RawTree MCP Server

Official

by rawtreedb

Overview Schema Source Related Servers Discussions Admin

TypeScript

Hybrid

Verify Cluster S3 Access

verify-cluster-s3-access

Idempotent

Purpose: Verify that RawTree can use a customer IAM role to access customer-owned S3 storage before cluster creation.

Instructions

Purpose: Verify that RawTree can use a customer IAM role to access customer-owned S3 storage before cluster creation.

Returns: Whether access was verified and a human-readable result message.

Behavior: RawTree assumes roleArn using s3StorageAccess.externalId, checks the data and backup bucket locations, lists each configured path, and writes, reads, then removes a temporary probe object under each path. Paths are optional and default to the bucket root. Both configured buckets must be in the cluster environment's AWS region.

Auth: The RawTree API requires a user access token with organization admin access. Authorization is enforced by the API.

When to use: Use this tool after the IAM trust and permissions policies are configured and immediately before create-cluster whenever its optional s3Storage field will be provided. It is unnecessary when RawTree-managed storage will be used.

Safety: This check temporarily writes to and deletes from both configured destinations. Confirm the exact organization, buckets, paths, role ARN, and External ID before running it. The IAM trust policy's External ID must match s3StorageAccess.externalId exactly.

Reliability: The check is safe to retry. Newly changed IAM policies may require a short propagation delay before verification succeeds.

Input Schema

Name	Required	Description
`regionId`	No	Region ID returned by list-regions. Use the same region for sizes, S3 verification and creation. Omit for the default backend.
`s3Storage`	Yes	Customer-owned S3 configuration to verify before cluster creation.
`organization`	Yes	Organization that will own the cluster.
`s3StorageAccess`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed16 schema fields changedv0.4.2Oct 21, 2026

addedInput schema / additionalProperties
```
Added value: +false
```

addedInput schema / properties / regionId

Added value: +{
+  "description": "Region ID returned by list-regions. Use the same region for sizes, S3 verification and creation. Omit for the default backend.",
+  "format": "uuid",
+  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+  "type": "string"
+}

addedInput schema / properties / s3Storage / additionalProperties
```
Added value: +false
```
addedInput schema / properties / s3Storage / properties / backups / additionalProperties
```
Added value: +false
```

changedInput schema / properties / s3Storage / properties / backups / description

Previous value: -"Customer-owned bucket and optional key prefix for backups."New value: +"Destination for backups."

addedInput schema / properties / s3Storage / properties / backups / properties / bucket / description
```
Added value: +"Customer-owned S3 bucket."
```
addedInput schema / properties / s3Storage / properties / backups / properties / path / description
```
Added value: +"Optional object-key prefix; defaults to the bucket root."
```
addedInput schema / properties / s3Storage / properties / data / additionalProperties
```
Added value: +false
```

changedInput schema / properties / s3Storage / properties / data / description

Previous value: -"Customer-owned bucket and optional key prefix for data."New value: +"Destination for table data."

addedInput schema / properties / s3Storage / properties / data / properties / bucket / description
```
Added value: +"Customer-owned S3 bucket."
```
addedInput schema / properties / s3Storage / properties / data / properties / path / description
```
Added value: +"Optional object-key prefix; defaults to the bucket root."
```

removedInput schema / properties / s3Storage / properties / externalId

Removed value: -{
-  "description": "External ID required by the IAM role trust policy. It must exactly match the value configured in AWS.",
-  "maxLength": 1224,
-  "minLength": 2,
-  "pattern": "^[A-Za-z0-9_+=,.@:/-]+$",
-  "type": "string"
-}

changedInput schema / properties / s3Storage / properties / roleArn / description

Previous value: -"ARN of the customer IAM role that RawTree may assume to access the configured buckets."New value: +"ARN of the customer IAM role RawTree may assume."

changedInput schema / properties / s3Storage / required

Previous value: -[
-  "data",
-  "backups",
-  "roleArn",
-  "externalId"
-]New value: +[
+  "data",
+  "backups",
+  "roleArn"
+]

addedInput schema / properties / s3StorageAccess

Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "externalId": {
+      "description": "Immutable cluster External ID. Use this exact value in customer IAM role trust policies.",
+      "maxLength": 1224,
+      "minLength": 2,
+      "pattern": "^[A-Za-z0-9_+=,.@:/-]+$",
+      "type": "string"
+    },
+    "resourceTag": {
+      "description": "Immutable rawtree.com/cluster tag value for S3 storage access. Generated by the API when omitted.",
+      "maxLength": 256,
+      "minLength": 1,
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "externalId"
+  ],
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "organization",
-  "s3Storage"
-]New value: +[
+  "organization",
+  "s3StorageAccess",
+  "s3Storage"
+]

Addedv0.3.2Sep 12, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial detail beyond the annotations: it discloses that the check temporarily writes, reads, and deletes a probe object under each path, that both buckets must live in the cluster's AWS region, the admin-token requirement, and that new IAM policies may need propagation time. This also reconciles the destructiveHint=false annotation with the described temporary writes — a genuinely important disclosure for an agent about to touch customer buckets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Bold section headers front-load purpose, return, behavior, auth, and safety, so an agent can scan to the needed part. Slightly long, with some overlap between the Behavior and Safety sections, but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers return value shape despite no output schema, documents auth, retry semantics, and the nested data/backups/roleArn structure, and flags the exact preconditions (region matching, External ID match). Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 75% schema coverage the baseline is 3, and the description goes further: it explains that paths are optional and default to the bucket root, that the trust policy's External ID must equal s3StorageAccess.externalId exactly, and that roleArn is assumed using that External ID. It does not explain regionId or resourceTag, which remain schema-only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: verify that RawTree can assume a customer IAM role and access customer-owned S3 before cluster creation. The pre-cluster-creation framing distinguishes it from the sibling verify-database-s3-access and from create-cluster itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit sequencing guidance ('after the IAM trust and permissions policies are configured and immediately before create-cluster whenever its optional s3Storage field will be provided') plus an explicit exclusion ('unnecessary when RawTree-managed storage will be used'). No inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Verify Cluster S3 Access

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools