Backblaze B2 MCP Server
OfficialProvides tools for interacting with Backblaze B2 Cloud Storage, enabling management of buckets, files, application keys, Object Lock, event notifications, lifecycle, and S3-compatible storage operations.
Backblaze B2 MCP Server
A Model Context Protocol server for Backblaze B2 Cloud Storage. It lets any MCP-compatible AI client (Claude, and others) operate B2 through a focused, safe set of tools, currently incubating in Backblaze-Labs.
This is the official Backblaze B2 MCP server —
backblaze-labs/b2-mcp, published as@backblaze-labs/b2-mcpon npm and listed in the Official MCP Registry asio.github.backblaze-labs/b2-mcp. Community forks and third-party wrappers are not maintained by Backblaze.
40 tools, assigned by backing category:
Native B2 SDK (
@backblaze-labs/b2-sdk) (17) — B2 control-plane operations the S3 API has no equivalent for: buckets, application keys, Object Lock, event notifications, and Partner/Groups operations.AWS S3 SDK (
@aws-sdk/client-s3) (19) — the S3-compatible data plane: object upload/download/copy/list/delete, multipart, bucket reachability, lifecycle, and presigned URL paths.Neither SDK (custom MCP code) (4) — repository-owned analytics over B2 reports and bounded live listings: storage growth, egress leaders, largest files, and abandoned uploads.
Availability is a per-tool annotation, separate from those backing categories: durable-secret-producing tools are sink-backed for local stdio runs and remain non-secret unavailable stubs on HTTP/serverless unless an explicit sink is configured.
Destructive actions are gated, durable B2 secrets stay out of the model's context in the default/file/off modes, and the unsafe B2_SECRET_SINK=inline escape hatch is explicit. The tool surface is deliberately lean (registration is capability-aware, so a key only ever sees tools it can use).
Quick start
Prerequisites: A supported Node.js runtime (22.22.2+, or 24 / 26) and a Backblaze B2 application key. A non-master key is all you need. The package engine range is ^22.22.2 || ^24 || ^26; CI runs on Node.js 22.23.1, 24, and 26.
The canonical package name is @backblaze-labs/b2-mcp and the canonical binary is b2-mcp (b2-mcp-server is a transition alias). The fastest setup runs it with npx, no clone or build.
S3-compatible and report tools derive their endpoint region from the authorized B2 account response. B2_REGION is only a fallback/default for paths that need a region before authorization, or when authorization is temporarily unavailable.
Connect Claude Desktop by editing its config file — claude_desktop_config.json, located per OS:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.jsonLinux:
~/.config/Claude/claude_desktop_config.json
{
"mcpServers": {
"backblaze-b2": {
"command": "npx",
"args": ["-y", "@backblaze-labs/b2-mcp"],
"env": {
"B2_APPLICATION_KEY_ID": "your-application-key-id",
"B2_APPLICATION_KEY": "your-application-key-secret"
}
}
}
}If you need an explicit fallback region before authorization, include B2_REGION in the same env block before restarting Claude Desktop:
{
"B2_APPLICATION_KEY_ID": "your-application-key-id",
"B2_APPLICATION_KEY": "your-application-key-secret",
"B2_REGION": "us-east-005"
}Restart Claude Desktop and the B2 tools appear. To persist local stdio logs from clients that do not expose child-process stderr, add "B2_LOG_FILE" to the same env block, set to an OS-appropriate absolute path (for example /var/log/b2-mcp.log on macOS/Linux or C:\\logs\\b2-mcp.log on Windows).
One non-master application key covers normal storage work: B2 native, S3, and key management. SDK-backed Partner/Groups tools require
B2_MASTER_KEY_ID/B2_MASTER_KEYon an account authorized for the Partner API. B2's S3 endpoint rejects master keys, which is why the application key remains the primary credential. See Configuration for the full list.Why your client may show fewer than 40 tools: registration is capability-aware, so a client only sees the tools its key can actually use. With a non-master key and no master key configured, the three Partner/Groups tools that require a master key (
b2_list_groups,b2_list_group_members,b2_eject_group_member) are not surfaced, sotools/listreports 37. AddB2_MASTER_KEY_ID/B2_MASTER_KEYon a Partner-entitled account to get the full 40. A read-only key trims the surface further, and durable-secret tools appear as non-secret "unavailable" stubs unless a secret sink is configured. This is expected, not a missing-install problem.
Other clients:
docs/CLIENTS.mdhas copy-paste setup for Cursor, VS Code, Cline, Windsurf, Zed, Continue, Goose, Claude.ai, and hosted (Streamable HTTP), plus a compatibility matrix.
git clone https://github.com/backblaze-labs/b2-mcp.git b2-mcp
cd b2-mcp
corepack enable pnpm
corepack prepare 'pnpm@11.20.0+sha256.34e198cb1e43237517ecedfd31f9ae26a6c0a3e5366ce58a2d05f4b21fb5f19a' --activate
pnpm install --frozen-lockfile
pnpm run build # produces dist/, required before first runThen set "command": "node" and "args": ["/ABSOLUTE/PATH/TO/b2-mcp/dist/index.js"] (or use the installed b2-mcp binary) in the config above.
Then just ask:
"List the buckets this key can access." · "Upload
./data.csvtoreports/may-2026.csv." · "Give me a 1-hour download link forbackups/latest.tar.gz." · "List files underlogs/2026/."
Local stdio runs can create application keys through the sink-backed tools; the
new key secret is written to ~/.b2-mcp/secrets.jsonl by default and is not
shown in the MCP response on POSIX platforms. Windows currently rejects file
sink paths because this implementation does not enforce owner-only ACLs there,
so use B2_SECRET_SINK=off or explicit local inline mode on Windows. For
hosted HTTP deployments, create and rotate keys outside the MCP flow unless you
have deliberately configured a reviewed secret sink.
Related MCP server: MinIO MCP Server
B2 Skills pack
This repo bundles a client-side Backblaze B2 skills pack under skills/ (manifest: skills/pack.json).
The MCP server is the action layer; these Markdown playbooks are the expertise
layer for common workflows: backup/restore, least-privilege keys, Object Lock,
lifecycle and cost hygiene, migration, and incident response.
The pack is optional but recommended for clients that support Markdown skills.
Each skill keeps bulk object bytes off the model and MCP server, uses
presigned/direct transfer paths for data movement, and pauses before destructive
or irreversible steps that are also gated by B2_DESTRUCTIVE_POLICY.
Validate the pack locally. The Node validator is a structural guard for the
declared pack, tool references, byte-path rules, and per-tool destructive gates;
it is not a content-safety proof, so skills/** changes require CODEOWNERS
review before publish. Each skill repeats the byte-path guardrails intentionally
so standalone client imports keep the no-model/no-server object-byte rule.
pnpm run validate:skillsLoad the pack in supported clients:
Claude Code: put each
skills/b2-*/directory under~/.claude/skills/or the client-supported project skills directory, then restart the session.Claude.ai / Claude Desktop with Skills: create ZIP archives for the desired
skills/b2-*/directories, with eachSKILL.mdat the ZIP root, then open Settings -> Capabilities -> Skills and upload those ZIP files.Other MCP clients with Markdown skills: register each
skills/b2-*/SKILL.mdfile or containing directory according to that client's skills documentation.
The skills do not add server endpoints or new permissions. They only sequence the existing B2 MCP tools and reinforce the same byte-path and destructive-action guardrails enforced by the server.
Docker quick start
The published image defaults to the HTTP transport, reads configuration only
from environment variables, and does not publish a mutable latest tag. Choose
the version tag that matches the package release. Cosign signatures are published
to a sibling GHCR repository so the package page's default pull command stays on
a runnable image tag:
B2_MCP_VERSION=VERSION # replace with the release version you want
B2_MCP_IMAGE="ghcr.io/backblaze-labs/b2-mcp:${B2_MCP_VERSION}"
docker run --rm --name b2-mcp \
--stop-timeout 20 \
-p 127.0.0.1:3000:3000 \
-e B2_HTTP_CREDENTIAL_MODE=server \
-e B2_APPLICATION_KEY_ID=your-application-key-id \
-e B2_APPLICATION_KEY=your-application-key-secret \
-e B2_ALLOWED_HOSTS=localhost,127.0.0.1 \
-e B2_DESTRUCTIVE_POLICY=block \
-e B2_REGISTER_ALL_TOOLS=false \
-e B2_SECRET_SINK=off \
-e B2_ALLOW_INLINE_SECRETS=false \
-e B2_ALLOW_LOCAL_FILES=false \
"$B2_MCP_IMAGE"For stdio clients inside a container, pass the transport explicitly and keep stdin open:
B2_MCP_VERSION=VERSION # replace with the release version you want
B2_MCP_IMAGE="ghcr.io/backblaze-labs/b2-mcp:${B2_MCP_VERSION}"
docker run --rm -i \
--no-healthcheck \
-e B2_APPLICATION_KEY_ID=your-application-key-id \
-e B2_APPLICATION_KEY=your-application-key-secret \
"$B2_MCP_IMAGE" stdioSee deploy/customer-hosted/README.md for
hardened HTTP examples with signature verification, B2_ALLOWED_ORIGINS, rate
limits, and in-flight request caps. The deployment index is
docs/DEPLOY.md, and the OAuth-secured Vercel adapter
runbook is deploy/vercel. Direct deployment guides
are available for
Vercel,
Cloudflare Workers,
Cloudflare Containers,
Docker/OCI,
Google Cloud Run,
AWS ECS Fargate,
Azure Container Apps,
Render,
Railway, and
Fly.io. All hosted paths share the
security and credential contract.
The image healthcheck applies to HTTP mode. For stdio containers, pass
--no-healthcheck. For HTTP containers, set the listen port through PORT so
the healthcheck probes the same port the server binds.
Configuration
Variable | Required | Default | Description |
| stdio / HTTP | — | Application key ID (non-master) — the workhorse for native B2 and S3-compatible tools |
| stdio / HTTP | — | Application key secret |
| — | falls back to app key | Master credential for SDK-backed Partner/Groups tools; required with Partner API entitlement for those operations |
| — |
| Fallback/default S3-compatible endpoint region; authorized B2 responses override this for S3/report tools |
| — | — | Optional operator token appended after the built-in |
| — |
| LLM-facing |
| — |
| CLI default transport when no |
| HTTP only | Node listen default | Standalone Node HTTP listen host; set to |
| — | stderr | Optional path for redacted structured JSON logs. When set, the file replaces stderr; stdout is never used for logs |
| — | stdio: | Durable-secret output mode: |
|
|
| Append-only plaintext JSONL credential ledger for file sink mode. HTTP/serverless file mode requires this explicit absolute path and |
| HTTP inline only |
| Dedicated HTTP/serverless opt-in required before |
| — | deprecated | Legacy alias retained for compatibility; S3 tools use the authorized |
| HTTP only |
|
|
| HTTP | — | JSON map from verified MCP principal to a customer-managed credential reference |
| HTTP | — | Env-backed secret-broker material for the mapped reference |
Every outbound B2 API call (native B2 SDK and the S3-compatible data plane) carries
a b2-mcp product token on its User-Agent so the traffic is attributable to this
server. A published release emits b2-mcp/<version> (for example b2-mcp/0.1.2);
a source checkout, CI, or a dev/prerelease build emits b2-mcp/dev. B2_MCP_UA_SUFFIX
appends an optional operator token after that built-in product token and does not
replace it.
S3-compatible and report tools use the s3ApiUrl returned by b2_authorize_account when a tool call authorizes; setting B2_REGION does not override that authorized region. On a cold authorization cache, the first S3/report call attempts B2 authorization to learn the authoritative region. That wait is bounded, and if authorization is temporarily unavailable, S3 tools fall back to the B2_REGION endpoint for that operation so the S3 data plane can still be attempted with the configured default. Once authorization succeeds, the derived S3 endpoint is cached for the server process lifetime; restart the process to pick up a later account-region migration. Authorized S3 endpoints remain restricted to HTTPS s3.<region>.backblazeb2.com hosts with no credentials, custom port, path, query, or fragment.
Security / policy (safe defaults; override as needed):
Variable | Default | Description |
| stdio: | Gate on destructive tools: |
|
| Set to |
| — | Optional maximum for |
|
| Explicitly allow |
|
| Explicitly allow |
| none | HTTP transport: Host/Origin allowlists (DNS-rebinding protection) — set these for any internet-facing HTTP deployment |
|
| Standalone Node HTTP transport request timeout and headers timeout |
|
| HTTP transport: trust |
|
| HTTP transport: per-credential request throttling |
|
| HTTP transport: global and per-credential concurrent in-flight request caps |
|
| Stdio bootstrap capability-discovery deadline; local expiry starts with a fail-closed tool surface |
|
| Bounded capability-discovery cache TTL and size. Cache identity is secret-bound; log labels are non-secret fingerprints |
|
| Idle timeout while streaming |
A ready-to-copy .env.example lists the local environment
variables, and deploy/customer-hosted/b2-mcp.env.example
lists the hosted container baseline. HTTP-only file-access vars
(B2_ALLOW_LOCAL_FILES, B2_FILE_ROOT) are covered in docs/DEPLOY.md.
