The official Tigris MCP server (@tigrisdata/tigris-mcp-server) that connects AI agents to Tigris, a high-performance S3-compatible object storage system — listing, creating, and deleting buckets; listing, uploading, and deleting objects; creating folders and files; and generating shareable links — using S3-style access keys against the Tigris endpoint.
The server can create and delete buckets and objects, so tools like bucket deletion and object deletion permanently remove data from your Tigris storage., The upload tool reads a local file path and writes it to a bucket, so it can access files on your machine and copy them to remote storage., Generating a shareable link produces a URL that grants access to an object; be careful sharing it, as anyone with the link may read that object., The S3 access key and secret grant access to your Tigris storage; scope the key's permissions and treat the credentials as secrets., Tigris recommends the Docker runtime over npx for better sandboxing, since the server holds your credentials and can read local files for upload.
Privacy notes
The server accesses your Tigris buckets with your keys; object listings, contents, and metadata it returns are passed to the LLM/MCP client., Stored objects can include AI models, training data, database backups, logs, or user uploads, which may be sensitive, so avoid exposing production data to the model unnecessarily., The upload tool reads local files by path; shareable links can expose object contents beyond the current session., Credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) live in your MCP client config env block — keep that config out of version control and restrict access to it.
Author
tigrisdata
Submitted by
davion-knight
Claim status
unclaimed
Last verified
2026-07-08
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Complete
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Done
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Pending
Baseline comparison available
No baseline peer selected yet.
Pending
Diverging trust signals identified
No major trust-signal divergence found.
Pending
Adoption plan
Balanced adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Risk 16
Pre-adoption checks
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Done
Confirm metadata review state
Listing has review metadata.
Done
Verify install payload
Install/config payload exists and can be inspected.
Done
Security checks
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Done
Review privacy notesRequired
Privacy notes are present.
Done
Verify package integrity metadata
No package verification/checksum metadata.
Pending
Rollout
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Pending
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Pending
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Pending
Evidence readiness
Evidence readiness matrix · balanced
Required evidence gates are covered (5/6 signals complete).
Risk 15
Source provenance
Present
Source repository/provenance is listed.
Required in this preset
Metadata review
Present
Review metadata is present.
Required in this preset
Safety notes
Present
Safety notes are present.
Required in this preset
Privacy notes
Present
Privacy notes are present.
Optional in this preset
Package integrity
Missing
Package integrity metadata is missing.
Optional in this preset
Install payload
Present
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
Decision timeline · balanced
5/6 steps complete with no blocking gaps for this preset.
Risk 14
triage
Confirm source provenanceRequired
Source/provenance metadata is available.
Done
triage
Check metadata review statusRequired
Review metadata is available.
Done
verify
Review safety notesRequired
Safety notes are available.
Done
verify
Review privacy notes
Privacy notes are available.
Done
verify
Validate package integrity metadata
Package integrity metadata is missing.
Pending
rollout
Verify install payload and commandsRequired
Install payload is available.
Done
No required blockers for this timeline preset.
Safety notes
The server can create and delete buckets and objects, so tools like bucket deletion and object deletion permanently remove data from your Tigris storage.
The upload tool reads a local file path and writes it to a bucket, so it can access files on your machine and copy them to remote storage.
Generating a shareable link produces a URL that grants access to an object; be careful sharing it, as anyone with the link may read that object.
The S3 access key and secret grant access to your Tigris storage; scope the key's permissions and treat the credentials as secrets.
Tigris recommends the Docker runtime over npx for better sandboxing, since the server holds your credentials and can read local files for upload.
Privacy notes
The server accesses your Tigris buckets with your keys; object listings, contents, and metadata it returns are passed to the LLM/MCP client.
Stored objects can include AI models, training data, database backups, logs, or user uploads, which may be sensitive, so avoid exposing production data to the model unnecessarily.
The upload tool reads local files by path; shareable links can expose object contents beyond the current session.
Credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) live in your MCP client config env block — keep that config out of version control and restrict access to it.
Prerequisites
Node.js and npm (the server runs via `npx -y @tigrisdata/tigris-mcp-server run`), or Docker (recommended for sandboxing)
A Tigris account and an S3 access key pair from the Tigris console
The `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_ENDPOINT_URL_S3` values for your account
An MCP-compatible client (Claude Desktop, Cursor, VS Code, etc.)
The Tigris MCP Server is the official Model Context Protocol server maintained by
Tigris Data. It connects AI agents to
Tigris — a high-performance, S3-compatible object storage system
for multi-cloud and AI workloads — for bucket and object management: listing, creating, and
deleting buckets; listing, uploading, and deleting objects; creating folders and files;
and generating shareable links.
It ships as the npm package
@tigrisdata/tigris-mcp-server
(v1.14.0, MIT), runs over stdio via npx (or Docker, which the project recommends for better
sandboxing), and authenticates with S3-style access keys (AWS_ACCESS_KEY_ID /
AWS_SECRET_ACCESS_KEY) against the Tigris endpoint (AWS_ENDPOINT_URL_S3). Setup details live in
the repository README.
Source Review
The following real repository and package sources were fetched and reviewed for this entry:
README.md — the npx/Docker install commands, the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_ENDPOINT_URL_S3 env vars, the client config blocks, and the bucket/object capabilities (list, create, delete, upload, create folder/file, shareable link).
Repository facts confirmed at review time: official tigrisdata organization, repository
tigrisdata/tigris-mcp-server, default branch main, not archived, and released as
@tigrisdata/tigris-mcp-server v1.14.0 on npm.
Features
Bucket management — list buckets, create a new bucket, and delete a bucket.
Object listing — list the objects in a bucket.
Uploads — upload a local file to a bucket by path.
Folders & files — create a folder in a bucket and create a file with inline content.
Deletion — delete an object from a bucket.
Shareable links — generate a link to share an object.
S3-compatible — works against Tigris's S3 API, so standard S3 tools and libraries apply.
npx or Docker — run via npx or a Docker image (recommended by Tigris for better sandboxing).
S3-key auth — authenticates with AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY over HTTPS.
Installation
Run the published package with npx, providing your Tigris S3 credentials and endpoint:
export AWS_ACCESS_KEY_ID="your_access_key_id"
export AWS_SECRET_ACCESS_KEY="your_secret_access_key"
export AWS_ENDPOINT_URL_S3="https://fly.storage.tigris.dev"
npx -y @tigrisdata/tigris-mcp-server run
Add it to an MCP client (e.g. Cursor / Claude Desktop):
Get an access key from the Tigris console. Tigris also offers a
Docker-based setup, which it recommends over npx for better sandboxing, and a hosted MCP server
with OAuth support.
Use Cases
Conversational storage management — list, create, and delete buckets and objects in natural language.
Uploading assets — push local files (models, datasets, backups, logs) to a Tigris bucket from an agent workflow.
Content authoring — create folders and files with inline content directly in a bucket.
Sharing — generate a shareable link to an object.
S3 workflows — use Tigris's S3-compatible API within AI editor workflows.
Safety and Privacy
Destructive operations. The server can delete buckets and objects, permanently removing data from your storage.
Reads local files. The upload tool reads a local file path and copies it to remote storage; Tigris recommends the Docker runtime over npx for better sandboxing.
Shareable links expose data. Generating a link produces a URL that grants access to an object — share it carefully.
Keys are broad. The S3 access key and secret grant access to your Tigris storage; scope the key and treat credentials as secrets.
Data flows to the model. Object listings, contents, and metadata are returned to the LLM/MCP client and can include sensitive stored data.
Duplicate Check
No existing entry in the directory matches this server. A search of all directory entries for "tigris"
across slugs, titles, repository URLs, and install commands returned no results, and there is no prior
entry pointing at github.com/tigrisdata/tigris-mcp-server or the npm package
@tigrisdata/tigris-mcp-server. This is therefore a net-new, non-duplicate entry.
