Introducing the Backblaze B2 MCP Server

Backblaze Inc. has launched the Backblaze B2 MCP Server, an open source server that connects AI agents to B2 Cloud Storage via the Model Context Protocol, enabling agents to perform storage operations such as creating buckets, generating short-lived upload URLs, and verifying uploads. The server enforces the permissions of the connected B2 application key, ensuring agents cannot bypass access boundaries, and supports up to 40 tools across the B2 Native API.

AI agents are getting very good at making things: reports, code builds, images, videos, datasets, customer exports, and backups. But generating a file is only half the job. The agent still needs somewhere durable to put it. That’s where B2 comes in. Today, we’re introducing the Backblaze B2 MCP Server https://github.com/backblaze-labs/b2-mcp : an open source server that gives AI agents a safe, standard way to operate cloud object storage. Introducing the Backblaze B2 MCP Server Model Context Protocol MCP provides a common way for AI agents to discover and use external tools. The Backblaze B2 MCP Server applies that model to Backblaze B2 Cloud Storage, connecting MCP-compatible clients to a focused set of storage operations. The server is open source and designed so the tools presented to the agent reflect the permissions of the connected B2 application key. And that last point is important. The MCP server does not invent a new permission model or grant an agent blanket access to your account. If the key can only read from one bucket, the agent’s usable tool set and reach are constrained accordingly. If the key does not permit an operation, the agent cannot use the MCP server to bypass that boundary. Why launch an MCP server? Storage has always met developers in two places: the API and the console. Agent tools are becoming a third, and increasingly the one where work starts. Our view is that infrastructure should be available inside the tool someone already has open, at the moment they need it. That spans a wide range of work: everyday tasks that produce outputs which need to be stored, AI workflows that read and write data as they run, and applications that require storage to handle files. A report or an export has to land somewhere durable. An application built around agents needs somewhere to put user uploads, generated assets, and datasets. Customers have also asked us how their own agents can administer their storage. MCP is what lets one implementation serve all of it. An MCP server provides these storage tools directly to the AI agents people use for everyday tasks and for coding, so the same credentials, scoping, transfer path, and destructive operation policy apply everywhere your team works. B2 is available inside the tools your teams already have open. See it in action Suppose an agent has prepared a customer export. Instead of handing it a general-purpose credential and writing the surrounding storage logic yourself, you could ask: “Prepare a private destination for this customer export. Keep it for 30 days and give me a secure way to upload it.” Depending on the application key’s permissions and the server’s policy settings, the agent can: 1. Create a private bucket or select an existing one the key can access. 2. Apply lifecycle or retention settings, depending on whether the export should expire automatically or be protected from deletion. 3. Generate a short-lived upload URL. 4. Verify that the export arrived. 5. Return a short-lived download URL to the intended recipient. For a large export, the bytes move directly to B2 using the short-lived URL; they do not need to pass through the model conversation or the MCP server. That keeps bulk data on the right path and leaves the agent responsible for orchestrating the work, not hauling the payload. Now imagine a follow-up request: “Delete that export.” The B2 MCP Server can require confirmation before the action proceeds or block destructive operations entirely, depending on how the server is configured. The same principle applies to changes that weaken protection, such as clearing retention or introducing lifecycle rules that schedule deletion. The result is a useful division of labor: The agent can set up the storage, move the file, and verify the outcome, while the B2 MCP server enforces the connected key’s limits and configured policy. Built for real storage work The B2 MCP Server includes up to 40 tools across the B2 Native API, B2’s S3 Compatible API, and purpose-built storage analytics. You do not need to expose all of them to every agent. The available surface adjusts to the connected key and the server’s policy settings. - Manage storage. Create and configure buckets, list and manage objects, define lifecycle rules, work with retention and legal holds, and use Object Lock where the workflow calls for stronger protection. - Move large files directly. Generate short-lived upload and download URLs, or use multipart transfers for large objects, so bulk data stays out of the model and MCP server. - Limit access. Connect a scoped B2 application key so the agent can see and use only the buckets and capabilities it needs. For normal storage work, a non-master key is the right starting point. - Gate destructive actions . Set the destructive-action policy to require confirmation, block the operation, or allow it in a trusted environment. Local use defaults to confirmation; hosted HTTP deployments default to blocking these calls. - Inspect usage. Find storage growth, identify egress leaders, locate the largest files in a bucket, and surface unfinished multipart uploads that may be consuming storage. Safety starts with the key An MCP server makes tools available to an agent; it should not make good access controls optional. With B2 MCP, the connected application key remains the first boundary. B2 application keys can be limited by bucket, capability, file prefix, and duration, giving developers a practical way to apply least privilege to agentic workflows. The server adds another layer around operations that deserve friction. Destructive and protection-weakening actions can require an explicit confirmation or be refused before execution. For hosted deployments, the project includes additional controls and deployment guidance for credential handling, authentication, allowed hosts and origins, rate limits, and logging. The goal is not to pretend an agent can never make a bad request. It is to give developers clear, enforceable boundaries around what the agent is allowed to do. Already use B2? Your agents can use it too If your application data, backups, media, or archives already live in B2, you do not need a separate storage product for agents. The MCP server works with standard B2 application keys and existing buckets. You can connect an existing key, but in most agentic workflows it is worth creating a narrower key for the job. A reporting agent might need read access to a specific prefix. An export workflow might need permission to write to one private bucket and generate a short-lived download link. A cleanup agent might need list access but no delete capability until a human approves the action. Try the B2 MCP Server One-click install Claude Desktop Download b2-mcp.mcpb from the latest release https://github.com/backblaze-labs/b2-mcp/releases/latest/download/b2-mcp.mcpb and double-click it. Claude Desktop opens, offers to install the extension, and prompts for your Application Key ID and Application Key Region and master key optional — no config file to edit, nothing pasted into the conversation. If your system hasn’t associated .mcpb files with Claude Desktop yet, open Settings → Extensions and install it from there, or drag the file onto that window. Run with npx any MCP client You need three things to get started: - A supported Node.js runtime. - A B2 application key. Use a non-master key and scope it as narrowly as the workflow allows. - An MCP-compatible client. The fastest way to run the server is with npx: npx -y @backblaze-labs/b2-mcp For Claude Desktop, add the following block to claude desktop config.json , substitute your application key values, and restart the client: json { "mcpServers": { "backblaze-b2": { "command": "npx", "args": "-y", "@backblaze-labs/b2-mcp" , "env": { "B2 APPLICATION KEY ID": "your-application-key-id", "B2 APPLICATION KEY": "your-application-key-secret" } } } } Do not paste the application key into the model conversation. Keep it in the client configuration or your deployment’s secret-management layer. Then try a deliberately simple first prompt: “List the buckets this key can access.” For copy-and-paste setup instructions for Cursor, VS Code, Cline, Windsurf, Zed, Continue, Goose, Claude.ai, and hosted deployments, see the client setup guide. Explore the GitHub repository https://github.com/backblaze-labs/b2-mcp or install the npm package https://www.npmjs.com/package/@backblaze-labs/b2-mcp . Join the webinar A safe way for agents to operate storage Agents need more than somewhere to put files. They need a safe way to operate storage: to prepare the right destination, move data on the right path, verify the outcome, and stop when a request exceeds their permissions or policy. The Backblaze B2 MCP Server https://github.com/backblaze-labs/b2-mcp brings those capabilities to the MCP clients developers are already using, while keeping B2 application keys and server-side safeguards in control. Try it with your existing B2 storage, or join the webinar to see the complete workflow.