Logging
b2-mcp emits one structured JSON log object per line. Logs default to stderr so the stdio transport's stdout channel stays reserved for MCP protocol frames.
Set B2_LOG_FILE=/absolute/path/to/b2-mcp.log to append those same redacted JSON
lines to a file instead of stderr. The path must be absolute. The file is created
with owner-only permissions when it does not exist; its parent directory must
already exist and be writable. Existing log files must be regular files, must
not be symlinks or hard links, and must be owned by the current user. Owned
pre-existing files are tightened to owner-only permissions at startup. A bad
path fails at startup with a clear B2_LOG_FILE error. Runtime write failures
are reported to stderr, and subsequent structured log lines fall back to stderr.
B2_LOG_FILE is currently supported only on POSIX platforms; Windows startup
fails clearly because this implementation does not enforce owner-only ACLs.
File logging does not mirror to stderr by default. Because B2_LOG_FILE is an
append-only file sink with no built-in rotation or retention, use
operator-managed rotation before enabling it for a long-running process. Do not
enable it on an internet-facing HTTP transport unless the host has a size and
retention policy and a log shipper tails the file directly. For external
logrotate, use rename/create rotation and send SIGHUP to the b2-mcp process
after rotation so the file destination is reopened. Copytruncate is not
recommended.
Package API Surface
The npm package intentionally supports only the root CommonJS entry
(require("@backblaze-labs/b2-mcp")), which exposes
startStdio(): Promise<void>, plus ./package.json for metadata. TypeScript
consumers may compile against that same root CommonJS surface:
import b2Mcp = require("@backblaze-labs/b2-mcp");
const start: () => Promise<void> = b2Mcp.startStdio;Programmatic TypeScript imports beyond that root entry are not a supported
public API. The supported form is the CommonJS import = require interop shown
above; ESM named imports such as import { startStdio } from "@backblaze-labs/b2-mcp" are not part of the contract. Deep imports such as
@backblaze-labs/b2-mcp/dist/server.js are private implementation details and
are closed by the package exports map. Use the CLI/bin entry or the root
startStdio export instead.
CLI Reference
The source entry point and installed package binary share the same CLI:
Usage: b2-mcp [stdio|http] [options]
Options:
--transport <stdio|http> Transport to serve (default: B2_MCP_TRANSPORT or stdio)
--port <port> HTTP listen port (default: PORT or 3000)
--host <host> HTTP listen host (default: Node listen default)
--version Print the package version
--help Show this helpExamples:
b2-mcp --transport stdio # or: npx -y @backblaze-labs/b2-mcp --transport stdio
b2-mcp http --host 127.0.0.1 --port 3000
node dist/index.js http --host 127.0.0.1 --port 3000 # equivalent from a source checkoutTool result text format
MCP transport messages always remain JSON-RPC JSON. Structured successful tool
results carry the lossless sanitized value in structuredContent, and the
single LLM-facing text block in content[0].text is selected by
B2_MCP_OUTPUT_FORMAT.
json(default): compact JSON text for clients that parse text content.toon: opt-in TOON text using the repo-owned encoder for TOON spec4.1.
Errors, validation failures, and concise one-line status messages stay plain
text. TextContent has no media-type field, so the server advertises the
selected text format in instructions instead of per-result prefixes or protocol
extensions.
Example b2_list_buckets text in default compact JSON mode:
{"accountId":"account-123","buckets":[{"bucketId":"bucket-a","bucketName":"logs-2026","bucketType":"allPrivate"},{"bucketId":"bucket-b","bucketName":"public-assets","bucketType":"allPublic"}],"bucket_count":2,"total_bucket_count":2}The same structured result with B2_MCP_OUTPUT_FORMAT=toon:
accountId: account-123
buckets[2]{bucketId,bucketName,bucketType}:
bucket-a,logs-2026,allPrivate
bucket-b,public-assets,allPublic
bucket_count: 2
total_bucket_count: 2The canonical structuredContent value is identical in both modes.
Rollout note: TextContent has no media-type field. Keep the default json
for rolling deployments and text-parsing clients. Opt into TOON only after
clients prefer structuredContent or explicitly support TOON; otherwise a fleet
with mixed B2_MCP_OUTPUT_FORMAT values can return either text shape.
Tools
The server exposes 40 tools (registration is capability-aware, so a given key sees only the subset it can use).
Native B2 SDK (17):
b2_authorize_account— Verify credentials and return account infob2_list_buckets— List buckets (optional filters)b2_create_bucket— Create a bucketb2_delete_bucket— Delete an empty bucketb2_update_bucket— Update type, CORS, lifecycle, encryption, replication, Object Lockb2_get_bucket_notification_rules— Get webhook notification rulesb2_set_bucket_notification_rules— Set webhook notification rulesb2_list_keys— List application keysb2_delete_key— Delete an application keyb2_create_key— Create an application key (one-time secret written to the configured sink)b2_update_file_legal_hold— Set/clear legal hold on an objectb2_update_file_retention— Set/clear retention on an objectb2_list_groups— List partner groups (Partner API credential)b2_eject_group_member— Remove a member from a partner group (Partner API credential)b2_list_group_members— List group members (Partner API credential)b2_create_group_member— Create a Partner group member (Partner API credential)b2_reserve_trial_create_account— Reserve a trial account (Partner API credential)
AWS S3 SDK — data plane (19):
s3_put_object— Inline upload of a small (≤1 MiB) control-plane objects3_get_object— Inline download of a small (≤1 MiB) control-plane objects3_delete_object— Delete an objects3_delete_objects— Bulk-delete objectss3_head_object— Object metadatas3_copy_object— Server-side copys3_list_objects_v2— List objectss3_list_object_versions— List object versionss3_create_multipart_upload— Begin a multipart uploads3_presign_upload_part— Mint a presigned PUT URL for a parts3_complete_multipart_upload— Finish a multipart uploads3_abort_multipart_upload— Abort a multipart uploads3_list_parts— List uploaded partss3_list_multipart_uploads— List in-progress multipart uploadss3_upload_part_copy— Server-side copy of a parts3_get_presigned_url— Short-lived presigned PUT/GET bearer URLs3_head_bucket— Check a bucket is reachable on the S3 endpoints3_get_bucket_location— Bucket region / location constraints3_put_bucket_lifecycle— Set S3 lifecycle rules
Custom MCP analytics (4):
b2_usage_growth— Rank accounts by stored-data growth between two datesb2_egress_leaders— Top egress by account or bucket over a periodb2_largest_files— A bucket's largest objects via bounded live listingb2_unfinished_uploads— Abandoned multipart uploads consuming storage
For availability nuances, the destructive-gate list, and durable-secret handling, see the detailed reference below.
Tool details and availability
40 total — 17 Native B2 SDK + 19 AWS S3 SDK + 4 Neither SDK/custom MCP tools. Prefix counts remain 21 native b2_* names + 19 data-plane s3_* names. Availability is orthogonal to backing: b2_create_key and b2_create_group_member are available when B2_SECRET_SINK=file or inline; b2_reserve_trial_create_account is available only with explicit inline mode because Reserve Trial has no provider-side recovery path after a file sink write failure. These names are non-secret compatibility stubs when unavailable. The inherited s3_* aliases use the AWS S3 SDK against B2's S3-compatible endpoint, with configuration derived from the official B2 SDK /s3 helper. Under stdio's default confirm policy, fifteen destructive, durable-secret-producing, or protection-weakening tool names require confirm: true or MCP form elicitation before execution: the explicit deletes (s3_delete_object, s3_delete_objects, s3_abort_multipart_upload, b2_delete_bucket, b2_delete_key), durable key creation (b2_create_key), PutObject presigning (s3_get_presigned_url with operation: "PutObject"), Partner group membership changes (b2_eject_group_member, b2_create_group_member), trial-account reservation (b2_reserve_trial_create_account), persistent outbound webhook replacement (b2_set_bucket_notification_rules), and the protection-removal or copy/delete policy paths (b2_update_file_retention when clearing/bypassing, b2_update_file_legal_hold when set off, b2_update_bucket when it makes a bucket public or weakens Object Lock/lifecycle/replication, and s3_put_bucket_lifecycle when a rule schedules deletion). HTTP defaults to block, so the same calls are refused unless the operator explicitly selects confirm or allow.
Tool | Availability | Description |
| Available | Verify credentials and return account info |
| Available | List buckets (optional filters) |
| Available | Create a bucket |
| Available | Delete an empty bucket |
| Available | Update type, CORS, lifecycle, encryption, replication, Object Lock |
| Available | Get webhook notification rules |
| Available | Set webhook notification rules |
| Available | List application keys |
| Available | Delete an application key |
| Sink-backed; HTTP default stub | Create an application key; file mode writes the one-time secret out of band |
| Available | Set/clear legal hold on an object |
| Available | Set/clear retention on an object |
| Available with Partner API credential | List partner groups through the official B2 SDK |
| Available with Partner API credential | Remove a member from a partner group through the official B2 SDK |
| Available with Partner API credential | List group members through the official B2 SDK |
| Sink-backed with Partner credential | Create a Partner group member; file mode writes the one-time secret out of band |
| Inline only with Partner credential | Reserve a trial account; file mode is unavailable because no provider-side recovery exists |
Durable-secret-producing operations split their result: the one-time
applicationKey is written to the configured sink, while MCP output returns
redacted metadata plus a secretSink pointer. Each request must include an
idempotencyKey; retrying the same key with identical input returns the
original sink pointer without creating a second credential or account. On POSIX
platforms, stdio defaults to file at ~/.b2-mcp/secrets.jsonl. Windows
rejects file sink paths because owner-only ACLs are not enforced by this
implementation; configure B2_SECRET_SINK=off or explicit local inline mode
there. HTTP/serverless defaults to off; enabling file there requires both
B2_ALLOW_LOCAL_FILES=true and an explicit B2_SECRET_SINK_FILE.
B2_SECRET_SINK=inline is an unsafe explicit opt-in that returns the secret
into MCP output with a warning; HTTP/serverless also requires
B2_ALLOW_INLINE_SECRETS=true. File sink records use stable JSONL
metadata fields (ts, tool, recordId) plus idempotency metadata and a
result payload. File mode also writes non-secret sidecar idempotency markers,
plus <B2_SECRET_SINK_FILE>.idempotency.jsonl as an audit trail, so retry
history survives when the plaintext ledger is rotated or vaulted. The ledger has
no built-in rotation or pruning, so operators must rotate, prune, vault, or
delete it under the same credential-retention policy used for live B2 keys while
retaining the sidecars for the deployment's retry window. The SDK-backed
Partner/Groups tools remain available only when a distinct master key is
configured and the account is authorized for the Partner API.
Tool | Availability | Description |
| Available | Inline upload / download of small (<=1 MiB) control-plane objects; bulk data uses a presigned URL |
| Available | Delete one / bulk-delete objects |
| Available | Object metadata |
| Available | Server-side copy; |
| Available | List objects / versions |
| Available | Multipart upload flow (large files); parts use short-lived presigned bearer URLs |
| Available | Manage multipart uploads |
| Available | Server-side copy of a part |
| Available | Short-lived presigned PUT/GET bearer URL (browser/CORS handoff) |
| Available | Check bucket exists/reachable on the S3 endpoint |
| Available | Bucket region / location constraint |
| Available | Lifecycle rules incl. |
Tool | Availability | Description |
| Available | Rank accounts by stored-data growth between two dates (daily usage reports; requires Usage Reports) |
| Available | Top egress by account or bucket over a period (daily usage reports; requires Usage Reports) |
| Available | A bucket's largest objects via live listing (bounded scan) |
| Available | Abandoned multipart uploads silently consuming storage (bounded live listing) |
Scope follows the caller's key — a partner key sees its sub-accounts; a customer key sees only itself. The usage-report tools feature-detect the b2-reports-<accountId> bucket and return a clear "not enabled" message when Usage Reports aren't enabled on the account.
Security & self-hosting
Built-in safeguards (on by default): destructive-action gating (B2_DESTRUCTIVE_POLICY), MCP form elicitation for destructive tools on clients that advertise it for the 2026 protocol, sink-backed durable-secret creation for local stdio with hosted HTTP fail-closed defaults, central recursive response sanitization, explicit credential-provider modes, capability-aware tool registration that fails closed, rate limiting, and a values-redacted audit log (non-secret credential fingerprints only — never secrets, values, or file contents). The server never phones home.
