Skip to main content
mcpSource-backedReview first Safety Privacy
Tigris MCP Server logo

Tigris MCP Server

The official Tigris MCP server (@tigrisdata/tigris-mcp-server) that connects AI agents to Tigris, a high-performance S3-compatible object storage system — listing, creating, and deleting buckets; listing, uploading, and deleting objects; creating folders and files; and generating shareable links — using S3-style access keys against the Tigris endpoint.

by tigrisdata · submitted by davion-knight·added 2026-07-08·
HarnessClaude CodeCodexCursorClaude Desktop
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://github.com/tigrisdata/tigris-mcp-server/blob/main/README.md, https://github.com/tigrisdata/tigris-mcp-server, https://www.tigrisdata.com/
Brand
Tigris MCP Server
Brand domain
tigrisdata.com
Brand asset source
brandfetch
Safety notes
The server can create and delete buckets and objects, so tools like bucket deletion and object deletion permanently remove data from your Tigris storage., The upload tool reads a local file path and writes it to a bucket, so it can access files on your machine and copy them to remote storage., Generating a shareable link produces a URL that grants access to an object; be careful sharing it, as anyone with the link may read that object., The S3 access key and secret grant access to your Tigris storage; scope the key's permissions and treat the credentials as secrets., Tigris recommends the Docker runtime over npx for better sandboxing, since the server holds your credentials and can read local files for upload.
Privacy notes
The server accesses your Tigris buckets with your keys; object listings, contents, and metadata it returns are passed to the LLM/MCP client., Stored objects can include AI models, training data, database backups, logs, or user uploads, which may be sensitive, so avoid exposing production data to the model unnecessarily., The upload tool reads local files by path; shareable links can expose object contents beyond the current session., Credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) live in your MCP client config env block — keep that config out of version control and restrict access to it.
Author
tigrisdata
Submitted by
davion-knight
Claim status
unclaimed
Last verified
2026-07-08

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

78

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Complete

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    Registry metadata indicates a reviewed listing.

    Done

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Adoption plan

Balanced adoption plan

Current risk score 16/100. Use staged verification before broader rollout.

Risk 16

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    Listing has review metadata.

    Done
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Required evidence gates are covered (5/6 signals complete).

Risk 15

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Present

Review metadata is present.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required evidence gates are covered for this preset.

Decision timeline

Decision timeline · balanced

5/6 steps complete with no blocking gaps for this preset.

Risk 14

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is available.

Done

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

No required blockers for this timeline preset.

Safety notes

  • The server can create and delete buckets and objects, so tools like bucket deletion and object deletion permanently remove data from your Tigris storage.
  • The upload tool reads a local file path and writes it to a bucket, so it can access files on your machine and copy them to remote storage.
  • Generating a shareable link produces a URL that grants access to an object; be careful sharing it, as anyone with the link may read that object.
  • The S3 access key and secret grant access to your Tigris storage; scope the key's permissions and treat the credentials as secrets.
  • Tigris recommends the Docker runtime over npx for better sandboxing, since the server holds your credentials and can read local files for upload.

Privacy notes

  • The server accesses your Tigris buckets with your keys; object listings, contents, and metadata it returns are passed to the LLM/MCP client.
  • Stored objects can include AI models, training data, database backups, logs, or user uploads, which may be sensitive, so avoid exposing production data to the model unnecessarily.
  • The upload tool reads local files by path; shareable links can expose object contents beyond the current session.
  • Credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) live in your MCP client config env block — keep that config out of version control and restrict access to it.

Prerequisites

  • Node.js and npm (the server runs via `npx -y @tigrisdata/tigris-mcp-server run`), or Docker (recommended for sandboxing)
  • A Tigris account and an S3 access key pair from the Tigris console
  • The `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_ENDPOINT_URL_S3` values for your account
  • An MCP-compatible client (Claude Desktop, Cursor, VS Code, etc.)

