.
    4
  • A
    license
    Not graded
    quality
    A
    maintenance
    Lightweight object storage with S3, HTTP, and MCP interfaces, enabling AI agents to store and retrieve files via structured tool definitions.
    4
    Do What The F*ck You Want To Public
  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server for AWS S3 and compatible object stores, enabling LLM clients to browse buckets and fetch objects.
    MIT No Attribution

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/backblaze-labs/b2-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server