minio-mcp offers bounded list, read, stat and write over MinIO, in two modes the
session is opened in - which, in the workflow manager, is the catalog entry the
flow author picked. The model never chooses between them.
Internal: the session arrives with x-minio-scope set to the execution's id. The
server uses the platform's MinIO from its own environment and, at initialize,
creates the bucket <prefix><execution id> when it is missing - the counterpart
of the coding agent creating an execution's workspace directory. The model sees
four tools and keys; no endpoint, no credential, no session to open.
The prefix (exec- by default) cannot be emptied. It is what keeps a caller
holding the API key inside the buckets this server made, rather than free to
name any bucket on that MinIO - the storage nodes' among them. The scope header
is pinned for the session, as dev-server's preview key is, and a session whose
bucket cannot be had never opens.
External: no header. The model opens sessions with endpoint, bucket and
credentials itself, as before, limited by MINIO_MCP_ALLOWED_ENDPOINTS.
Wired into the stack behind /minio/ and :3104. No delete tool in either mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lucio Lelii
be5690309f