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Tool listing metadata
Full copyable content
{
  "mcpServers": {
    "tigris-mcp-server": {
      "command": "npx",
      "args": ["-y", "@tigrisdata/tigris-mcp-server", "run"],
      "env": {
        "AWS_ACCESS_KEY_ID": "YOUR_AWS_ACCESS_KEY_ID",
        "AWS_SECRET_ACCESS_KEY": "YOUR_AWS_SECRET_ACCESS_KEY",
        "AWS_ENDPOINT_URL_S3": "https://fly.storage.tigris.dev"
      }
    }
  }
}

About this resource

Content

The Tigris MCP Server is the official Model Context Protocol server maintained by Tigris Data. It connects AI agents to Tigris — a high-performance, S3-compatible object storage system for multi-cloud and AI workloads — for bucket and object management: listing, creating, and deleting buckets; listing, uploading, and deleting objects; creating folders and files; and generating shareable links.

It ships as the npm package @tigrisdata/tigris-mcp-server (v1.14.0, MIT), runs over stdio via npx (or Docker, which the project recommends for better sandboxing), and authenticates with S3-style access keys (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) against the Tigris endpoint (AWS_ENDPOINT_URL_S3). Setup details live in the repository README.

Source Review

The following real repository and package sources were fetched and reviewed for this entry:

  • README.md — the npx/Docker install commands, the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_ENDPOINT_URL_S3 env vars, the client config blocks, and the bucket/object capabilities (list, create, delete, upload, create folder/file, shareable link).
  • npm: @tigrisdata/tigris-mcp-server — package name and version (1.14.0), MIT license, and the tigris-mcp-server bin entry.
  • LICENSE — MIT License.

Repository facts confirmed at review time: official tigrisdata organization, repository tigrisdata/tigris-mcp-server, default branch main, not archived, and released as @tigrisdata/tigris-mcp-server v1.14.0 on npm.

Features

  • Bucket management — list buckets, create a new bucket, and delete a bucket.
  • Object listing — list the objects in a bucket.
  • Uploads — upload a local file to a bucket by path.
  • Folders & files — create a folder in a bucket and create a file with inline content.
  • Deletion — delete an object from a bucket.
  • Shareable links — generate a link to share an object.
  • S3-compatible — works against Tigris's S3 API, so standard S3 tools and libraries apply.
  • npx or Docker — run via npx or a Docker image (recommended by Tigris for better sandboxing).
  • S3-key auth — authenticates with AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY over HTTPS.

Installation

Run the published package with npx, providing your Tigris S3 credentials and endpoint:

export AWS_ACCESS_KEY_ID="your_access_key_id"
export AWS_SECRET_ACCESS_KEY="your_secret_access_key"
export AWS_ENDPOINT_URL_S3="https://fly.storage.tigris.dev"
npx -y @tigrisdata/tigris-mcp-server run

Add it to an MCP client (e.g. Cursor / Claude Desktop):

{
  "mcpServers": {
    "tigris-mcp-server": {
      "command": "npx",
      "args": ["-y", "@tigrisdata/tigris-mcp-server", "run"],
      "env": {
        "AWS_ACCESS_KEY_ID": "YOUR_AWS_ACCESS_KEY_ID",
        "AWS_SECRET_ACCESS_KEY": "YOUR_AWS_SECRET_ACCESS_KEY",
        "AWS_ENDPOINT_URL_S3": "https://fly.storage.tigris.dev"
      }
    }
  }
}

Get an access key from the Tigris console. Tigris also offers a Docker-based setup, which it recommends over npx for better sandboxing, and a hosted MCP server with OAuth support.

Use Cases

  • Conversational storage management — list, create, and delete buckets and objects in natural language.
  • Uploading assets — push local files (models, datasets, backups, logs) to a Tigris bucket from an agent workflow.
  • Content authoring — create folders and files with inline content directly in a bucket.
  • Sharing — generate a shareable link to an object.
  • S3 workflows — use Tigris's S3-compatible API within AI editor workflows.

