AI accessAvailable on Stream Vessel Cloud

Give your AI a door, not a key.

Stream Vessel is a hosted S3 MCP server: secure S3 access for AI agents, for AWS S3 and every S3-compatible provider. Tiered, expiring tokens. Every call logged. No access keys in any config file.

Create a token Works with Claude Code, Cursor, VS Code and any MCP client.

The problem

A generic S3 MCP server wants your access key and secret in mcp.json. Full access to every bucket, no expiry, no log, and revoking it means rotating the key for everyone.

What it is

What is Stream Vessel MCP?

An MCP server for S3, hosted by Stream Vessel. The Model Context Protocol lets AI clients call tools; this server's tools list, search, read, write, copy, move and delete objects in the storage you connected to Stream Vessel Cloud. The AI authenticates with a Stream Vessel token, so your storage keys never leave Stream Vessel.

Why this matters, and how it compares with putting keys in an MCP config: secure S3 access for AI agents.

Clients

Which MCP clients can use it?

Claude Code. One claude mcp add command gives Claude S3 access through your token.
Cursor. Cursor S3 access through a deep link or mcp.json.
VS Code. A deep link or mcp.json.
Other MCP clients. Any client that connects to a remote HTTP server with an Authorization header.

Coming soon OAuth remote connectors, for hosted AI clients that do not accept a bearer token.

How it works

Token, connect kit, work.

Create a token

Choose READ, WRITE or FULL, and an expiry: 30 days, 90 days, a year, or a date you pick.

Copy the connect kit

A Claude Code command, an mcp.json block, or a Cursor or VS Code deep link.

Let the agent work

It lists, searches, reads, writes, copies, moves and deletes, within its tier. You watch the audit log.

In Stream Vessel Cloud

One page: tokens, connect kit, audit.

A newly created MCP token with the connect kit: server URL, Claude Code command, Add to Cursor and Add to VS Code

# Claude Code
claude mcp add stream-vessel \
  --transport http https://app.streamvessel.com/mcp \
  --header "Authorization: Bearer svmt_…"

// mcp.json · Cursor, VS Code, any client
{
  "mcpServers": {
    "stream-vessel": {
      "url": "https://app.streamvessel.com/mcp",
      "headers": { "Authorization": "Bearer svmt_…" }
    }
  }
}

16 tools

Everything the explorer can do, as tools.

Discover

list_connections
list_buckets
list_objects
find_objects
stat_prefix

Read

read_object
get_object_metadata
create_download_link

Write

write_object
set_object_metadata
create_upload_link
copy_object
move_object

Delete

delete_object
delete_objects
delete_prefix

Safety

Built to be revoked.

Tokens expire on the schedule you set. 30 or 90 days, a year, or a date you pick. Expired tokens stop working on their own.
Revoke any time from the token list. The key underneath never moves.
Audit log of every tool call, and rate limits.
Your keys bound the token. The agent reaches what your connections' keys reach. A key limited to one bucket, such as a bucket-scoped R2 token or a bucket-restricted B2 application key, keeps the agent in that bucket.
Shared connections included. A token works on a connection shared with you, at the lower of the token's tier and the share's level.

Coming soon

Tighter scopes, more clients.

Restrict a token to chosen connections, buckets and prefixes
Scoped connections, s3://bucket/prefix/, on Stream Vessel Cloud
Remote connectors with OAuth for hosted AI clients
MCP on self-hosted

Providers

Which storage can AI access?

Every provider Stream Vessel Cloud connects to. The endpoint must be reachable from the internet, because tool calls run on Stream Vessel's servers.

AWS S3 →Cloudflare R2 →Backblaze B2 →Wasabi →MinIO →DigitalOcean Spaces →IDrive e2 →

FAQ

MCP questions

What is Stream Vessel MCP?

A hosted MCP server at https://app.streamvessel.com/mcp that gives AI clients tools to work with the S3 and S3-compatible storage you connected to Stream Vessel Cloud. The client authenticates with a Stream Vessel token, never with your storage keys.

Which MCP clients can use it?

Claude Code, Cursor and VS Code have ready-made setup in the connect kit. Any other MCP client that can connect to a remote HTTP server and send an Authorization header works with the same mcp.json settings. Clients that only support OAuth remote connectors are not supported yet; OAuth is coming soon.

How are my storage credentials protected?

They stay encrypted with AES-256 on Stream Vessel servers. The AI client gets only a token, which you can revoke or let expire without touching the key.

Can I restrict what the AI can reach?

Each token has a tier, READ, WRITE or FULL, and an expiry. What it can reach is bounded by your connections' keys, so a key limited to one bucket keeps the agent in that bucket. Restricting a token to chosen connections, buckets and prefixes is coming soon.

Are AI operations auditable?

Yes. Every tool call is recorded in a server-side audit log, and tokens are rate-limited.

Which storage providers can the AI access?

Any connection in Stream Vessel Cloud: AWS S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, MinIO, IDrive e2 and other S3-compatible endpoints reachable from the internet, plus connections shared with you.

Your buckets, your AI, your rules.

Create a token About Stream Vessel Cloud