Destructive actions have two layers. B2_DESTRUCTIVE_POLICY=block is the hard refusal and remains the required wall for internet-facing or untrusted-client HTTP deployments. Under confirm, capable 2026 MCP clients are asked for form elicitation first; clients without compatible elicitation, or servers with B2_DESTRUCTIVE_ELICITATION=off, fall back to the existing confirm: true retry. elicit is the stricter middle ground between confirm and block: it requires an accepted MCP form-elicitation response from a form-capable client and refuses (rather than falling back to a model confirm: true) whenever no such response can be obtained, for deployments that want human-in-the-loop friction on every destructive action without giving up the operation entirely. Because the response is relayed by the client, this is friction, not an independent authorization boundary. Under allow, both the confirm gate and elicitation are skipped for trusted single-user sessions. Elicitation responses are relayed by the MCP client, so they are useful human-in-the-loop friction but not an independent security boundary against a malicious or compromised internet-facing client.
Rollout note: elicitation changes compatible 2026 confirm clients from a one-request confirm: true flow to a two-request flow carrying server-minted requestState. Deploy all HTTP replicas with the same credentials and config. During an expand/contract rollout, an elicitation follow-up routed to a pre-elicitation pod fails safe with the old confirmation refusal; it does not execute an unapproved destructive operation.
Running it safely:
Use a supported deployment for hosted HTTP —
deploy/customer-hostedcontains the portable container, compose, and nginx/OAuth edge example.deploy/vercelcontains the OAuth-secured Vercel runtime adapter. The deployment index links the current provider guides:Vercel,Cloudflare Workers,Cloudflare Containers,Docker/OCI,Google Cloud Run,AWS ECS Fargate,Azure Container Apps,Render,Railway,Fly.io, andshared security.Use a least-privilege key — a non-master key is correct for normal storage operations. Local stdio can create scoped keys through the file sink; hosted HTTP deployments should create and rotate keys outside the MCP tool flow unless the file sink has been explicitly configured and reviewed.
b2_create_keyrefuses key-management grants, unscoped write/delete grants, and over-long or non-expiring keys unless the corresponding policy override is set.Presigned URLs are different from durable secrets —
s3_get_presigned_urlands3_presign_upload_partreturn short-lived bearer capabilities withexpiresIn/expiresAt. Treat the URL as sensitive until expiry, but it is not a long-lived B2 application key.Local use → stdio (the Quick Start above). Credentials stay in your client config / environment.
Exposing HTTP → choose a credential mode. Unset mode remains
headersfor one-release compatibility with existing header clients; B2 credential headers must be present on every MCP request. SetB2_HTTP_CREDENTIAL_MODE=serverto keep one B2 credential in the server process/customer secret manager, orprincipalto map verified MCPauthInfoto customer-held credentials.Caller auth stays at your edge. For
principalmode, terminate TLS and validate OAuth before the SDK handler receivesauthInfo; strip any trusted identity headers at the edge and only re-add them inside an allowlisted proxy boundary.MCP SDK v2 packages are pinned. HTTP and stdio use the official
@modelcontextprotocol/serverv2 package fromgithub.com/modelcontextprotocol/typescript-sdk; opt-in TOON output uses a reviewed repo-owned encoder for spec4.1, with@toon-format/toon@4.1.1retained only as a dev/test decoder oracle.Never commit credentials — use env vars / a secrets manager.
.env*is gitignored.
Full hosted runbook (nginx, Let's Encrypt, hardened systemd, fail2ban, monitoring, and a security baseline checklist): docs/DEPLOY.md.
Authentication, credential custody, OAuth metadata, and B2 credential-mode
details are documented in docs/AUTHENTICATION.md.
Development
pnpm run build # clean + compile to dist/
pnpm run typecheck # type-check src + tests (no emit)
pnpm test # typecheck, then fast unit tests
pnpm run test:contract # deterministic MCP/package/schema contracts
pnpm run test:protocol # modern + legacy MCP protocol behavior
pnpm run test:coverage # deterministic source-covering suites + coverage summary
pnpm run test:diagnostics # MaxListeners/open-handle warning diagnostics
pnpm run test:slow # deterministic high-cost tests, isolated from unit
pnpm run test:package # packed-package installation test
pnpm run verify # fast no-credential quality gate
pnpm run test:live:b2-integration # live B2 tests; requires B2_APPLICATION_KEY_ID / B2_APPLICATION_KEY
pnpm run test:live:b2-contract # live B2 request-shape checks; requires B2 credentials
pnpm run test:live:b2 # both protected live B2 suites
pnpm run evals # deterministic LLM eval harness; live provider cases skip by default
pnpm run evals:provider-comparison # opt-in Claude vs OpenAI comparison; requires provider keys and current dist/
pnpm start # stdio transport
pnpm run start:http --port 3000 # MCP 2026-07-28 HTTP transport
b2-mcp --help # installed package CLI help after publish/install
b2-mcp --transport http --port 3000 # installed package HTTP command after publish/install
pnpm run smoke:local # deterministic local MCP smoke; no endpoint or B2 credentials
pnpm run smoke:client # advisory SDK client smoke; requires existing dist/, no B2 calls
pnpm run smoke:inspector # advisory locked Inspector CLI smoke; requires existing dist/Compatible MCP Inspector release for isolated manual inspection:
@modelcontextprotocol/inspector@2.4.0, which requires Node.js 22.19.0 or
newer. Run it through pnpm run smoke:inspector so the command uses the
committed lockfile and a sanitized temporary environment.
Documentation
API reference — generated TypeDoc for the public
srcsurface, published to GitHub Pages frommaindocs/CLIENTS.md— per-client setup + compatibility matrixdocs/AUTHENTICATION.md— OAuth, credential custody, and auth boundarydocs/DEPLOY.md— deployment matrix and supported-host linksdocs/deployment/security-and-credentials.md— shared hosted security contractdocs/deployment/vercel.md,docs/deployment/cloudflare-workers.md,docs/deployment/cloudflare-containers.md,docs/deployment/docker.md,docs/deployment/google-cloud-run.md,docs/deployment/aws.md,docs/deployment/azure-container-apps.md,docs/deployment/render.md,docs/deployment/railway.md,docs/deployment/fly-io.md— provider deployment guidesdocs/PUBLIC_CONTRACTS.md— public document ownership and contract statusdocs/TOOL_CONTRACT.md— Phase 1 tool-contract policydocs/TOOL_PROFILES.md— generated tool-profile referencedocs/TESTING.md— deterministic and live-test gate skeletondocs/EVALS.md— LLM eval local and CI runbookdocs/SECURITY_REVIEW.md— pre-public security and provenance review checklistdocs/DISCOVERABILITY.md— registry/directory listings runbook (Glama, Smithery, LobeHub, mcp.so) and per-release stepsRELEASE.md— release process and[Unreleased]disciplineCHANGELOG.md— release notesSECURITY.md— reporting vulnerabilities
License
MIT — © 2026 Backblaze, Inc.
Available Tools
40 toolsb2_authorize_accountARead-onlyIdempotent
Authorize with B2 and return account info including accountId, apiUrl, and downloadUrl. The server handles authorization automatically, but this tool is useful for verifying credentials and retrieving account details.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states that the tool returns account info and lists the specific fields. It does not explicitly mention side effects, but the annotations indicate readOnlyHint and idempotentHint, which are consistent with a read operation. The behavior is generally transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of two sentences that convey the purpose and usage. It is focused and free of unnecessary detail, making it easy to read and understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is no output schema, the description adequately explains what the tool returns (accountId, apiUrl, downloadUrl). It also provides context on how authorization is handled. There is no missing essential information for an agent to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty ({}), so there are no parameters to describe. The description does not add any parameter information, but since there are none, this is fully appropriate. Schema coverage is 100% with no gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: authorize with B2 and return account info including accountId, apiUrl, and downloadUrl. It specifies the action and the output, leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance on when to use the tool: it notes that the server handles authorization automatically, but the tool is useful for verifying credentials and retrieving account details. It doesn't explicitly mention alternatives, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_create_bucketA
Create a new B2 bucket. Bucket names must be globally unique, 6-63 characters, and contain letters, digits, hyphens, and periods (names are not case-sensitive and cannot start with 'b2-').
| Name | Required | Description | Default |
|---|---|---|---|
| corsRules | No | CORS rules: <=100. allowedOrigins/allowedOperations require 1-100 non-empty strings; allowedHeaders/exposeHeaders allow <=100. Strings <=999 chars. Per-rule UTF-8 total <1,000. Names unique. | |
| bucketInfo | No | Custom metadata: <=10 pairs. Keys: 1-50 UTF-8 bytes, chars A-Z a-z 0-9 . _ ` ~ ! # $ % ^ & * ' | + -, no b2- prefix. Values total <=10,000 UTF-8 bytes. | |
| bucketName | Yes | The name for the new bucket. Must be globally unique. | |
| bucketType | Yes | allPublic allows unauthenticated downloads; allPrivate requires authorization. | |
| lifecycleRules | No | Lifecycle rules for automatic file management. | |
| fileLockEnabled | No | Enable Object Lock (file lock) on the bucket at creation. (Object Lock can also be enabled later on an existing bucket via b2_update_bucket.) Must be true before any retention or legal hold can be applied to files in this bucket. | |
| defaultServerSideEncryption | No | Default server-side encryption for new files in this bucket. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral context beyond what the annotations already convey: it creates a resource, is not read-only, and is not idempotent. It does not mention authorization requirements, side effects on failure, or what happens if the bucket name already exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with the primary action front-loaded. The remaining sentence earns its place by capturing important bucket-name constraints that an agent must know before calling.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a complex 7-parameter schema with nested objects and no output schema, the description is narrow. It fully covers bucket naming constraints, but omits usage context, required authorization, expected return value, and relationship to sibling bucket operations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful parameter nuance beyond the schema for bucketName by specifying global uniqueness, 6-63 characters, allowed characters, case-insensitivity, and the prohibition on a 'b2-' prefix.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Create a new B2 bucket.' This clearly separates it from siblings like b2_delete_bucket and b2_update_bucket, and the modifier 'new' removes ambiguity about the operation's intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives, no prerequisites, and no mention of related tools such as b2_authorize_account or b2_update_bucket. The intended use is only implied by the verb 'Create.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_create_group_memberADestructive
Create a Backblaze account for a new Partner group member. In file sink mode, the one-time application key secret is written to the configured out-of-band secret sink and the MCP response contains only redacted metadata plus a secretSink pointer. In inline mode, the secret is returned with an explicit warning.
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | Optional data region for the new account. | |
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| groupId | Yes | The Group ID that the new member will join. | |
| memberEmail | Yes | Email address for the new group member account. | |
| adminAccountId | Yes | The accountId of the Group admin. Must be authorized for the Partner API. | |
| idempotencyKey | Yes | Caller-generated idempotency key. Reuse the same value only when retrying the identical group-member creation request. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and non-read-only behavior. The description adds meaningful operational context by disclosing how the one-time application key secret is handled in each mode: file sink mode returns redacted metadata plus a secretSink pointer, while inline mode returns the secret with an explicit warning. This goes beyond the structured fields and helps the agent anticipate side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no padding. The primary purpose is front-loaded, and the follow-up sentence efficiently explains the two operational modes and their output implications. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given six parameters, full schema coverage, annotations, and no output schema, the description covers the crucial behavioral distinction between file-sink and inline modes and what the response will contain. It does not enumerate every possible response field or error case, but for this tool it is sufficiently complete for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters. The description adds semantic context about secret handling and modes but does not provide additional meaning for individual parameters beyond what the schema already states. A baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Create a Backblaze account for a new Partner group member.' It clearly identifies the action and the target, and is distinct from siblings like b2_eject_group_member or b2_list_group_members. The extra mode detail reinforces the purpose without obscuring it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the intended use clear: this is for onboarding a new Partner group member. It does not explicitly name alternatives or state when not to use the tool, but the context is unambiguous and the sibling set includes related but distinct operations, so an agent can infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_create_keyADestructive
Create a B2 application key. In file sink mode, the one-time key secret is written to the configured out-of-band secret sink and the MCP response contains only redacted metadata plus a secretSink pointer. In inline mode, the secret is returned with an explicit warning.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Confirm this durable credential creation. Required when the server destructive policy is 'confirm' (the default). | |
| keyName | Yes | Human-readable name for the new key. | |
| bucketId | No | Deprecated single-bucket restriction. Use bucketIds for new integrations; do not provide both. | |
| bucketIds | No | Optional bucket restrictions. Omit for account-wide access. | |
| namePrefix | No | Optional file-name prefix restriction for file capabilities. | |
| capabilities | Yes | B2 capabilities to grant to the new key. | |
| idempotencyKey | Yes | Caller-generated idempotency key. Reuse the same value only when retrying the identical durable-key creation request. | |
| validDurationInSeconds | No | Optional key lifetime in seconds. Omit for no expiration. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations: it explains how the secret is handled in file sink mode versus inline mode, and what the MCP response contains in each case. This is valuable because the tool is destructive and non-idempotent, and the secret-handling behavior is not obvious from annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core purpose. Each sentence adds value, particularly the mode-specific secret-handling details, though terms like 'file sink mode' and 'inline mode' are introduced without explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does a decent job explaining response contents, but it leaves ambiguity about how an agent determines which mode (file sink vs inline) is active. Required parameters like confirm and idempotencyKey are covered by the schema, so the main gap is the mode-selection context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all eight parameters. The tool description itself does not add parameter-level detail, matching the baseline score for a fully documented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Create a B2 application key.' This clearly distinguishes it from sibling tools like b2_delete_key and b2_list_keys, though it does not explicitly contrast against them in text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the tool name and first sentence: use when you need to create a B2 application key. However, there is no explicit guidance about when to prefer this over related key-management tools or any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_delete_bucketADestructiveIdempotent
Delete a B2 bucket. The bucket must be empty — all files and file versions must be deleted first.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| bucketId | Yes | The ID of the bucket to delete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the behavioral requirement that the bucket must be empty, which is a key runtime behavior. It doesn't repeat the destructive/idempotent hints already present in annotations, but the added empty-bucket condition goes beyond annotation info.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct and directly to the point, stating the action and one crucial precondition without any redundant wording. It effectively communicates the essential information in two short sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the operation and the presence of schema descriptions for parameters, the description adequately covers the core purpose and a key constraint. It doesn't explain return values, but no output schema exists, so that is not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description itself does not elaborate on parameters, but the schema descriptions cover 100% of the parameters (bucketId and confirm). Since schema coverage is high, a baseline of 3 applies, and the description adds no extra parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Delete' and the resource 'a B2 bucket', along with a necessary precondition. The verb and object are unambiguous, leaving no doubt about the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a critical usage condition: the bucket must be empty before deletion. While it doesn't explicitly compare with alternative tools, the condition is highly informative for correct usage in typical scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_delete_keyADestructiveIdempotent
Permanently delete a B2 application key. This action is irreversible. Any system using the deleted key will lose access immediately.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| applicationKeyId | Yes | The ID of the application key to delete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true; the description adds meaningful consequences: deletion is irreversible and access is lost immediately. This exceeds the structured safety flags with real-world impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with no filler; the core action and irreversibility are front-loaded, and the access-loss consequence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter destructive action, the essential facts (what happens, reversibility, immediate effect) are present. It lacks usage/alternative context, but schema and annotations fill most operational details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so applicationKeyId and confirm are already documented. The description adds no parameter-level information, which is acceptable given the schema baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Permanently delete a B2 application key'), and the irreversibility clarifies the scope. This clearly distinguishes it from sibling tools like b2_delete_bucket or b2_create_key.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to choose this tool over alternatives, nor any conditions under which deletion should be avoided. It implies the action but doesn't provide decision context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_egress_leadersARead-onlyIdempotent
Rank top egress (downloaded bytes) by account or bucket over a period — default month-to-date. For 'who's downloading the most', 'where is egress concentrated'. Returns leaders with each one's share of total egress, from the daily usage reports. Scope follows the caller's key. Needs Usage Reports enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| by | No | Rank by 'account' (default) or 'bucket'. | account |
| days | No | Rolling window in days (1–90). Omit for current month to date. | |
| limit | No | Leaders to return (15). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, non-destructive behavior, and the description adds substantial context beyond that: results are derived from daily usage reports, scope follows the caller's key, and Usage Reports must be enabled. This meaningfully prepares an agent for how the tool behaves in practice.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: the primary action and default are front-loaded, followed by use cases and then important operational constraints. Every sentence adds information needed for correct selection and invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with three optional parameters and no required fields, this description is complete: it covers what is ranked, the possible grouping, the default time window, the output concept (leaders with egress share), the data source, authorization scoping, and a prerequisite. An agent can confidently invoke and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds extra meaning by clarifying that 'account'/'bucket' maps to the 'by' parameter, that omitting 'days' means month-to-date, and that the result focuses on each leader's share of total egress. It does not discuss the limit parameter, but the schema already covers that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Rank top egress') with a clear resource (downloaded bytes by account or bucket) and time scope (default month-to-date). It explicitly names the use cases ('who's downloading the most', 'where is egress concentrated'), which clearly separates it from sibling tools like b2_largest_files and b2_usage_growth.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for when to use it: ranking egress leaders by account/bucket over a period, with a default month-to-date window. It also notes the prerequisite that Usage Reports must be enabled, but it does not explicitly state when not to use it or name alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_eject_group_memberADestructiveIdempotent
Eject a member from a Group. The account is NOT deleted — just removed (the member resets their password on next login). Optionally change their email on eject. Cannot be re-added via API (only the Group Management page).
| Name | Required | Description | Default |
|---|---|---|---|
| No | New email for the ejected account. If omitted, the existing email is kept. Must not already be a Backblaze account. | ||
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| groupId | Yes | The Group ID from which to eject the member. | |
| adminAccountId | Yes | The accountId of the Group admin. Must be authorized for the Partner API. | |
| memberAccountId | Yes | The accountId of the Group member to eject. Must be a member of the specified Group. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark destructiveHint true, but the description adds significant context: the account is not deleted, the member resets password on next login, and the action is irreversible via API. This goes beyond the annotation by clarifying what actually happens.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The purpose is front-loaded, followed by key constraints. Efficient and clearly structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the behavioral implications (account not deleted, password reset, irreversibility) and the option to change email. All parameters are documented in the schema. The description is sufficient for a destructive tool, though it could explicitly mention the confirm requirement (which is in the schema).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters are already well-documented. The description adds a note about optionally changing email, but this is also covered in the schema. Baseline of 3 is appropriate since the schema carries the semantic load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (eject) and resource (member from a Group), and distinguishes from siblings like b2_create_group_member and b2_list_group_members. It is specific and not a tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides useful context on the effect (account not deleted, password reset) and a restriction (cannot be re-added via API), giving clear guidance on when to use it. However, it does not explicitly compare to alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_get_bucket_notification_rulesARead-onlyIdempotent
Get the event notification rules (webhooks) configured for a B2 bucket.
| Name | Required | Description | Default |
|---|---|---|---|
| bucketId | Yes | The bucket ID to get notification rules for. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds the clarification that the rules are webhooks and are bucket-scoped, but does not describe return structure or edge cases like empty rule sets. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence states the action and object with no wasted words. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only getter with annotations carrying the safety profile and no output schema, the description is sufficient for an agent to invoke correctly. It clearly identifies what is being fetched, and the required bucketId is documented in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema's only parameter, bucketId, is fully described ('The bucket ID to get notification rules for.'), and schema description coverage is 100%. The description does not add parameter-level detail, but the schema carries the meaning, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Get' and names the resource 'event notification rules (webhooks) configured for a B2 bucket.' This clearly distinguishes it from the sibling b2_set_bucket_notification_rules, which writes rather than reads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus b2_set_bucket_notification_rules or other siblings. The read-only verbs and annotations imply retrieval, but the description does not state prerequisites, exclusions, or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_largest_filesARead-onlyIdempotent
List a bucket's largest objects by size via a live listing. For 'largest files', 'what's taking up space in '. Give the bucket by name or bucketId; optional path prefix. Sorting by size requires a full listing, so on very large buckets the scan is bounded by max_scan and a time budget — it then returns the largest among the objects scanned with truncated=true; pass a prefix to focus on a subtree for a complete ranking. Returns name, size, and upload time — never contents.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many of the largest files to return (default 10, max 100). | |
| bucket | Yes | Bucket name or bucketId to inspect. | |
| prefix | No | Optional path prefix, e.g. "checkpoints/". | |
| max_scan | No | Safety cap on objects scanned (default 50,000, max 500,000). Buckets with millions of files cannot be fully sorted by size in one live call; the scan stops at this cap (or a time budget) and returns truncated=true. Narrow with prefix for an exhaustive ranking of a subtree. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint=true annotation, the description discloses a live listing, bounded scan by max_scan and a time budget, and truncated=true. This materially shapes agent expectations about results being approximate on large buckets, and it explicitly states that file contents are never returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences front-load the purpose, then explain the important scanning caveat and return contents. Every sentence earns its place with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description helpfully states the return fields (name, size, upload time) and the truncated=true behavior. It doesn't discuss auth, error cases, or how it relates to b2_usage_growth, but for a read-only listing tool the essential information is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters with descriptions, and the tool description adds meaningful guidance for prefix and max_scan, explaining the full-listing requirement, truncation behavior, and subtree ranking. This adds value beyond the schema without needing to do more.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource ('List a bucket's largest objects by size') and clarifies that it returns metadata, never contents. It does not contrast itself with sibling tools like b2_usage_growth or b2_list_buckets, so an agent must infer differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context with natural-language triggers ('largest files', 'what's taking up space') and instructs using a prefix for a complete subtree ranking. It does not explicitly name alternatives or when not to use this tool, though the 'never contents' caveat helps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_list_bucketsARead-onlyIdempotent
List B2 buckets for the authorized account. Optionally filter by bucket ID, name, or type. When the key is bucket-scoped and no bucketId/bucketName filter is supplied, requests are automatically narrowed to the authorized bucket IDs. Returns bucket ID, name, type, CORS rules, and lifecycle rules for each bucket. Capped to limit buckets (default 100, max 1000) to keep the response small for accounts with many buckets; if more exist the result is truncated with total_bucket_count and a note — raise limit or filter to target specific buckets.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of buckets to return (default 100, max 1000). The B2 API returns every bucket in one response; this caps how many are surfaced to keep the payload and token cost bounded. If the account has more buckets than the limit, the result is truncated with total_bucket_count and a note — raise limit (up to 1000) or filter by bucketName / bucketId / bucketTypes. | |
| bucketId | No | Filter to a specific bucket by its ID | |
| bucketName | No | Filter to a specific bucket by its name | |
| bucketTypes | No | Filter by bucket types. Defaults to all types. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already provide readOnlyHint and openWorldHint, indicating a safe, non-destructive operation. The description adds valuable behavioral details beyond the annotations: it explicitly states that requests are automatically narrowed to authorized bucket IDs when bucket-scoped, that results are truncated if exceeding the limit, and it describes the return fields (ID, name, type, CORS rules, lifecycle rules). This enhances transparency beyond what the annotations alone convey, though it does not fully describe edge cases like error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately concise, but it is well-structured with two main sentences: one stating the core action and filters, another explaining the cap and truncation. It front-loads the primary purpose and includes necessary details without excessive verbosity. It could be slightly tightened (e.g., merging repeated 'filter' mentions), but it remains clear and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is no output schema, the description compensates by explicitly listing the returned fields (ID, name, type, CORS rules, lifecycle rules). It also covers important context such as the automatic authorization narrowing and the truncation behavior, which are essential for a user to understand the tool's behavior in a real-world B2 account scenario. The description is complete for the complexity of a simple list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for all four parameters with 100% coverage, including default values and enums for bucketTypes. The description reinforces these by explaining the purpose of the limit (to keep response small) and the consequence of exceeding it (truncation with a note). This adds semantic value, particularly around the limit parameter, going slightly beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists B2 buckets for the authorized account, using a specific verb ('List') and resource ('B2 buckets'). It distinguishes itself from other list tools by mentioning optional filters (by bucket ID, name, or type) and the automatic narrowing to authorized bucket IDs when bucket-scoped. This makes its purpose unambiguous and distinct from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use the tool: it is the primary listing operation, and it explains that the response is capped and how to handle truncation (raise the limit or add filters). While it does not explicitly mention alternative tools (e.g., b2_list_keys or s3_list_objects_v2), the context is clear enough for typical usage. It falls just short of explicit 'when-not-to-use' guidance, hence a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_list_group_membersARead-onlyIdempotent
List active (ACCEPTED) Group members for a specific Group. Returns up to 1,000 members per call; use nextEmail for pagination. Includes B2 storage stats per member.