Safety and Privacy

  • Destructive operations. The server can delete buckets and objects, permanently removing data from your storage.
  • Reads local files. The upload tool reads a local file path and copies it to remote storage; Tigris recommends the Docker runtime over npx for better sandboxing.
  • Shareable links expose data. Generating a link produces a URL that grants access to an object — share it carefully.
  • Keys are broad. The S3 access key and secret grant access to your Tigris storage; scope the key and treat credentials as secrets.
  • Data flows to the model. Object listings, contents, and metadata are returned to the LLM/MCP client and can include sensitive stored data.

Duplicate Check

No existing entry in the directory matches this server. A search of all directory entries for "tigris" across slugs, titles, repository URLs, and install commands returned no results, and there is no prior entry pointing at github.com/tigrisdata/tigris-mcp-server or the npm package @tigrisdata/tigris-mcp-server. This is therefore a net-new, non-duplicate entry.

Source citations

Add this badge to your README

Show that Tigris MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/tigris-mcp-server.svg)](https://heyclau.de/entry/mcp/tigris-mcp-server)

How it compares

Tigris MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field

The official Tigris MCP server (@tigrisdata/tigris-mcp-server) that connects AI agents to Tigris, a high-performance S3-compatible object storage system — listing, creating, and deleting buckets; listing, uploading, and deleting objects; creating folders and files; and generating shareable links — using S3-style access keys against the Tigris endpoint.

Open dossier

The official Infisical MCP server (@infisical/mcp) that lets AI assistants work with Infisical's secrets-management API through function calling — reading, creating, updating, and deleting secrets, and managing projects, environments, folders, and project members — authenticating with a Machine Identity (universal auth) or an access token against Infisical Cloud or a self-hosted instance.

Open dossier

The official InfluxData MCP server for InfluxDB 3 (Core, Enterprise, Cloud Dedicated, Clustered, and Cloud Serverless). It lets LLMs run SQL queries, write line-protocol data, inspect databases and measurement schemas, manage databases and tokens, and check cluster health over the Model Context Protocol.

Open dossier

The official Mux MCP server (@mux/mcp) that gives AI agents access to the Mux API for video and analytics. It uses a "Code Mode" scheme — exposing a documentation-search tool and a code tool that runs agent-written TypeScript against the Mux SDK in an isolated sandbox — to work with Mux Video (assets, live streams, playback IDs, uploads) and Mux Data (viewer metrics and monitoring).

