Skip to main content

Connecting an AI agent over MCP

Connecting an AI agent to STRG lets it create buckets, read and write objects and manage access keys for you, asked in plain words - and if you have no account yet, connecting signs you up. The server is at https://mcp.strg.com/mcp, and the easiest start is Connect your own agent in the dashboard's top bar, which shows the setup for your client ready to copy.

Setting up your client​

Each client has its own place for MCP servers. The configuration needs only the server URL, and the client opens a browser sign-in when it first connects:

claude mcp add --transport http strg https://mcp.strg.com/mcp

With --scope project, it goes into .mcp.json in your project instead, ready to share with your team:

.mcp.json
{
  "mcpServers": {
    "strg": {
      "type": "http",
      "url": "https://mcp.strg.com/mcp"
    }
  }
}

The sign-in then runs from /mcp in Claude Code, or from your shell with claude mcp login strg.

What happens when you connect​

A browser window signs you in to STRG - or signs you up, with an email code or GitHub. You then choose the access key the agent will act as: its buckets, an optional key prefix and its permissions, on the same form as the Access Keys page (Access keys). Granting Manage Object Lock asks you to confirm once more, since an Object Lock can never be undone. Connect creates the key and takes you back to your client. The key appears on the Access Keys page like any other, and deleting it there disconnects the agent.

Connecting with an access key instead​

A client can also skip the sign-in and send an access key holding Use the MCP server as a header:

Authorization: Bearer <access key id>:<secret access key>

The dashboard's Connect your agent dialog makes this easy: under Static credentials it creates such a key and shows each client's setup with the key written in. The secret is shown only that once.

Example prompts​

Once connected, an agent takes requests in plain words, such as:

  • Create a private bucket called my-bucket in eu-central-1.
  • List my buckets and the endpoint for each.
  • Create an access key that can only read and list objects in my-bucket, and show me how to use it with the AWS CLI.
  • Create an access key that can read and write objects under photos/ in my-bucket only.
  • Revoke the access key labelled ci-uploader.
  • Upload this file to my-bucket as notes/todo.md.
  • Give me a download link for photos/2024/cat.jpg in my-bucket that is valid for one day.
  • Set up CORS on my-bucket so that my web app at https://example.com can upload from the browser.
  • Add a lifecycle rule to my-bucket that deletes old versions after 30 days.

What an agent can do​

An agent acts as one access key, and can do exactly what that key permits - its permissions, its buckets and its key prefix - so its reach is always the one you gave it when connecting. A key the agent creates never exceeds its own. Billing and account settings stay with you, in the dashboard. If the key has Act without confirmation, the agent also receives its secret access key, so that it can configure its own S3 tools for bulk transfers.

What you are asked to confirm​

Unless the key has Act without confirmation, your MCP client asks you before the agent does anything that cannot be undone - in broad terms, deleting object versions or buckets, locking objects, changing lifecycle rules, making a bucket public, and creating or revoking access keys. The question says what is affected, in plain words, and nothing happens until you accept. Everything else - reads, uploads, ordinary deletes - simply runs, since versioning keeps an earlier version to go back to. A client that cannot ask is turned away rather than let through, so a question is never skipped.

A card first​

Connecting creates an access key, so an account without a verified card is asked to add one on the connect page first. Until then, the tools that create a bucket or an access key answer that a card is needed and that only you can add one - Billing covers it.

Next steps​

  • Access keys - every permission a key can carry.
  • Object Lock - worth reading before granting an agent Manage Object Lock.
  • The S3 API - the operations available and how STRG differs from Amazon S3.
  • Billing - your card and your invoices.
View as Markdown