S3 storage

Connect a bucket of Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, Google Cloud Storage or any S3-compatible storage. Agents list, read, write and delete its objects; the secret key stays with Sallyport.

On this page

Connect a bucket
What the agent calls
Which calls wait for you
Large files and binary data

The agent names an object. Sallyport signs the request with AWS Signature V4, sends it to your bucket and returns the answer. The agent never sees the access key or its secret.

Connect a bucket

Open Add a credential and choose S3 storage under Credential source.
Pick the Storage. The Region and the Storage address fill themselves; change the Region and the address follows it.
Enter the Bucket. Agents reach this bucket and nothing else on the storage.
Create a key at the storage that can reach this bucket only, and paste its Access key ID and Secret access key.
The Connection name is the bucket’s name until you change it. Pick the Workspace and the Environment.
Press Save and check the key. Sallyport seals the key, writes the connection and lists one object of the bucket with it.

The key’s page shows the result under “Where this key goes”. A wrong secret is rejected there, in the storage’s own words, before any agent tries it. Every agent of the workspace can use the bucket the moment it is saved.

Storage	Storage address	Region
Amazon S3	`https://s3.<region>.amazonaws.com`. The bucket goes into the host name: `https://<bucket>.s3.<region>.amazonaws.com`.	The bucket’s region, such as `eu-central-1`.
Cloudflare R2	The S3 API address from the R2 overview: `https://<account-id>.r2.cloudflarestorage.com`.	`auto`
Backblaze B2	`https://s3.<region>.backblazeb2.com`	The region in the bucket’s endpoint, such as `eu-central-003`.
Wasabi	`https://s3.<region>.wasabisys.com`	The bucket’s region, such as `eu-central-1`.
DigitalOcean Spaces	`https://<region>.digitaloceanspaces.com`	The datacenter, such as `fra1`.
Google Cloud Storage	`https://storage.googleapis.com`, with an HMAC key of a service account.	`auto`
Other S3-compatible storage	The HTTPS address of its S3 API: MinIO, Hetzner, Scaleway, OVH, IDrive e2 and others.	The region it signs for; `us-east-1` when it names none.

What the agent calls

The bucket’s tools end in _read and _write. Their description tells the agent how to list, read, write and delete, so it does not have to guess. The path is the full S3 path: on every storage but Amazon S3 it starts with the bucket.

JSON · list the objects under notes/ (the _read tool)

{
  "method": "GET",
  "path": "/reports/",
  "params": { "list-type": "2", "prefix": "notes/" }
}

JSON · write an object (the _write tool)

{
  "method": "PUT",
  "path": "/reports/notes/2026-09-30.md",
  "headers": { "Content-Type": "text/markdown", "x-amz-meta-author": "agent" },
  "body": "# Weekly notes",
  "intent": "Save this week's notes"
}

A read is GET /reports/notes/2026-09-30.md. A copy is a PUT with x-amz-copy-source: /reports/notes/2026-09-30.md. A delete is DELETE /reports/notes/2026-09-30.md. Answers are S3’s own XML.

Which calls wait for you

Call	Class
`GET` and `HEAD`: a listing, a download, an object’s metadata	read
`PUT` and `POST`: an upload, a copy, a multipart upload	write
`POST ?delete` that removes many objects at once	write
`DELETE`	destructive

An object’s name never changes its class: reading builds/run.log is a read. Calls run without asking until you decide otherwise; the rules are on the agent’s Access list. See Approvals.

Large files and binary data

The MCP tools carry text: CSV, JSON, logs, Markdown. For files of any kind, send the bytes through the HTTP proxy with the agent token. The path after /p/<connection-id> is the object’s key inside the bucket.

Shell · upload and download through the proxy

export SP_AGENT_TOKEN='<agent-token>'

curl --fail-with-body -X PUT \
  -H "Authorization: Bearer $SP_AGENT_TOKEN" \
  -H 'Content-Type: application/pdf' \
  -H 'X-Sallyport-Intent: Store the signed contract' \
  --data-binary @contract.pdf \
  "https://mcp.sallyport.cloud/p/<connection-id>/contracts/2026/acme.pdf"

curl --fail-with-body -H "Authorization: Bearer $SP_AGENT_TOKEN" \
  -o acme.pdf "https://mcp.sallyport.cloud/p/<connection-id>/contracts/2026/acme.pdf"

One upload through the proxy carries up to 32 MiB; one download up to 512 MiB. Split a larger file into a multipart upload.