mcp-s3-v1.2.0

mcp-s3 v1.2.0

Generic, open-source MCP server for Amazon S3 and S3-compatible object storage.

✨ Highlights

Streaming / multipart uploads are the headline of this release. A new PutObjectStream method on client.Client uploads objects from an io.Reader using the AWS SDK transfer manager — without buffering the full payload in memory. This makes large or unbounded sources (query exports, log streams) practical, where the existing []byte-based PutObject was bounded by available memory.

Alongside the feature, v1.2.0 rolls up a large batch of dependency, CI, and base-image updates that keep the supply chain current.

🚀 What's new

Streaming uploads — PutObjectStream (#104)

PutObject buffers the entire body in memory; PutObjectStream does not. It streams from any io.Reader via the AWS SDK transfer manager, splitting large bodies into parts and falling back to a single PUT for small ones.

out, err := s3Client.PutObjectStream(ctx, &client.PutObjectStreamInput{
    Bucket:      "my-bucket",
    Key:         "exports/large.csv",
    Body:        reader,            // any io.Reader
    ContentType: "text/csv",
    MaxBytes:    500 * 1024 * 1024, // optional bound; abort past this many bytes
})
if errors.Is(err, client.ErrStreamTooLarge) {
    // stream exceeded MaxBytes and was aborted before completing
}

Behavior and design:

• No full buffering — peak memory no longer scales with object size.
• MaxBytes bound — optional inclusive byte limit, enforced at the library level; exceeding it aborts the upload with the new sentinel client.ErrStreamTooLarge. (The size-limit MCP extension measures a buffered body's length and can't apply to a length-unknown stream, so the bound lives here.)
• Caller-controlled deadline — the per-operation S3_TIMEOUT is intentionally not applied to streaming uploads, which can legitimately run long. Control the deadline via context.Context.
• Library-only — exposed through pkg/client for composition; no new MCP tool. The read-only and size-limit extensions continue to guard the tool layer exactly as before.
• Honors your endpoint — the uploader shares the same configured S3 client, so custom endpoints / path-style addressing (SeaweedFS, MinIO, etc.) and credentials are respected.

Adds a dependency on the AWS SDK's feature/s3/transfermanager (currently a developer-preview module). It is isolated behind a small ObjectUploader interface so the implementation can be swapped without touching callers.

Documentation

• Re-skin to the txn2 design system with a hero mark, Open Graph card, and SEO improvements (#84).
• New Streaming uploads section in the README.

🔄 Dependencies & maintenance

• AWS SDK for Go v2 (S3 + grouped updates): #102, #98, #91, #87, #83, #82, #77, #74
• MCP Go SDK (modelcontextprotocol/go-sdk → 1.6.1): #99, #88, #78
• Docker: Alpine base-image digest bump (#79)
• CI / tooling: GoReleaser, QEMU, Buildx, CodeQL, golangci-lint, Cosign installer, Codecov, login-action, setup-go, upload-artifact, upload-pages — #101, #100, #97, #96, #95, #94, #93, #92, #90, #89, #86, #85, #81, #80, #76, #75, #73, #72

⬆️ Upgrade notes

No breaking changes. PutObject is unchanged and PutObjectStream is purely additive. Projects importing pkg/client will transitively pick up feature/s3/transfermanager — run go mod tidy after upgrading.

⚠️ Known issue (this release)

The .mcpb desktop-extension bundles and their Cosign signatures are not attached to this release. The pipeline's asset-upload step failed after GitHub's immutable-releases feature locked the published release before those bundles were added, so they could not be appended. Homebrew, Docker, the library/go install path, and the prebuilt archive assets below are unaffected. The MCPB bundles will ship in a follow-up release.

Full changelog: v1.1.0...v1.2.0

Installation

Homebrew (macOS)

brew install txn2/tap/mcp-s3

Claude Code CLI

claude mcp add s3 \
  -e AWS_REGION=us-east-1 \
  -e AWS_ACCESS_KEY_ID=your-key \
  -e AWS_SECRET_ACCESS_KEY=your-secret \
  -- mcp-s3

Docker

docker pull ghcr.io/txn2/mcp-s3:v1.2.0

Verification

All release artifacts are signed with Cosign. Verify with:

cosign verify-blob --bundle mcp-s3_1.2.0_linux_amd64.tar.gz.sigstore.json \
  mcp-s3_1.2.0_linux_amd64.tar.gz