mcp-s3 mcp · go object storage for ai.

Name: mcp-s3
Author: Craig Johnston

mcp-s3 is an MCP server that gives AI assistants safe, structured access to Amazon S3 and any S3-compatible store. List buckets, browse objects with prefix and delimiter, read content, write under guard rails, copy across buckets, and mint presigned URLs. Read-only by default, with size caps and prefix ACLs. Speaks to AWS S3, SeaweedFS, LocalStack, and anything else that talks the S3 wire protocol.

Run it standalone, or import it as a Go library and compose your own MCP server with custom auth, tenant isolation, and audit logging through middleware, interceptors, and transformers. Multi-account out of the box. Apache 2.0, part of the txn2 mcp data platform alongside mcp-trino and mcp-datahub.

§ 01 / install · run

Two ways to use it.

Run mcp-s3 as a standalone server and wire it to Claude, Cursor, or any MCP client. Or import the Go packages and compose a custom MCP server with your own auth, tenancy, and audit logic. Same toolkit, two surfaces.

SRV-001 · go · server docs ↗

standalone server

One binary. Wire to any MCP client over stdio.

Install with go install, Docker, or grab a release. Point it at AWS, SeaweedFS, or LocalStack via environment variables. Read-only mode is the default; flip MCP_S3_EXT_READONLY=false when you mean it. Add multiple connections through S3_ADDITIONAL_CONNECTIONS and let the AI pick.

~ / mcp-s3

$ go install github.com/txn2/mcp-s3/cmd/mcp-s3@latest

$ claude mcp add s3 \
    -e AWS_ACCESS_KEY_ID=$KEY \
    -e AWS_SECRET_ACCESS_KEY=$SECRET \
    -e AWS_REGION=us-east-1 \
    -- mcp-s3
  added: s3 (read-only, 10MB GET cap)

$ claude
# ask: list my buckets

LIB-002 · go · library docs ↗

go library

Compose a custom MCP server. Bring your own auth.

client.New returns a configured S3 handle. tools.NewToolkit packages the S3 operations as MCP tools. Register them on your own MCPServer, then attach Use middleware, AddInterceptor guards, and transformers for redaction or audit logging. No forking required.

~ / library

$ go get github.com/txn2/mcp-s3

// main.go
cfg := client.FromEnv()
s3, _ := client.New(ctx, &cfg)

kit := tools.NewToolkit(s3,
    tools.WithReadOnly(true),
    tools.WithMaxGetSize(10*1024*1024),
)
kit.RegisterTools(srv)
kit.Use(authMiddleware)

§ 02 / what it does

S3 as tools. Not a black box.

mcp-s3 exposes S3 as a small, deliberate set of MCP tools. Each tool maps to one bucket-or-object operation, with strict input validation, size caps, and clear error contracts.

001
list, read, browse
s3_list_buckets, s3_list_objects (prefix, delimiter, pagination), s3_get_object, s3_get_object_metadata. The read-side surface that is always safe to expose.

tools
002
read-only by default
MCP_S3_EXT_READONLY=true is the default. s3_put_object, s3_delete_object, and s3_copy_object are blocked unless explicitly enabled. Size caps via MCP_S3_MAX_GET_SIZE and MCP_S3_MAX_PUT_SIZE.

safety
003
multi-account & multi-cloud
Configure multiple connections via S3_ADDITIONAL_CONNECTIONS. Query production, staging, and a local SeaweedFS from the same MCP install. s3_list_connections lets the AI pick.

runtime
004
presigned urls
s3_presign_url mints time-bound GET or PUT URLs the AI can hand to a user. Useful for downloads, third-party uploads, and any flow that needs to escape the MCP transport.

share
005
middleware & interceptors
Wrap tool execution with Use middleware. Block or rewrite requests with interceptors. Redact, audit, or transform results post-execution. Compose enterprise concerns without forking the toolkit.

compose
006
aws s3, seaweedfs, localstack
Built on AWS SDK v2. Set S3_ENDPOINT and S3_USE_PATH_STYLE=true to point at any S3-compatible service. Same tools, same contract, no per-provider branches in your prompts.

backends
···
part of the txn2 mcp data platform
Sister projects: mcp-trino for federated SQL, mcp-datahub for metadata, mcp-data-platform as the catalog.

+ ecosystem

// open source

mcp-s3 is one of several open source components by Craig Johnston, sponsored by Deasil Works, Inc. and Plexara. Released under the Apache 2.0 license. Built to give AI assistants a safe, composable bridge to object storage.

github.com/txn2/mcp-s3 → txn2.com ↗ pkg.go.dev ↗ releases ↗