| Name | Required | Description | Default |
|---|---|---|---|
| groupId | Yes | The groupId whose members to list. | |
| startEmail | No | Pagination cursor — the first member email to return. If no exact match, starts from the next email alphabetically. | |
| adminAccountId | Yes | The accountId of the Group admin. Must be authorized for the Partner API. | |
| maxMemberCount | No | Maximum number of members to return (1-1000). Defaults to 100. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds value by disclosing pagination limits (up to 1,000 per call), the use of nextEmail for continuation, and that storage stats per member are included. These details go beyond annotations and help the agent understand response volume and pagination flow. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The core purpose is front-loaded, followed by essential behavioral details (pagination limit and response content). Every word earns its place; it is compact and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list operation with no output schema, the description provides sufficient context: it defines the resource scope, pagination mechanism, and return content (members with storage stats). It does not enumerate member fields, but that is not essential for invocation. Combined with annotations covering safety, the description is complete enough for correct use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (all 4 parameters have descriptions). The description does not add new semantic meaning beyond the schema—it restates pagination and the 1,000 limit, which are already in parameter descriptions (maxMemberCount maximum and startEmail as cursor). With high schema coverage, baseline 3 is appropriate; no additional parameter context is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('List'), resource ('Group members'), and scope ('for a specific Group'). It also specifies the active (ACCEPTED) state, distinguishing it from siblings like b2_list_groups (lists groups) and b2_create_group_member (adds a member). The tool's purpose is unambiguous and clearly differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by stating it lists accepted members for a specific group, and mentions pagination behavior. However, it does not explicitly name alternatives or state when not to use this tool versus others like b2_list_groups. There is no explicit when/when-not guidance, though the purpose is clear enough for basic selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_list_groupsARead-onlyIdempotent
List active Groups administered by a Group admin account. Returns up to 100 groups per call; use nextGroupId for pagination. Requires the account to be authorized for the Partner API.
| Name | Required | Description | Default |
|---|---|---|---|
| groupName | No | Filter by Group name. Returns all Groups with this exact name. | |
| startGroupId | No | Pagination cursor — the groupId to begin listing from. | |
| maxGroupCount | No | Maximum number of Groups to return (1-100). Defaults to 100. | |
| adminAccountId | Yes | The accountId of the Group admin. Must be authorized for the Partner API. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral detail beyond that: it specifies a 100-group limit, pagination via nextGroupId, and the authorization requirement. These are not in the annotations and help the agent understand expected behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero wasted words. The main action is front-loaded, and the critical details (limit, pagination, authorization) are included without redundancy. It is a model of efficient writing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with no output schema, the description covers the key points: the scope ('active Groups'), the cap and pagination mechanism, and a prerequisite (authorization). It does not describe the response shape, but that is a minor gap given the tool's simplicity and the presence of a pagination hint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented. The description's mention of 'Returns up to 100 groups' and 'use nextGroupId for pagination' loosely relates to maxGroupCount and startGroupId but does not add new semantic meaning beyond the schema. Per the rubric, a baseline of 3 is appropriate when the schema carries the full burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a clear resource ('active Groups'), and adds the qualifier 'administered by a Group admin account,' which distinguishes it from sibling tools like b2_list_group_members (which lists members) and b2_list_buckets. It is unambiguous and immediately conveys the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states the required context (Group admin account, Partner API authorization) and implies the tool is for listing groups, but it does not explicitly name alternatives or state when not to use it. The distinction from b2_list_group_members is inferable but not spelled out, so guidance is present but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_list_keysARead-onlyIdempotent
List the application keys associated with the B2 account. Does not return the actual key secrets — only key IDs, names, capabilities, and restrictions.
| Name | Required | Description | Default |
|---|---|---|---|
| maxKeyCount | No | Maximum number of keys to return (1-1000). | |
| startApplicationKeyId | No | Pagination cursor from a previous response's nextApplicationKeyId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, and non-destructive behavior. The description adds valuable behavioral context by explicitly stating that key secrets are not returned and exactly which fields are included (IDs, names, capabilities, restrictions). This goes beyond the schema and informs the agent about data sensitivity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with zero redundancy. The primary purpose is front-loaded, and the important caveat about key secrets is placed immediately after, giving the agent the most decision-relevant information efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward list tool with no required parameters, the description covers the key details: what is listed, what is returned, and what is deliberately excluded. Pagination mechanics are handled by the schema's parameter descriptions, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both maxKeyCount and startApplicationKeyId fully described in the schema itself. The description adds no additional parameter-level detail, but the schema already provides sufficient semantics for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('application keys associated with the B2 account'), making the tool's function immediately clear. It also distinguishes itself from sibling tools like b2_create_key and b2_delete_key by focusing on listing rather than mutation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly identifies this as a listing operation for application keys, which gives the agent enough context to select it over creation or deletion siblings. It does not explicitly state 'use this instead of X', but the read-only listing intent and the security-focused caveat provide clear situational context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_reserve_trial_create_accountADestructive
Reserve a B2 trial account through the Partner API. Available only in explicit inline mode because Reserve Trial has no provider-side recovery path if a file sink write fails after account creation.
| Name | Required | Description | Default |
|---|---|---|---|
| term | Yes | Trial duration in days (7-30). | |
| Yes | Email address for the new B2 Reserve trial account. | ||
| region | No | Optional data region for the new account. | |
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| storage | Yes | Trial storage amount in TB (1-50). | |
| idempotencyKey | Yes | Caller-generated idempotency key. Reuse the same value only when retrying the identical reserve-trial account creation request. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already flag the operation as destructive and not read-only. The description adds a valuable behavioral caveat beyond those annotations: account creation has no provider-side recovery path if a file sink write fails. This helps the agent appreciate the irreversibility and failure implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the first sentence states the purpose, the second adds a crucial caveat. Minor jargon such as 'file sink' slightly reduces clarity, but every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a fully described schema, clear annotations, and a focused purpose statement, the description is largely complete for invocation. The failure-recovery caveat materially improves completeness for a destructive operation, though no output/return behavior is described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and every parameter already has a meaningful description, including the confirm flag's destructive-policy dependency. The tool description itself adds no parameter-specific guidance, so it neither duplicates nor needs to compensate for the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Reserve'), the resource ('a B2 trial account'), and the channel ('through the Partner API'). This is distinct from the sibling create/update tools and leaves no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear condition of use ('Available only in explicit inline mode') and explains the reason behind it, which helps an agent decide *how* to call it. However, it does not name alternatives or explicitly state when not to use this tool versus another sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_set_bucket_notification_rulesADestructiveIdempotent
Set event notification rules (webhooks) for a B2 bucket. Replaces any existing rules.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Confirm replacing persistent outbound webhook notification rules. Required when the server destructive policy is 'confirm' (the default). | |
| bucketId | Yes | The bucket ID to set notification rules for. | |
| eventNotificationRules | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this destructive and idempotent; the description adds useful specificity by stating that any existing rules are replaced. It does not go as far as noting the conditional confirm requirement, but the schema covers that, so the added behavioral insight is sufficient for a scoring of 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the key action and destructive effect front-loaded. No filler or redundant restating of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a clear mutating operation with detailed schema and annotations, but it omits when-to-use guidance and the confirm/destructive-policy context that would make it fully self-contained, especially given the absence of an output schema describing the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds only a webhook hint and the replacement consequence; it does not explain bucketId, confirm, or rule construction. With schema description coverage at 67% and rich per-property documentation in the schema, the description neither meaningfully compensates nor detracts from what the agent can already read.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation: setting event notification webhook rules for a B2 bucket, and adds the non-obvious behavior that existing rules are replaced. This distinguishes it from sibling b2_get_bucket_notification_rules without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool vs alternatives, no prerequisites, and no mention that b2_get_bucket_notification_rules is the read counterpart. The description only states what the tool does, leaving the agent to infer selection context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_unfinished_uploadsARead-onlyIdempotent
Find abandoned multipart uploads that silently consume storage in a bucket. For 'bucket bloat', 'stuck/incomplete uploads', 'wasted storage'. Returns count, oldest upload age, and wasted bytes. Give the bucket by name or bucketId. Live listing, bounded by max_uploads and an internal time budget — on a very bloated bucket it returns a truncated result (and wasted_gb may be a lower bound) and recommends a lifecycle rule.
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | Bucket name or bucketId to inspect. | |
| max_uploads | No | Safety cap on how many unfinished uploads to scan (default 1000, max 10,000). A bucket bloated with abandoned uploads would otherwise trigger an unbounded walk plus a per-upload parts fan-out that times out. If the cap or an internal time budget is hit, the result is truncated and wasted_gb may be a lower bound — add a lifecycle rule to auto-cancel unfinished large files. | |
| older_than_days | No | Only count uploads started more than this many days ago (optional). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior, so the baseline burden is lower. The description adds meaningful behavior beyond annotations: it is a live listing bounded by max_uploads and an internal time budget, may truncate results on bloated buckets, and wasted_gb may be a lower bound. It also discloses that the tool recommends a lifecycle rule.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: use case, return metrics, invocation, and truncation caveat are each given distinct content. The most important scoping information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even without an output schema, the description tells the agent what will be returned: count, oldest upload age, and wasted bytes. It also covers the key failure mode and mitigation recommendation. Combined with rich annotations, this is complete enough for correct invocation and result interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters little parameter-level meaning beyond restating that the bucket can be given by name or bucketId, which duplicates the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Find abandoned multipart uploads that silently consume storage in a bucket.' It also includes use-case keywords like 'bucket bloat' and 'wasted storage', which help distinguish it from generic listing tools such as s3_list_multipart_uploads and from size-focused siblings like b2_largest_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear invocation contexts: 'bucket bloat', 'stuck/incomplete uploads', and 'wasted storage'. It does not explicitly name alternative tools or state when not to use this tool, so it stops short of full exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_update_bucketADestructiveIdempotent
Update the settings of an existing B2 bucket, including type, CORS rules, lifecycle rules, encryption, and replication configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Confirm a destructive change (making the bucket public, weakening Object Lock/lifecycle, or changing replication). Required when the server destructive policy is 'confirm' (the default); non-destructive updates do not need it. | |
| bucketId | Yes | The ID of the bucket to update. | |
| corsRules | No | CORS rules: <=100. allowedOrigins/allowedOperations require 1-100 non-empty strings; allowedHeaders/exposeHeaders allow <=100. Strings <=999 chars. Per-rule UTF-8 total <1,000. Names unique. | |
| bucketInfo | No | Custom metadata: <=10 pairs. Keys: 1-50 UTF-8 bytes, chars A-Z a-z 0-9 . _ ` ~ ! # $ % ^ & * ' | + -, no b2- prefix. Values total <=10,000 UTF-8 bytes. | |
| bucketType | No | ||
| ifRevisionIs | No | Conditional update — only update if the bucket revision matches this value. | |
| lifecycleRules | No | ||
| fileLockEnabled | No | Enable Object Lock on the bucket. Unlike S3's PutObjectLockConfiguration (which only enables lock at bucket creation), the B2 native API allows enabling Object Lock on an existing bucket here. Requires the writeBucketRetentions capability. | |
| defaultRetention | No | Default Object Lock retention for newly uploaded objects. Requires Object Lock enabled on the bucket. Send { mode: null, period: null } to clear. | |
| replicationConfiguration | No | ||
| defaultServerSideEncryption | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already identify this as destructive and non-read-only, but the description itself adds no behavioral context beyond 'update.' It does not mention confirmation requirements, destructive consequences, or how updates apply. The confirm parameter appears only in the schema, not the tool description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the verb and resource front-loaded and no filler. Every phrase contributes to understanding what the tool operates on and what it can change.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter tool with nested objects and no output schema, the one-line description is adequate for basic tool selection but leaves important caveats—destructive confirmation, Object Lock requirements, and update semantics—to the schema and annotations. It is not incomplete enough to block use, but it is not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 64%, so the schema carries most parameter documentation. The description adds a useful high-level category list, but it omits key parameters like confirm, fileLockEnabled, defaultRetention, bucketInfo, and ifRevisionIs, so it only partially compensates for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Update') with a clear resource ('existing B2 bucket') and lists major setting categories (type, CORS rules, lifecycle rules, encryption, replication). This clearly separates it from siblings like b2_create_bucket, b2_delete_bucket, and b2_set_bucket_notification_rules.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'existing B2 bucket' implies an update use case, and the listed settings suggest when to choose this tool. However, there is no explicit guidance about when not to use it or which sibling to prefer for related tasks such as notification rules or lifecycle-only updates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_update_file_legal_holdADestructiveIdempotent
Set or clear a legal hold on a specific file version in B2. When a legal hold is active, the file cannot be deleted regardless of retention settings. Requires the writeFileLegalHolds capability on the application key.