Open dossier
Next steps
Trust
Review statusReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
Submitterdavion-knightdavion-knightdavion-knightdavion-knight
Install riskReview firstReview firstReview firstReview first
Notes Safety Privacy Safety Privacy Safety Privacy Safety Privacy
BrandTigris MCP Server logoTigris MCP ServerInfisical MCP Server logoInfisical MCP ServerInfluxDB 3 MCP Server logoInfluxDB 3 MCP ServerMux MCP Server logoMux MCP Server
Categorymcpmcpmcpmcp
Sourcesource-backedsource-backedsource-backedsource-backed
AuthortigrisdataInfisicalinfluxdatamuxinc
Added2026-07-082026-07-082026-07-082026-07-08
Platforms
Claude CodeCodexCursorClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Source repo
Safety notesThe server can create and delete buckets and objects, so tools like bucket deletion and object deletion permanently remove data from your Tigris storage. The upload tool reads a local file path and writes it to a bucket, so it can access files on your machine and copy them to remote storage. Generating a shareable link produces a URL that grants access to an object; be careful sharing it, as anyone with the link may read that object. The S3 access key and secret grant access to your Tigris storage; scope the key's permissions and treat the credentials as secrets. Tigris recommends the Docker runtime over npx for better sandboxing, since the server holds your credentials and can read local files for upload.The server can read, create, update, and delete secrets (`get-secret`, `list-secrets`, `create-secret`, `update-secret`, `delete-secret`) in the projects and environments its identity can access, so deletions and edits affect real secrets. It can also create projects, environments, and folders and invite members to a project (`create-project`, `create-environment`, `create-folder`, `invite-members-to-project`), which change structure and access. Access is bounded by the Machine Identity or access token, not by tool naming; scope that identity to the minimum projects, environments, and permissions needed. Because this manages secrets, prefer a least-privilege identity and a non-production project when an agent acts autonomously. The universal-auth client secret or `INFISICAL_TOKEN` grants access to your secrets and must itself be treated as a secret.The server exposes write and delete tools — `write_line_protocol` ingests data, `create_database`/`update_database` change database config, and `delete_database` permanently removes a database (the README marks it irreversible). On Core/Enterprise it can mint and revoke credentials via `create_admin_token` (full permissions), `create_resource_token`, and `delete_token`; `regenerate_operator_token` is flagged dangerous/irreversible and rotates the operator token. The `execute_query` tool runs arbitrary SQL against the target database with the supplied token's permissions, so scope the token to least privilege rather than relying on tool naming. Cloud Dedicated/Clustered token tools (`cloud_create_database_token`, `cloud_update_database_token`, `cloud_delete_database_token`) manage real database access grants on the cluster. Point the server at a non-production instance or a tightly scoped token when letting an agent act autonomously; token permissions are the authoritative boundary, not the tool list.This server uses a Code Mode scheme — the agent writes TypeScript against the Mux SDK and the server runs it in an isolated sandbox that has no web or filesystem access, then returns what the code prints or returns. The sandboxed code runs with your Mux access token, so it can create, modify, and delete real Mux resources (assets, live streams, playback IDs, uploads) within that token's permissions. Access is bounded by the Mux token's permissions, not by tool naming — scope the token to least privilege and prefer a non-production environment when an agent acts autonomously. Optional Mux signing and private keys enable signed playback URLs and JWTs; treat `MUX_SIGNING_KEY` and `MUX_PRIVATE_KEY` as secrets. Launching the client with the remote HTTP transport opens a network listener, so secure and authenticate it before exposing it beyond localhost.