Show that Tigris MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/tigris-mcp-server)
How it compares
Tigris MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
The official Tigris MCP server (@tigrisdata/tigris-mcp-server) that connects AI agents to Tigris, a high-performance S3-compatible object storage system — listing, creating, and deleting buckets; listing, uploading, and deleting objects; creating folders and files; and generating shareable links — using S3-style access keys against the Tigris endpoint.
The official Infisical MCP server (@infisical/mcp) that lets AI assistants work with Infisical's secrets-management API through function calling — reading, creating, updating, and deleting secrets, and managing projects, environments, folders, and project members — authenticating with a Machine Identity (universal auth) or an access token against Infisical Cloud or a self-hosted instance.
The official InfluxData MCP server for InfluxDB 3 (Core, Enterprise, Cloud Dedicated, Clustered, and Cloud Serverless). It lets LLMs run SQL queries, write line-protocol data, inspect databases and measurement schemas, manage databases and tokens, and check cluster health over the Model Context Protocol.
The official Mux MCP server (@mux/mcp) that gives AI agents access to the Mux API for video and analytics. It uses a "Code Mode" scheme — exposing a documentation-search tool and a code tool that runs agent-written TypeScript against the Mux SDK in an isolated sandbox — to work with Mux Video (assets, live streams, playback IDs, uploads) and Mux Data (viewer metrics and monitoring).
✓The server can create and delete buckets and objects, so tools like bucket deletion and object deletion permanently remove data from your Tigris storage.
The upload tool reads a local file path and writes it to a bucket, so it can access files on your machine and copy them to remote storage.
Generating a shareable link produces a URL that grants access to an object; be careful sharing it, as anyone with the link may read that object.
The S3 access key and secret grant access to your Tigris storage; scope the key's permissions and treat the credentials as secrets.
Tigris recommends the Docker runtime over npx for better sandboxing, since the server holds your credentials and can read local files for upload.
✓The server can read, create, update, and delete secrets (`get-secret`, `list-secrets`, `create-secret`, `update-secret`, `delete-secret`) in the projects and environments its identity can access, so deletions and edits affect real secrets.
It can also create projects, environments, and folders and invite members to a project (`create-project`, `create-environment`, `create-folder`, `invite-members-to-project`), which change structure and access.
Access is bounded by the Machine Identity or access token, not by tool naming; scope that identity to the minimum projects, environments, and permissions needed.
Because this manages secrets, prefer a least-privilege identity and a non-production project when an agent acts autonomously.
The universal-auth client secret or `INFISICAL_TOKEN` grants access to your secrets and must itself be treated as a secret.
✓The server exposes write and delete tools — `write_line_protocol` ingests data, `create_database`/`update_database` change database config, and `delete_database` permanently removes a database (the README marks it irreversible).
On Core/Enterprise it can mint and revoke credentials via `create_admin_token` (full permissions), `create_resource_token`, and `delete_token`; `regenerate_operator_token` is flagged dangerous/irreversible and rotates the operator token.
The `execute_query` tool runs arbitrary SQL against the target database with the supplied token's permissions, so scope the token to least privilege rather than relying on tool naming.
Cloud Dedicated/Clustered token tools (`cloud_create_database_token`, `cloud_update_database_token`, `cloud_delete_database_token`) manage real database access grants on the cluster.
Point the server at a non-production instance or a tightly scoped token when letting an agent act autonomously; token permissions are the authoritative boundary, not the tool list.
✓This server uses a Code Mode scheme — the agent writes TypeScript against the Mux SDK and the server runs it in an isolated sandbox that has no web or filesystem access, then returns what the code prints or returns.
The sandboxed code runs with your Mux access token, so it can create, modify, and delete real Mux resources (assets, live streams, playback IDs, uploads) within that token's permissions.
Access is bounded by the Mux token's permissions, not by tool naming — scope the token to least privilege and prefer a non-production environment when an agent acts autonomously.