| Name | Required | Description | Default |
|---|---|---|---|
| fileId | Yes | The B2 file ID of the file to update. | |
| confirm | No | Confirm this irreversible/protection-removing operation. Required when the server destructive policy is 'confirm' (the default). | |
| fileName | Yes | The name of the file (required by the B2 API alongside fileId). | |
| legalHold | Yes | 'on' to apply a legal hold; 'off' to remove it. B2's write API expects this bare string — not the isClientAuthorizedToRead/value object that b2_get_file_info returns. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal destructiveHint=true, readOnlyHint=false, and idempotentHint=true. The description adds useful context beyond those hints: an active legal hold makes the file undeletable regardless of retention settings, and the operation requires a specific capability. It does not separately warn that clearing the hold removes protection, but the destructive annotation already covers that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences: the first states the action and resource, and the second adds behavioral and permission context. There is no filler, repetition, or unnecessary preamble.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Combined with the full schema and annotations, the description supplies the remaining operational facts: capability requirement and the relationship between legal hold and retention settings. Since there is no output schema, return values are not described, but for a state-setting operation this does not prevent correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter, including the legalHold enum and the confirm field, is already documented in the input schema. The description adds no parameter-level detail, but none is required beyond the schema's coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb phrase ('Set or clear a legal hold') and identifies the exact resource ('a specific file version in B2'). It further distinguishes this from the related sibling b2_update_file_retention by stating that an active legal hold prevents deletion 'regardless of retention settings.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states the capability prerequisite (writeFileLegalHolds) and the behavioral effect of an active hold, which lets an agent infer when this tool applies. However, it never explicitly contrasts legal holds with retention policy or names the sibling b2_update_file_retention, so when-to-use guidance is implied rather than directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_update_file_retentionADestructiveIdempotent
Set or modify the retention policy on a specific file version in B2. Supports governance and compliance retention modes. In compliance mode, the retain-until date can only be extended. Requires the writeFileRetentions capability.
| Name | Required | Description | Default |
|---|---|---|---|
| fileId | Yes | The B2 file ID of the file to update. | |
| confirm | No | Confirm this irreversible/protection-removing operation. Required when the server destructive policy is 'confirm' (the default). | |
| fileName | Yes | The name of the file (required by the B2 API alongside fileId). | |
| fileRetention | Yes | Retention policy to apply, or { mode: null, retainUntilTimestamp: null } to clear. This is the flat shape B2's write API expects — do NOT include the read-only isClientAuthorizedToRead/value wrapper that b2_get_file_info returns. | |
| bypassGovernance | No | If true, allows overriding governance-mode retention. Requires bypassGovernance capability. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as destructive and non-read-only; the description adds useful behavior beyond that, such as 'In compliance mode, the retain-until date can only be extended' and the required writeFileRetentions capability. There is no contradiction with annotations. It could include more side-effect detail, but the provided context is meaningful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences carry the essential information: purpose, mode support, compliance constraint, and capability requirement. Every sentence earns its place with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description plus the richly documented schema cover the core operation, prerequisites, mode restrictions, required parameters, and the confirm behavior. There is no output schema, but for a mutation tool this is acceptable. A minor gap is that the description does not explicitly summarize clearing behavior, though the schema covers it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds extra parameter-relevant meaning: the compliance mode only allows extending retain-until, and the capability requirement affects whether certain operations are permitted. This goes beyond what the schema's property descriptions state.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Set or modify the retention policy on a specific file version in B2,' naming the action, the resource, and the scope precisely. It also names the two supported retention modes, distinguishing this from legal-hold and bucket-level operations. This is specific and non-tautological.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes when the tool is applicable—when a B2 file version's retention policy needs to be set or modified—and adds the capability prerequisite. It does not explicitly name alternative tools, but the operation scope and sibling names make the intended use unambiguous. The schema covers the confirm flag for destructive operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
b2_usage_growthARead-onlyIdempotent
Rank accounts by how much STORED data grew or shrank between two points in time, from the daily B2 usage reports (uses stored_gb, the end-of-day snapshot). For 'which customers grew the most/least', 'who's moving data off'. Compares the latest snapshot against one month/quarter/year earlier and fetches only those two days, so it stays fast even on large report buckets. Returns the two dates compared and per-account start vs current GB and % growth (new accounts flagged). Scope follows the caller's key (a partner key sees all its sub-accounts). Needs Usage Reports enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Custom trailing window in days that overrides `period` (e.g. 7 for week-over-week). | |
| limit | No | Max accounts (default 50). | |
| order | No | Ranking. Default most_grown. | most_grown |
| period | No | Compare the latest snapshot against one month, quarter, or year ago. Default month. | month |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool read-only, idempotent, and non-destructive. The description adds substantial behavioral context beyond that: it uses end-of-day stored_gb snapshots, fetches only two days for efficiency, returns the compared dates and per-account start/current GB plus % growth, flags new accounts, and explains that scope follows the caller's key. This gives the agent a clear picture of what the call does and what to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence adds value: purpose, use cases, data semantics, performance behavior, return contents, scoping, and a prerequisite. It is front-loaded with the core action and remains readable despite its length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description explains what the response contains (dates compared, per-account start vs current GB, % growth, new account flags). It also covers prerequisites, scope, and performance characteristics. For a read-only reporting tool with four optional parameters, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with all four parameters documented in the input schema itself. The tool description reinforces the period-window concept but does not add much new parameter-level meaning beyond what the schema already says. Baseline 3 is appropriate when the schema carries the parameter documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Rank accounts by how much STORED data grew or shrank'), names the data source (daily B2 usage reports, stored_gb snapshots), and gives concrete use cases ('which customers grew the most/least', 'who's moving data off'). This clearly differentiates it from siblings like b2_egress_leaders or b2_largest_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it is for growth/shrinkage ranking between two points, compares latest snapshot against month/quarter/year earlier, and notes the prerequisite that Usage Reports must be enabled. It does not explicitly name alternative tools or state when not to use it, but the intended scenarios are well specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_abort_multipart_uploadADestructiveIdempotent
Abort an in-progress S3-compatible multipart upload and release all associated storage.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| bucket | Yes | The bucket name. | |
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| uploadId | Yes | The UploadId to abort. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true, so the description is not required to restate destructiveness. It adds useful behavioral context by specifying that the operation aborts an in-progress upload and releases associated storage, making the consequence concrete beyond the bare annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly constructed sentence that communicates the action, scope, and consequence with no redundant words. It is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation, the description plus annotations and 100% schema parameter coverage provide enough information to invoke the tool correctly. It would benefit from a brief note about irreversible consequences or the distinction from s3_complete_multipart_upload, but those are either covered by annotations or inferable from the sibling tool names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and every parameter, including the important confirm flag, already has a meaningful schema description. The tool description itself adds no parameter-specific detail, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Abort') with a clear resource ('in-progress S3-compatible multipart upload') and an outcome ('release all associated storage'). This clearly distinguishes it from related operations like s3_complete_multipart_upload or s3_create_multipart_upload.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'in-progress' implies this tool is for canceling an unfinished multipart upload rather than completing it, which gives some usage context. However, it does not explicitly state when to choose this over s3_complete_multipart_upload or s3_delete_object, nor does it mention any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_complete_multipart_uploadAIdempotent
Finalize an S3-compatible multipart upload. Provide the ETags of all uploaded parts in order.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| parts | Yes | All uploaded parts in ascending part number order. | |
| bucket | Yes | The bucket name. | |
| uploadId | Yes | The UploadId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only (false), idempotent (true), and non-destructive (false) hints. The description adds the behavioral requirement that parts must be provided in ascending order, which is useful, but it does not disclose other traits such as error behavior or effects of retries. This is acceptable given the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences: the first states the action, the second states the critical input requirement. Zero filler, front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complete parameter schema, the no-output-schema case, and annotations covering safety and idempotency, this description provides sufficient context for an agent to invoke the tool correctly. It could be slightly richer on error cases or return values, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well-documented. The description's mention of ETags and ordering adds a minor contextual layer but does not introduce new information beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Finalize' with the resource 'S3-compatible multipart upload', clearly distinguishing it from create/abort operations. It also adds a key requirement ('Provide the ETags... in order') that solidifies its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: the tool finalizes an upload, which presupposes that all parts have been uploaded. It does not explicitly mention alternatives like abort_multipart_upload or state conditions for when to use this over other tools, but the context makes the primary use case clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_copy_objectAIdempotent
Copy an object within B2 or between B2 buckets via B2's S3-compatible CopyObject API. The acl input is retained as a no-op S3 compatibility hint; B2 access follows the destination bucket policy.
| Name | Required | Description | Default |
|---|---|---|---|
| acl | No | Accepted as a no-op S3 compatibility hint; B2 access follows the destination bucket policy. | |
| metadata | No | New metadata (only used with REPLACE). | |
| sourceKey | Yes | The source object key. | |
| contentType | No | New content type (only used with REPLACE). | |
| sourceBucket | Yes | The source bucket name. | |
| destinationKey | Yes | The destination object key. | |
| sourceVersionId | No | Copy a specific version of the source object. | |
| destinationBucket | Yes | The destination bucket name. | |
| metadataDirective | No | COPY copies metadata from source; REPLACE uses the provided metadata. | COPY |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral context beyond the annotations: the acl parameter is called out as a no-op S3 compatibility hint, and B2 access is tied to the destination bucket policy. This helps the agent understand side effects and authorization behavior that the annotations do not convey. There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads the core operation and scope, then places the important acl caveat and access-policy note. Every sentence earns its place and the structure is easy for an agent to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with full schema coverage and useful annotations, the description is reasonably complete: it clarifies bucket scope and the acl no-op. It does not describe the return value or error behavior, but the absence of an output schema and the schema's thorough parameter documentation keeps this from being a major gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameter meanings. The description repeats the acl no-op behavior that the schema already states, adding no new param-level insight. Baseline 3 is appropriate because the schema does the heavy lifting and the description does not need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the operation: 'Copy an object within B2 or between B2 buckets via B2's S3-compatible CopyObject API.' It names a specific verb, resource, and scope, and the phrase 'CopyObject API' distinguishes it from sibling upload/part-copy tools without requiring schema inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for the operation and its cross-bucket scope, but it never explicitly tells the agent when to choose this over alternatives like s3_put_object or s3_upload_part_copy. Usage is implied by the semantics of 'copy' rather than stated with exclusions or sibling comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_create_multipart_uploadA
Initiate an S3-compatible multipart upload for a large file in B2. Returns an UploadId to use with s3_presign_upload_part, which mints per-part URLs the client uploads directly to B2.
| Name | Required | Description | Default |
|---|---|---|---|
| acl | No | ||
| key | Yes | The object key for the final assembled file. | |
| bucket | Yes | The destination bucket name. | |
| metadata | No | Custom metadata for the object. | |
| contentType | No | MIME type of the object. | |
| serverSideEncryption | No | Server-side encryption. B2 supports SSE-B2 (AES256) only — not SSE-KMS. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey non-read-only and non-idempotent behavior. The description adds useful operational context by clarifying that this call only initiates the upload, returns an UploadId, and does not upload data itself. However, it omits the important lifecycle fact that the initiated upload persists as unfinished state until completed or aborted, so it adds some but not rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry purpose, scope, return value, and companion-tool routing without any filler. The key information is front-loaded in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Combined with the schema, the description is sufficient for the immediate call: it implies required bucket/key, optional metadata, and the meaning of the returned UploadId. The main gap is lifecycle guidance—an initiated multipart upload should eventually be completed or aborted—and there is no output schema to fill that in, making the overall description informative but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is about 83%, and the schema already explains bucket, key, metadata, contentType, and serverSideEncryption. The tool description adds no parameter-specific meaning beyond 'large file' and the returned UploadId, so it stays at the schema-coverage baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific action ('Initiate an S3-compatible multipart upload') on a clear resource ('a large file in B2') and immediately names the companion sibling tool, s3_presign_upload_part, distinguishing this initiation step from per-part URL minting. There is no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage context: use this when the file is large and when a multipart strategy is intended, and pass the returned UploadId to s3_presign_upload_part. However, it does not explicitly say when not to use it, such as recommending s3_put_object for small objects, or mention that completion/abort steps must follow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_delete_objectADestructive
Delete an object from a B2 bucket. Optionally specify a version ID to delete a specific version.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key to delete. | |
| bucket | Yes | The bucket name. | |
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| versionId | No | Version ID of the specific version to delete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive and non-read-only behavior. The description adds minimal extra context by noting that version ID selects a specific version, but it does not disclose consequences like irreversibility or behavior in versioned buckets. This is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and resource. Every word earns its place; no filler or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive 4-parameter tool with annotations and full schema coverage, this is minimally sufficient. However, it omits behavior on missing objects, versioning edge cases, and the bulk-delete alternative. Without an output schema, a bit more context would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description does not add meaning beyond what the schema already provides. The version-ID mention in the description only restates the schema field description, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Delete'), a clear resource ('an object from a B2 bucket'), and the optional version-ID behavior. It is immediately distinguishable from the sibling s3_delete_objects by the singular object scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. In particular, the sibling tool s3_delete_objects provides bulk deletion, and the description does not mention that distinction or any other selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_delete_objectsADestructive
Delete multiple objects from a B2 bucket with bounded SDK concurrency (up to 1000 objects).