Privacy notesThe server accesses your Tigris buckets with your keys; object listings, contents, and metadata it returns are passed to the LLM/MCP client. Stored objects can include AI models, training data, database backups, logs, or user uploads, which may be sensitive, so avoid exposing production data to the model unnecessarily. The upload tool reads local files by path; shareable links can expose object contents beyond the current session. Credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) live in your MCP client config env block — keep that config out of version control and restrict access to it.The `get-secret` and `list-secrets` tools return secret values to the LLM/MCP client, so plaintext secrets can be exposed to the model and its provider — a significant consideration for a secrets manager. Avoid pointing the server at production secrets; use a scoped, non-sensitive project for agent workflows where possible. The identity credentials (client ID/secret or access token) live in your MCP client config env block — keep that config out of version control and restrict access to it. When self-hosting, `INFISICAL_HOST_URL` targets your own instance, and requests plus credentials are sent there.The server connects to your live InfluxDB 3 instance with the token you supply; query results, measurement schemas, and database listings it returns are passed to the LLM/MCP client. Time-series records and tags can contain sensitive or identifying data (device IDs, user IDs, locations, metrics), and query/schema tools can surface those fields to the model. Token-management tools can list and reveal token metadata; treat created tokens and their scopes as secrets. Credentials (`INFLUX_DB_TOKEN`, instance URL, cluster ID) are provided through environment variables in your MCP client config — keep that config out of version control and restrict access to it.The server calls the Mux API with your credentials; asset metadata, live-stream details, and Mux Data results it returns are passed to the LLM/MCP client. Mux Data covers viewer and playback analytics (video views, errors, quality-of-experience metrics), which can include viewer and session information. Credentials (`MUX_TOKEN_ID`, `MUX_TOKEN_SECRET`, and any signing/webhook secrets) are provided via environment variables in your MCP client config — keep that config out of version control and restrict access to it. Video assets and analytics can reference real customer-facing content and usage, so avoid exposing a production account's data to the model unnecessarily.
Prerequisites
  • Node.js and npm (the server runs via `npx -y @tigrisdata/tigris-mcp-server run`), or Docker (recommended for sandboxing)
  • A Tigris account and an S3 access key pair from the Tigris console
  • The `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_ENDPOINT_URL_S3` values for your account
  • An MCP-compatible client (Claude Desktop, Cursor, VS Code, etc.)
  • Node.js and npm (the server runs via `npx -y @infisical/mcp`)
  • An Infisical account on Infisical Cloud or a self-hosted instance
  • Credentials — a Machine Identity universal-auth client ID and secret, or an access token (`INFISICAL_TOKEN`)
  • Optionally `INFISICAL_HOST_URL` for a self-hosted or dedicated instance (defaults to `https://app.infisical.com`)
  • Node.js 20.11 or newer and npm 9 or newer (for the npm/npx runtime), or Docker as an alternative
  • A reachable InfluxDB 3 instance — Core, Enterprise, Cloud Serverless, Cloud Dedicated, or Clustered
  • An InfluxDB token (and, for Cloud Dedicated, the cluster ID) with the permissions you want the agent to have
  • The correct `INFLUX_DB_PRODUCT_TYPE` for your deployment (`core`, `enterprise`, `cloud-serverless`, `cloud-dedicated`, or `clustered`)
  • Node.js and npm (the server runs via `npx -y @mux/mcp@latest`)
  • A Mux account and an access token (token ID and secret) from the Mux dashboard
  • Optional Mux signing/private keys or webhook secret if you use signed playback or webhook features
  • An MCP-compatible client (Claude Desktop, Cursor, VS Code, Windsurf, etc.)
Install
npx -y @tigrisdata/tigris-mcp-server run
npx -y @infisical/mcp
npx -y @influxdata/influxdb3-mcp-server
npx -y @mux/mcp@latest
Config
{
  "mcpServers": {
    "tigris-mcp-server": {
      "command": "npx",
      "args": ["-y", "@tigrisdata/tigris-mcp-server", "run"],
      "env": {
        "AWS_ACCESS_KEY_ID": "YOUR_AWS_ACCESS_KEY_ID",
        "AWS_SECRET_ACCESS_KEY": "YOUR_AWS_SECRET_ACCESS_KEY",
        "AWS_ENDPOINT_URL_S3": "https://fly.storage.tigris.dev"
      }
    }
  }
}
{
  "mcpServers": {
    "infisical": {
      "command": "npx",
      "args": ["-y", "@infisical/mcp"],
      "env": {
        "INFISICAL_HOST_URL": "https://app.infisical.com",
        "INFISICAL_AUTH_METHOD": "access-token",
        "INFISICAL_TOKEN": "your_access_token"
      }
    }
  }
}
{
  "mcpServers": {
    "influxdb": {
      "command": "npx",
      "args": ["-y", "@influxdata/influxdb3-mcp-server"],
      "env": {
        "INFLUX_DB_INSTANCE_URL": "https://us-east-1-1.aws.cloud2.influxdata.com",
        "INFLUX_DB_TOKEN": "<YOUR_INFLUXDB_TOKEN>",
        "INFLUX_DB_PRODUCT_TYPE": "cloud-serverless"
      }
    }
  }
}
{
  "mcpServers": {
    "mux": {
      "command": "npx",
      "args": ["-y", "@mux/mcp"],
      "env": {
        "MUX_TOKEN_ID": "your_token_id",
        "MUX_TOKEN_SECRET": "your_token_secret"
      }
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.