Skip to main content
Glama

s3-mcp

A generic S3-protocol MCP server (stdio) that works against any S3-compatible endpoint — RustFS, MinIO, Cloudflare R2, Backblaze B2, AWS S3 — not just AWS.

Single Python package, one boto3 client created at startup, configuration via environment variables only. Built on the official mcp SDK (high-level server API) and boto3.

Configuration (environment variables)

Variable

Required

Default

Description

S3_ENDPOINT_URL

no

(unset)

S3-compatible endpoint; omit to target real AWS

AWS_REGION

no

us-east-1

Region for signing and bucket creation

AWS_ACCESS_KEY_ID

yes

—

Access key

AWS_SECRET_ACCESS_KEY

yes

—

Secret key

S3_PATH_STYLE

no

true

Path-style addressing (https://host/bucket/key) — required by most non-AWS stores

S3_TLS_INSECURE

no

false

true disables TLS certificate verification (self-signed endpoints)

Booleans accept true/false/1/0/yes/no (case-insensitive). Missing credentials or invalid booleans abort startup with a clear error.

Related MCP server: MinIO MCP Server

Tools

Tool

Read-only hint

list_buckets()

yes

list_objects(bucket, prefix="", max_keys=1000)

yes

get_object(bucket, key) → text if UTF-8 else {base64, content_type}

yes

stat_object(bucket, key)

yes

presign_get(bucket, key, expires_s=3600)

yes

put_object(bucket, key, body, base64=false)

no

delete_object(bucket, key)

no

copy_object(src_bucket, src_key, dst_bucket, dst_key)

no

create_bucket(bucket)

no

delete_bucket(bucket)

no

presign_put(bucket, key, expires_s=3600)

no

Tool errors are raised as short RuntimeError messages and surfaced by MCP as error results. Presigned URLs are capped at 7 days (604800 s), per SigV4.

Example configurations

RustFS with a self-signed certificate

{
  "mcpServers": {
    "s3-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "S3_ENDPOINT_URL=https://rustfs.local:9000",
        "-e", "S3_TLS_INSECURE=true",
        "-e", "AWS_REGION=us-east-1",
        "-e", "AWS_ACCESS_KEY_ID",
        "-e", "AWS_SECRET_ACCESS_KEY",
        "ghcr.io/jakeperalta7/s3-mcp:latest"
      ]
    }
  }
}

-e VAR without a value passes the variable through from your shell, so credentials never appear in the config file.

MinIO

{
  "mcpServers": {
    "s3-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "S3_ENDPOINT_URL=http://localhost:9000",
        "-e", "AWS_REGION=us-east-1",
        "-e", "AWS_ACCESS_KEY_ID",
        "-e", "AWS_SECRET_ACCESS_KEY",
        "ghcr.io/jakeperalta7/s3-mcp:latest"
      ]
    }
  }
}

AWS S3

Omit S3_ENDPOINT_URL; standard AWS credential/region resolution applies:

{
  "mcpServers": {
    "s3-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "AWS_REGION",
        "-e", "AWS_ACCESS_KEY_ID",
        "-e", "AWS_SECRET_ACCESS_KEY",
        "ghcr.io/jakeperalta7/s3-mcp:latest"
      ]
    }
  }
}

Without Docker (uv)

uvx --from git+https://github.com/JakePeralta7/s3-mcp s3-mcp
{
  "mcpServers": {
    "s3-mcp": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/JakePeralta7/s3-mcp", "s3-mcp"],
      "env": {
        "S3_ENDPOINT_URL": "http://localhost:9000",
        "AWS_ACCESS_KEY_ID": "...",
        "AWS_SECRET_ACCESS_KEY": "..."
      }
    }
  }
}

Development

uv sync --group dev   # install deps into .venv
uv run pytest -q      # unit tests (boto3 mocked, no network)
docker build -t s3-mcp:dev .

Entrypoint: python -m s3_mcp (stdio transport only).

Releasing

Every push to main runs tests, then publishes ghcr.io/<owner>/<repo>:<version> + :latest, where <version> is read from version in pyproject.toml. To release, bump the version and merge to main. Git tags are not used.

License

MIT

Available Tools

11 tools
copy_objectC

Copy an object within or across buckets on the same endpoint.

Inputs: dst_key (required), src_key (required), dst_bucket (required), src_bucket (required). Returns: object

create_bucketC

Create a bucket in the configured region.

Inputs: bucket (required). Returns: object

delete_bucketA

Delete a bucket (must be empty).

Inputs: bucket (required). Returns: object

delete_objectC

Delete an object from a bucket.

Inputs: key (required), bucket (required). Returns: object

get_objectA
Read-only

Read an object. UTF-8 content returns as text; anything else as base64.

Inputs: key (required), bucket (required). Returns: object

list_bucketsA
Read-only

List all buckets accessible with the configured credentials.

Inputs: no named parameters. Returns: result

list_objectsA
Read-only

List objects in a bucket (single page, up to max_keys).

Returns objects with key/size/last_modified plus a truncated flag when more results exist.

Inputs: bucket (required), prefix, max_keys. Returns: object

presign_getB
Read-only

Generate a pre-signed GET URL valid for expires_s seconds (max 604800).

Inputs: key (required), bucket (required), expires_s. Returns: result

presign_putC

Generate a pre-signed PUT URL valid for expires_s seconds (max 604800).

Inputs: key (required), bucket (required), expires_s. Returns: result

put_objectC

Write an object. Set base64=true when body is base64-encoded binary.

Inputs: key (required), body (required), bucket (required), base64. Returns: object

stat_objectA
Read-only

Get object metadata (size, etag, content type, last modified).

Inputs: key (required), bucket (required). Returns: object

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.5/5.0

    Scored across 11 tools

    Disambiguation5/5

    Every tool maps to a distinct S3 operation: bucket listing/creation/deletion, object listing/read/metadata/write/delete/copy, and presigned URL generation for GET vs PUT. There is no functional overlap that would cause an agent to select the wrong tool.

    Naming Consistency5/5

    All tool names follow the same snake_case verb_noun pattern (list_buckets, get_object, presign_put, create_bucket, etc.). The naming is predictable and consistent across the entire surface.

    Tool Count5/5

    With 11 tools, the set is well-scoped for an S3-focused server. Each tool covers a core operation without extraneous additions or redundant convenience wrappers.

    Completeness4/5

    The server covers bucket lifecycle and object CRUD, including copying and presigned URLs, so common workflows are fully supported. Minor gaps exist around pagination for large object listings and advanced operations like multipart uploads, but these are not severe for typical usage.

    Maintenance

    ActivityActive
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      F
      maintenance
      Enables interaction with AWS S3 through MCP, supporting bucket and object management, lifecycle configurations, tagging, policies, CORS settings, presigned URLs, and file uploads/downloads.
      3
      MIT
    • F
      license
      A
      quality
      D
      maintenance
      Provides tools for interacting with MinIO and S3-compatible object storage through MCP clients like Claude. It enables comprehensive bucket and object management, including listing, creating, uploading, and generating presigned URLs.
      13
      2
      -
    • A
      license
      A
      quality
      D
      maintenance
      Enables MCP clients to connect to AWS S3 buckets, list, upload, and read objects in various formats, supporting public and private buckets with multiple transport modes.
      4
      MIT
    • A
      license
      Not graded
      quality
      B
      maintenance
      Provides MCP tools for AWS S3 and S3-compatible storage, enabling file upload, download, listing, deletion, and temporary remote file staging via natural language.
      BSD 3-Clause