| Name | Required | Description | Default |
|---|---|---|---|
| quiet | No | If true, only return errors (not successes) in the response. | |
| bucket | Yes | The bucket name. | |
| confirm | No | Confirm this destructive/irreversible operation. Required when the server destructive policy is 'confirm' (the default). | |
| objects | Yes | Array of objects to delete. | |
| bypassGovernance | No | If true, bypass governance-mode Object Lock retention when deleting specific versions. Requires bypassGovernance capability. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the destructive nature is covered. The description adds the 'bounded SDK concurrency' detail, but does not add further behavioral context such as irreversibility, versionId effects, or interaction with the confirm parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the verb first, the target resource next, and a useful bound trailing; no filler or repetition of schema fields. It earns its place and is immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive batch tool, the schema covers quiet, confirm, objects, and governance, while the description adds the concurrency and batch-size framing. The lack of an output schema is mitigated by the quiet parameter documentation, though a one-line note about response behavior would have made it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters and their fields. The description only restates the maxItems bound of 1000 objects, adding no new semantic detail beyond the schema baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete action ('Delete multiple objects') plus the exact resource ('B2 bucket') and an explicit scope bound ('up to 1000 objects'). It is immediately distinguishable from the sibling s3_delete_object, which covers the single-object case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'multiple objects' and the explicit 1000-object upper bound provide a clear context for batch deletion versus the single-object sibling. It does not explicitly name s3_delete_object or state when not to use the tool, so it stops just short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_get_bucket_locationARead-onlyIdempotent
Get the region (location constraint) of a B2 bucket via the S3-compatible API. No native b2_* equivalent — used to verify region/endpoint pairing.
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | The bucket name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool read-only, idempotent, and non-destructive, lowering the disclosure burden. The description adds useful context about the S3-compatible API and its verification purpose, but does not describe the return payload or failure behavior. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the operation and resource, and every clause adds value. The parenthetical and dash clause pack in API family and purpose without any filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only, idempotent tool with complete schema coverage and rich annotations, the description covers the essential context: API family, purpose, and lack of native alternative. It does not explicitly state the return value, but the operation name and purpose make it mostly inferable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single required bucket parameter, so the schema fully documents the input. The description mentions 'B2 bucket' and 'location constraint' but adds no parameter-level meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with a specific verb ('Get') and resource ('region (location constraint) of a B2 bucket'), and distinguishes itself from b2_* siblings by explicitly stating there is no native equivalent. This makes it clearly identifiable among the many S3 and B2 tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear use case ('verify region/endpoint pairing') and notes that no native b2_* equivalent exists, guiding the agent away from the b2_* family. It does not explicitly name alternatives like s3_head_bucket, so the guidance is useful but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_get_objectA
Read a SMALL object inline (≤1 MiB, returned base64) — for manifests, sidecars, and configs the agent must inspect — or stream any size to a local path with saveToPath. For real object data, generate a GetObject URL with s3_get_presigned_url and download directly from B2 (bytes never pass through the server or the model context).
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| range | No | Byte range, e.g. 'bytes=0-1048575'. | |
| bucket | Yes | The bucket name. | |
| versionId | No | Specific version of the object to retrieve. | |
| saveToPath | No | If provided, save the file to this local path. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the 1 MiB inline cap, base64 return encoding, streaming behavior via saveToPath, and that the presigned URL path keeps object bytes out of the server/model context. This goes well beyond the sparse annotations and gives an agent a clear behavioral model with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences front-load the primary behavior and decision rule, then route to the sibling tool. Every clause earns its place and there is no repetition of schema or annotation content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with no output schema and sparse annotations, the description covers the key facts an agent needs: size limits, return encoding, local streaming, and the correct sibling for real object data. Required parameters remain obvious from the schema, and no critical behavior is left unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds meaningful usage semantics for saveToPath ('stream any size to a local path') and clarifies that inline reads are limited to small objects returned as base64. It does not elaborate on range or versionId, but those are already adequately described in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Read a SMALL object inline' with concrete constraints (≤1 MiB, returned base64) and explicitly contrasts with s3_get_presigned_url. An agent can immediately distinguish this tool from sibling object-access tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use the inline path (manifests, sidecars, configs), when to use saveToPath for any size, and when to use s3_get_presigned_url for real object data. The exclusion is clear and names the exact sibling alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_get_presigned_urlADestructiveIdempotent
Generate a short-lived presigned URL bearer capability for one B2 object — GetObject (download) or PutObject (upload). The response includes the URL, operation, expiresIn, and expiresAt; treat the URL as sensitive until it expires. This is the preferred path for moving real object data: bytes flow directly between the client/worker and B2 and never pass through the MCP server. Note: presigned POST (browser form uploads) is NOT supported by B2; use a PutObject URL instead.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| bucket | Yes | The bucket name. | |
| confirm | No | Confirm minting a PutObject presigned URL bearer capability that can create or overwrite object data. Required when operation is PutObject and the server destructive policy is 'confirm' (the default). | |
| expiresIn | No | URL expiry in seconds (default: 3600 = 1 hour, max: 604800 = 7 days). | |
| operation | Yes | The operation the URL allows: GetObject to download or PutObject to upload. | |
| versionId | No | For GetObject: the specific version ID to target. | |
| contentType | No | For PutObject: restrict the upload to this content type. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description adds valuable behavioral context: the URL is a bearer capability, it is short-lived, it should be treated as sensitive until expiry, and B2 does not support presigned POST. The destructive nature of PutObject URLs is consistent with destructiveHint=true, and readOnlyHint=false matches the upload capability. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the core behavior, the operational advantage and sensitivity guidance, and the critical B2 limitation. The most important information is front-loaded, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description usefully states that the response includes URL, operation, expiresIn, and expiresAt. It also covers the key operational context (direct byte flow, sensitivity, unsupported POST flow) and the tool's role relative to siblings. An agent has enough information to call this tool correctly and interpret its result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% coverage of all seven parameters, including descriptions, defaults, enums, and constraints, so the description does not need to restate parameter details. The description does add contextual meaning by labeling the URL a bearer capability and mentioning the response fields, but this is not parameter-level semantics. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (Generate), a precise resource (short-lived presigned URL bearer capability for one B2 object), and the two allowed operations (GetObject download / PutObject upload). It also distinguishes itself from sibling tools by explaining that bytes flow directly between client and B2 and never through the MCP server.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly positions this as 'the preferred path for moving real object data,' giving the agent a direct criterion for choosing it over s3_get_object or s3_put_object. It also explicitly warns that presigned POST is unsupported and instructs to use a PutObject URL instead, but it does not enumerate other alternative tools or when to avoid this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_head_bucketARead-onlyIdempotent
Check whether a B2 bucket exists and is reachable on the S3-compatible endpoint with the current credentials. Use this to validate S3-surface reachability (the native b2_list_buckets confirms existence but not S3 reachability).
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | The bucket name to check. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds valuable behavioral context: it operates on the S3-compatible endpoint, checks both existence and reachability, and depends on current credentials. This goes beyond what the annotations convey, though it could mention explicit error/status outcomes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler. The primary purpose is first, followed by a precise usage directive. Every phrase earns its place and nothing needs to be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, read-only tool with full annotations and complete schema coverage, this description supplies all necessary context: what it checks, what credentials it uses, and when to prefer it over a sibling. No missing information blocks an agent from selecting or invoking it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the only parameter, 'bucket', is already described as 'The bucket name to check.' The description reinforces this by referencing the bucket but does not add new semantic details such as name format or restrictions. Baseline 3 is appropriate given full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Check whether') and resource ('B2 bucket') with the precise scope: exists and is reachable on the S3-compatible endpoint with current credentials. It also distinguishes itself from b2_list_buckets, removing any ambiguity with sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives the use case: 'Use this to validate S3-surface reachability' and directly names the alternative (b2_list_buckets) that does not cover S3 reachability. This tells an agent exactly when to choose this tool over a similar sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_head_objectARead-onlyIdempotent
Get metadata for a B2 object without downloading it. Returns content type, size, last modified, ETag, and custom metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| bucket | Yes | The bucket name. | |
| versionId | No | Specific version of the object. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the read-only safety profile is established. The description adds value beyond those by disclosing that the operation returns metadata only and by listing the response fields (content type, size, last modified, ETag, custom metadata), which is genuinely useful given there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler: the core purpose and differentiator are front-loaded in the first sentence, and the response summary follows directly. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple metadata-retrieval tool with rich annotations and fully documented parameters, the description is nearly complete, and it partially compensates for the missing output schema by enumerating the returned metadata fields. Minor gaps remain around failure behavior (e.g., 404 for a missing object) and versionId semantics, but these are not blocking for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — bucket, key, and versionId each already carry descriptive entries, so the baseline 3 applies. The description adds no parameter-specific detail, but none is required given that the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get metadata for a B2 object') and the key differentiator 'without downloading it', which distinguishes it from s3_get_object and s3_head_bucket. The second sentence enumerates the response contents, making the tool's scope unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without downloading it' provides clear context for when to choose this tool over the object-download sibling: when only metadata is needed and the body is not. However, no alternative is named explicitly and no exclusionary conditions are stated, so it stops short of the strongest routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_list_multipart_uploadsARead-onlyIdempotent
List all in-progress S3-compatible multipart uploads for a bucket.
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | The bucket name. | |
| prefix | No | Only list uploads for keys with this prefix. | |
| delimiter | No | ||
| keyMarker | No | Pagination cursor. | |
| maxUploads | No | ||
| uploadIdMarker | No | Pagination cursor. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile with readOnlyHint, idempotentHint, and destructiveHint=false. The description adds useful context by specifying 'in-progress' and 'S3-compatible', but it does not disclose that results are paginated through maxUploads/keyMarker/uploadIdMarker, despite saying 'List all'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loading the verb and resource. It is as short as possible while still conveying the tool's scope and S3 compatibility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, but the description never explains the response shape or how pagination works, so an agent cannot fully anticipate what the tool returns. The presence of two 'Pagination cursor' parameters implies paging, but the description gives no guidance on how to traverse pages to actually list 'all' uploads.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no parameter-level meaning beyond the schema; 'for a bucket' merely recontextualizes the required bucket parameter. With 67% schema coverage, the missing delimiter and maxUploads semantics are not compensated for by the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clear resource ('in-progress S3-compatible multipart uploads') and a clear scope ('for a bucket'). It distinguishes itself from sibling s3_list_parts, which lists parts of a specific upload, and from b2_unfinished_uploads by emphasizing S3 compatibility.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The action itself implies when to use it (when in-progress multipart uploads need enumeration), but it gives no explicit alternatives or exclusions. It does not tell the agent to prefer s3_list_parts for a single upload or to use abort/complete operations for finalization, so routing relies on inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_list_objects_v2ARead-onlyIdempotent
List objects in a B2 bucket via the S3-compatible ListObjectsV2 API. Supports prefix filtering, delimiter-based folder listings, and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | The bucket name. | |
| prefix | No | Only return objects whose keys start with this prefix. | |
| maxKeys | No | ||
| delimiter | No | Use '/' to list like a folder tree. | |
| startAfter | No | Return objects after this key (exclusive S3 StartAfter semantics). | |
| continuationToken | No | Pagination token from a previous response. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read-only, idempotent, non-destructive behavior, so the description does not need to repeat safety traits. It adds useful functional detail about filtering, delimiter folder views, and pagination, but it does not disclose truncation behavior or the need to follow continuation tokens.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One well-structured sentence that front-loads the primary action and resource, then lists the key capabilities. Every clause adds information, and there is no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description, combined with rich annotations and a well-documented schema, gives an agent enough to invoke the tool correctly. It covers filtering, folder-style listing, and pagination; the only notable gap is not explicitly explaining that results can be truncated and require a continuation token, though the word 'pagination' hints at this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high at 83%, providing a solid baseline. The description goes further by giving semantic meaning to key parameters: 'prefix filtering' maps to prefix, 'delimiter-based folder listings' maps to delimiter, and 'pagination' maps to continuationToken. Only maxKeys lacks prose explanation, though the schema defines its bounds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Begins with the specific verb-object pair 'List objects in a B2 bucket' and names the exact S3-compatible ListObjectsV2 API. This clearly identifies the operation and distinguishes it from siblings like s3_list_object_versions and s3_list_parts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use cases by mentioning prefix filtering, delimiter-based folder listings, and pagination, but it never states when to choose this tool over alternatives such as s3_list_object_versions or s3_list_parts. There is no explicit when-to-use or when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_list_object_versionsARead-onlyIdempotent
List all versions of objects in a versioned B2 bucket, including delete markers.
