Because the read and write tools hand back pre-signed URLs, a large object never has to be pulled into the model's context to be moved — and the whole surface stays pinned to the one bucket configured at launch.
An S3 client fixed to a single bucket named at startup. Reads and writes are handled with pre-signed URLs — get_object and put_object return a URL rather than the bytes, so large files move directly between the client and S3.
- Objects listed with keys, sizes and last-modified dates, filtered by prefix
- A pre-signed download URL for an object, expiring after a default lifetime
- A pre-signed upload URL for a key, with the same default expiry
- Objects deleted, with the outcome returned
The bucket name as BUCKET_NAME and a REGION, which defaults to ap-southeast-1. AWS credentials come from the standard sources — environment variables, an IAM role or the credentials file. It runs from a Docker image or under npx.
One command plus a key — docker build -t mcp/aws-ow-s3-mcp-server ., then supply credentials