Optional Mux signing and private keys enable signed playback URLs and JWTs; treat `MUX_SIGNING_KEY` and `MUX_PRIVATE_KEY` as secrets.
Launching the client with the remote HTTP transport opens a network listener, so secure and authenticate it before exposing it beyond localhost.
Privacy notes
✓The server accesses your Tigris buckets with your keys; object listings, contents, and metadata it returns are passed to the LLM/MCP client.
Stored objects can include AI models, training data, database backups, logs, or user uploads, which may be sensitive, so avoid exposing production data to the model unnecessarily.
The upload tool reads local files by path; shareable links can expose object contents beyond the current session.
Credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) live in your MCP client config env block — keep that config out of version control and restrict access to it.
✓The `get-secret` and `list-secrets` tools return secret values to the LLM/MCP client, so plaintext secrets can be exposed to the model and its provider — a significant consideration for a secrets manager.
Avoid pointing the server at production secrets; use a scoped, non-sensitive project for agent workflows where possible.
The identity credentials (client ID/secret or access token) live in your MCP client config env block — keep that config out of version control and restrict access to it.
When self-hosting, `INFISICAL_HOST_URL` targets your own instance, and requests plus credentials are sent there.
✓The server connects to your live InfluxDB 3 instance with the token you supply; query results, measurement schemas, and database listings it returns are passed to the LLM/MCP client.
Time-series records and tags can contain sensitive or identifying data (device IDs, user IDs, locations, metrics), and query/schema tools can surface those fields to the model.
Token-management tools can list and reveal token metadata; treat created tokens and their scopes as secrets.
Credentials (`INFLUX_DB_TOKEN`, instance URL, cluster ID) are provided through environment variables in your MCP client config — keep that config out of version control and restrict access to it.
✓The server calls the Mux API with your credentials; asset metadata, live-stream details, and Mux Data results it returns are passed to the LLM/MCP client.
Mux Data covers viewer and playback analytics (video views, errors, quality-of-experience metrics), which can include viewer and session information.
Credentials (`MUX_TOKEN_ID`, `MUX_TOKEN_SECRET`, and any signing/webhook secrets) are provided via environment variables in your MCP client config — keep that config out of version control and restrict access to it.
Video assets and analytics can reference real customer-facing content and usage, so avoid exposing a production account's data to the model unnecessarily.
Prerequisites
Node.js and npm (the server runs via `npx -y @tigrisdata/tigris-mcp-server run`), or Docker (recommended for sandboxing)
A Tigris account and an S3 access key pair from the Tigris console
The `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_ENDPOINT_URL_S3` values for your account
An MCP-compatible client (Claude Desktop, Cursor, VS Code, etc.)
Node.js and npm (the server runs via `npx -y @infisical/mcp`)
An Infisical account on Infisical Cloud or a self-hosted instance
Credentials — a Machine Identity universal-auth client ID and secret, or an access token (`INFISICAL_TOKEN`)
Optionally `INFISICAL_HOST_URL` for a self-hosted or dedicated instance (defaults to `https://app.infisical.com`)
Node.js 20.11 or newer and npm 9 or newer (for the npm/npx runtime), or Docker as an alternative
A reachable InfluxDB 3 instance — Core, Enterprise, Cloud Serverless, Cloud Dedicated, or Clustered
An InfluxDB token (and, for Cloud Dedicated, the cluster ID) with the permissions you want the agent to have
The correct `INFLUX_DB_PRODUCT_TYPE` for your deployment (`core`, `enterprise`, `cloud-serverless`, `cloud-dedicated`, or `clustered`)
Node.js and npm (the server runs via `npx -y @mux/mcp@latest`)
A Mux account and an access token (token ID and secret) from the Mux dashboard
Optional Mux signing/private keys or webhook secret if you use signed playback or webhook features
An MCP-compatible client (Claude Desktop, Cursor, VS Code, Windsurf, etc.)