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | Yes | The bucket name. | |
| prefix | No | Only list versions for objects with this prefix. | |
| maxKeys | No | ||
| delimiter | No | ||
| keyMarker | No | Pagination cursor — key from a previous response. | |
| versionIdMarker | No | Pagination cursor — version ID from a previous response. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, non-destructive behavior. The description adds useful context beyond that by revealing the response includes delete markers and that the bucket must be versioned. It does not describe pagination, error behavior, or response shape, but those are secondary for a safe read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loaded with the verb and object, and the 'including delete markers' qualifier is placed at the end where it does not interfere with the primary action. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description plus schema covers the core behavior and parameter meanings, but there is no mention of output structure, pagination behavior, or how the tool behaves on an unversioned bucket. Since there is no output schema and the tool has 6 parameters, these gaps leave some uncertainty for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (bucket, prefix, keyMarker, and versionIdMarker are described; maxKeys and delimiter are not), and the description contributes no parameter-level meaning. An agent gets no help from the description for the undocumented maxKeys and delimiter parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), identifies the exact resource ('all versions of objects in a versioned B2 bucket'), and adds a distinguishing detail ('including delete markers') that separates it from siblings like s3_list_objects_v2. This makes the tool's scope immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: an agent needs this tool when it wants every version or delete markers rather than just current objects. However, it never explicitly names alternatives like s3_list_objects_v2 or states when not to use this tool, leaving the routing decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_list_partsARead-onlyIdempotent
List the parts that have been uploaded for an in-progress S3-compatible multipart upload.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| bucket | Yes | The bucket name. | |
| maxParts | No | ||
| uploadId | Yes | The UploadId. | |
| partNumberMarker | No | Pagination cursor. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the description does not need to restate safety. It adds the useful context that the upload must be in-progress, but it does not disclose pagination behavior, response shape, or any error conditions, so it stays at the baseline.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence communicates the operation, resource, and required state with no redundant wording. Every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list operation, the description plus schema annotations cover the essential invocation details: the operation, the target resource, and the in-progress state. It does not describe the return object, but a list operation of this kind is still sufficiently callable without that detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 80% of parameters, documentating bucket, key, uploadId, and partNumberMarker, leaving only maxParts without a description. The description does not add meaning to any parameter beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), a clear resource ('parts'), and a scoping condition ('an in-progress S3-compatible multipart upload'). This clearly distinguishes it from sibling tools like s3_list_multipart_uploads, which list uploads rather than parts, and from s3_upload_part_copy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'in-progress' provides clear context that this tool is for active multipart uploads, implying it is not for completed uploads. It does not explicitly name alternatives or exclusions, but the intended use case is clear enough without additional guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_presign_upload_partAIdempotent
Generate short-lived presigned PUT URL bearer capabilities for parts of an S3-compatible multipart upload, so the client/worker uploads each part DIRECTLY to B2. The response includes expiresIn/expiresAt; treat each URL as sensitive until it expires. Flow: s3_create_multipart_upload → s3_presign_upload_part → PUT each part to its URL (capture the ETag from each response header) → s3_complete_multipart_upload with those ETags. Parts except the last must be ≥5 MiB.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The object key. | |
| bucket | Yes | The bucket name. | |
| uploadId | Yes | The UploadId from s3_create_multipart_upload. | |
| expiresIn | No | URL expiry in seconds (default: 3600 = 1 hour, max: 604800 = 7 days). | |
| partNumbers | Yes | Part numbers to presign (each 1–10000). Mint all parts at once, or only the missing ones to resume. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals that URLs are short-lived bearer capabilities, that the response contains expiresIn/expiresAt, and that each URL should be treated as sensitive until expiry. It also clarifies that the upload happens directly to B2 by the client/worker rather than by this tool. This adds meaningful behavior beyond the annotations and does not contradict them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence contributes: purpose, security/expiry behavior, the full multipart flow, and a size constraint. It is front-loaded with the core function before the workflow details. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by stating the key response fields (expiresIn/expiresAt) and the required flow with ETags. It covers prerequisites, sequencing, and the part-size rule. The exact response shape mapping part numbers to URLs is not spelled out, but enough context is present for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters. The description adds workflow-level context and the ≥5 MiB part-size rule, but does not add detailed parameter-level semantics beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: generating short-lived presigned PUT URLs for parts of an S3-compatible multipart upload. It distinguishes itself from siblings like s3_get_presigned_url by specifying PUT and multipart parts, and clarifies the tool does not perform the upload itself ('client/worker uploads each part DIRECTLY').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It embeds the tool in a concrete workflow, naming the preceding and following calls and the ETag handoff. It also states a hard constraint ('Parts except the last must be ≥5 MiB'). It does not explicitly name alternative tools or when not to use them, so this is clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_put_bucket_lifecycleADestructiveIdempotent
Set S3 lifecycle rules on a B2 bucket; pass rules: [] to clear the S3 lifecycle configuration. Supports AbortIncompleteMultipartUpload, Expiration, and NoncurrentVersionExpiration. B2 does not support Transition/storage-class rules.
| Name | Required | Description | Default |
|---|---|---|---|
| rules | Yes | Rules to set; [] clears the configuration. | |
| bucket | Yes | The bucket name. | |
| confirm | No | Required under 'confirm' when rules is [] or rules expire objects. Not needed for abort-incomplete-upload-only rules. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already mark this as destructive and idempotent. The description adds valuable behavioral detail: passing rules: [] clears the entire lifecycle configuration, and B2 does not support Transition/storage-class rules. This helps an agent avoid invalid or unintended calls.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short, information-dense sentences with no filler. The primary action is front-loaded, followed by clearing behavior and supported/unsupported rule types.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the schema already documents all parameters and the annotations cover safety behavior, the description adds the essential B2-specific context. The only minor gap is that it does not explicitly state that setting non-empty rules replaces any existing lifecycle configuration, but this is largely implied by the 'set' and 'clear' semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful semantics beyond the schema by explaining that rules: [] clears the configuration and by enumerating the supported lifecycle actions. The confirm parameter is not described in the description, but the schema already covers it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: 'Set S3 lifecycle rules on a B2 bucket.' It also names the supported rule types and the key B2-specific limitation around Transition/storage-class rules, which distinguishes this tool from general S3 mutation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: this is the tool for lifecycle configuration on a B2 bucket and it clarifies what rule types are supported. It does not explicitly name sibling tools as alternatives or state when not to use this tool, but the scope is specific enough that the intended use case is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_put_objectAIdempotent
Upload a SMALL object inline (≤1 MiB) to a B2 bucket — for manifests, sidecars, and tiny configs. Provide base64-encoded content or a local file path. For real object data, generate a PutObject URL with s3_get_presigned_url and upload directly to B2 (bytes never pass through the server), or use the multipart tools for large objects.
| Name | Required | Description | Default |
|---|---|---|---|
| acl | No | Accepted as a no-op S3 compatibility hint; B2 bucket policy is unchanged. | |
| key | Yes | The object key (file path within the bucket). | |
| bucket | Yes | The destination bucket name. | |
| content | No | Base64-encoded content to upload. | |
| filePath | No | Absolute local path to the file to upload. | |
| metadata | No | Custom metadata key-value pairs. | |
| contentType | No | MIME type of the object. | |
| storageClass | No | Accepted as a no-op S3 compatibility hint; B2 storage class is unchanged. | |
| serverSideEncryption | No | Server-side encryption. B2 supports SSE-B2 (AES256) only — not SSE-KMS. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only status, idempotency, and destructiveness. The description adds useful behavioral context beyond annotations: the 1 MiB size limit, the inline nature of the upload, and the fact that presigned URLs keep bytes from passing through the server. It does not detail overwrite/versioning behavior, but the annotations lower the burden here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three compact sentences with no filler. The purpose and size constraint are front-loaded, followed by parameter options and routing to alternatives. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given high schema coverage, present annotations, and no output schema, the description covers the core decision space well: size threshold, inline vs. presigned, and multipart alternative. It could be slightly more explicit that content or filePath must actually be supplied despite only bucket and key being marked required in the schema, but the imperative 'Provide base64-encoded content or a local file path' substantially mitigates that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all nine parameters. The description adds marginal value by clarifying that content is base64-encoded and that either base64 content or a local file path can be provided, but it does not need to compensate for missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Upload'), a specific resource ('a SMALL object inline (≤1 MiB) to a B2 bucket'), and the intended use cases ('manifests, sidecars, and tiny configs'). It distinguishes this tool from s3_get_presigned_url and multipart upload tools, so an agent can tell them apart without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool (SMALL inline objects ≤1 MiB) and when not to ('For real object data, generate a PutObject URL... or use the multipart tools for large objects'). It names the specific alternative tools and the condition that selects between them, leaving little to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
s3_upload_part_copyAIdempotent
Copy a part from an existing B2 object into an in-progress S3-compatible multipart upload. Use this to efficiently assemble large objects from existing parts without re-uploading data.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The destination object key. | |
| bucket | Yes | The destination bucket name. | |
| uploadId | Yes | The UploadId from s3_create_multipart_upload. | |
| copySource | Yes | The source object in 'bucket/key' format, e.g. 'my-bucket/path/to/file.dat'. URL-encode special characters in the key. | |
| partNumber | Yes | The part number (1–10000). | |
| copySourceRange | No | Byte range to copy from the source, e.g. 'bytes=0-104857599' for the first 100MB. | |
| copySourceVersionId | No | Version ID of the source object to copy from. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, idempotentHint=true, and destructiveHint=false, so the safety profile is established. The description adds contextual detail about assembling large objects without re-uploading, but does not disclose additional behavioral specifics such as failure modes, authentication requirements, or source-destination constraints. It neither contradicts nor substantially enriches the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The action is front-loaded and the use-case rationale follows immediately. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description and schema together are sufficient for invoking the tool, but since there is no output schema, the description does not explain what the response contains (e.g., the part ETag needed to complete the multipart upload). It also does not explicitly sequence the upload workflow, though uploadId referencing s3_create_multipart_upload implies it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter already has meaningful documentation. The tool description itself adds no parameter-level semantics beyond the schema, which puts this at the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Copy') and resource ('a part from an existing B2 object into an in-progress S3-compatible multipart upload'). This clearly distinguishes it from related siblings like s3_copy_object (whole object copy) and s3_put_object (new data upload).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence tells the user when to use this tool: to efficiently assemble large objects from existing parts without re-uploading data. It provides clear context for the multipart upload workflow, though it does not explicitly name alternative tools or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools target a distinct resource and action, but there is notable overlap between native B2 and S3-compatible surfaces (e.g., b2_update_bucket and s3_put_bucket_lifecycle, b2_unfinished_uploads and s3_list_multipart_uploads). Detailed descriptions help, but an agent could reasonably confuse the intended tool in several cases.
The b2_ and s3_ prefixes establish a clear pattern, and most tools follow verb_noun naming. Minor deviations include analytic tools like b2_largest_files, b2_egress_leaders, and b2_usage_growth that use noun-style names, plus s3_presign_upload_part versus s3_get_presigned_url.
Forty tools is a heavy surface, well beyond the 25-tool threshold where a tool set becomes difficult to navigate. The breadth is justified by dual B2/S3 APIs and partner/analytics features, but the count still imposes significant cognitive load and redundancy.
The set covers bucket CRUD, object operations, multipart uploads, presigned URLs, lifecycle, notifications, keys, retention/legal hold, partner group management, and usage analytics. Minor gaps exist—such as no explicit create/update/delete for groups and only a put for S3 lifecycle—but the workflows are largely complete.
Maintenance
Related MCP Connectors
MCP server for InsForge BaaS — database, storage, edge functions, and deployments
Cloud-hosted MCP server for durable AI memory
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP Hub: AI service discovery, per-user OAuth, and multi-service workflow orchestration
Related MCP Servers
- AlicenseBqualityCmaintenanceMCP server enabling AI models to list S3 buckets, objects, and download files securely.24MIT
- FlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server that provides a bridge between MCP-compatible clients and MinIO object storage. It exposes MinIO operations as MCP tools for seamless bucket management and object operations.4
- AlicenseNot gradedqualityAmaintenanceLightweight object storage with S3, HTTP, and MCP interfaces, enabling AI agents to store and retrieve files via structured tool definitions.4Do What The F*ck You Want To Public
- AlicenseNot gradedqualityDmaintenanceMCP server for AWS S3 and compatible object stores, enabling LLM clients to browse buckets and fetch objects.MIT No Attribution
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/backblaze-labs/b2-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server