@storage4everyone/mcp 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -71
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,75 +1,9 @@
|
|
|
1
|
-
#
|
|
1
|
+
# @storage4everyone/mcp
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
A [Model Context Protocol](https://modelcontextprotocol.io) server for **Storage4Everyone (S4E)** cloud object storage.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
Lets AI agents such as Claude Code, Claude Desktop and Cursor list, download, upload and delete files in your S4E buckets, using your own API key.
|
|
6
6
|
|
|
7
|
-
|
|
7
|
+
📘 Full documentation: [docs.storage4everyone.com](https://docs.storage4everyone.com)
|
|
8
8
|
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
- **Scopes:** `storage:read` only, unless the agent must upload or delete.
|
|
12
|
-
- **Buckets:** choose only the buckets the agent needs.
|
|
13
|
-
- **Expiry:** set one (for example 30 days).
|
|
14
|
-
|
|
15
|
-
Revoke the key in the dashboard to cut off the agent. Revocation takes effect within about a minute.
|
|
16
|
-
|
|
17
|
-
## 2. Add it to your agent
|
|
18
|
-
|
|
19
|
-
Claude Code:
|
|
20
|
-
|
|
21
|
-
```sh
|
|
22
|
-
claude mcp add s4e --env S4E_API_KEY=s4e_live_... --env S4E_BUCKET=bkt_... -- npx -y @storage4everyone/mcp
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
Claude Desktop, Cursor and other clients use a JSON config like this:
|
|
26
|
-
|
|
27
|
-
```json
|
|
28
|
-
{
|
|
29
|
-
"mcpServers": {
|
|
30
|
-
"s4e": {
|
|
31
|
-
"command": "npx",
|
|
32
|
-
"args": ["-y", "@storage4everyone/mcp"],
|
|
33
|
-
"env": {
|
|
34
|
-
"S4E_API_KEY": "s4e_live_...",
|
|
35
|
-
"S4E_BUCKET": "bkt_...",
|
|
36
|
-
"S4E_MCP_ROOT": "/path/to/agent-files"
|
|
37
|
-
}
|
|
38
|
-
}
|
|
39
|
-
}
|
|
40
|
-
}
|
|
41
|
-
```
|
|
42
|
-
|
|
43
|
-
On Windows, some clients need `"command": "cmd"` and `"args": ["/c", "npx", "-y", "@storage4everyone/mcp"]`.
|
|
44
|
-
|
|
45
|
-
## 3. Settings
|
|
46
|
-
|
|
47
|
-
| Variable | Required | Meaning |
|
|
48
|
-
| --- | --- | --- |
|
|
49
|
-
| `S4E_API_KEY` | Yes | The agent's API key. Read from the environment only; never passed as a tool argument. |
|
|
50
|
-
| `S4E_BUCKET` | No | Default bucket (`bkt_…`, name, or `s4e://workspace/bucket`) when the agent does not name one. |
|
|
51
|
-
| `S4E_MCP_ROOT` | No | The only local folder the server reads uploads from and writes downloads to. Defaults to the folder the agent app starts it in. Use a dedicated folder. |
|
|
52
|
-
| `S4E_MCP_ALLOW_WRITE` | No | Set to `true` to enable `upload_file` and `delete_object`. Off by default. |
|
|
53
|
-
|
|
54
|
-
## 4. Tools
|
|
55
|
-
|
|
56
|
-
| Tool | What it does | Needs |
|
|
57
|
-
| --- | --- | --- |
|
|
58
|
-
| `list_buckets` | Lists buckets the key can access | `storage:read` |
|
|
59
|
-
| `list_objects` | Lists files in a bucket (name, size, type, upload time); optional prefix; up to 500 per call | `storage:read` |
|
|
60
|
-
| `download_file` | Saves a file into `S4E_MCP_ROOT` and returns the saved path. Will not overwrite unless `overwrite: true` | `storage:read` |
|
|
61
|
-
| `upload_file` | Uploads a file from `S4E_MCP_ROOT` (up to 5 GiB; large files are sent in parts) | `storage:write` + `S4E_MCP_ALLOW_WRITE=true` |
|
|
62
|
-
| `delete_object` | Deletes a file (paid plans move it to the Trash Bin) | `storage:write` + `S4E_MCP_ALLOW_WRITE=true` |
|
|
63
|
-
|
|
64
|
-
The service may assign stored file names on upload; use the returned `fileName` afterwards.
|
|
65
|
-
|
|
66
|
-
Not included: share links, usage figures, creating buckets, client apps and browser sessions. These need the dashboard.
|
|
67
|
-
|
|
68
|
-
## 5. Security
|
|
69
|
-
|
|
70
|
-
- **The server decides what is allowed.** The MCP package adds no permissions. A read-only key cannot upload, even with `S4E_MCP_ALLOW_WRITE=true`.
|
|
71
|
-
- **Local folder sandbox.** Paths outside `S4E_MCP_ROOT` are refused, including `..`, other absolute paths, and symlinks or junctions that point outside it. This stops a misled agent from uploading files such as SSH keys or writing outside the folder.
|
|
72
|
-
- **No secrets in the agent's context.** Tool results never contain the API key or signed download URLs, and error messages are scrubbed of both. Downloads go to disk; file contents are not returned to the model.
|
|
73
|
-
- **File names are data.** Treat names in listings as untrusted text. Agents should not follow instructions found in file names or downloaded files.
|
|
74
|
-
- **Rate limits and quotas** are the same as for any API client. When a limit is hit, the agent gets the error code and the retry time; the server does not retry automatically.
|
|
75
|
-
- **Your agent provider sees tool results.** File names, sizes and bucket names returned to the agent are sent to whichever AI service runs it, under that service's terms.
|
|
9
|
+
License: Apache-2.0
|
package/package.json
CHANGED