Backblaze B2 MCP Server Opens Scoped Storage to AI Agents
Backblaze has released an open source Backblaze B2 MCP Server that gives AI agents a safe, standard way to operate cloud object storage. Announced on September 8, 2026, the new server connects Model Context Protocol (MCP) clients, which are applications that follow a shared way for AI agents to discover and call external tools, to a focused set of Backblaze B2 Cloud Storage operations. The important design point is that the tools an agent can see and use reflect the permissions of the connected B2 application key, a credential that grants access only to specific storage resources instead of the whole account. If a key can only read from one bucket, a named container that holds stored objects, the agent's reach is constrained to that bucket; if the key does not permit an operation, the agent cannot use the MCP server to bypass that boundary.
Backblaze's argument for launching the server is that storage has traditionally met developers in two places: the application programming interface (API), which is a set of rules that lets software talk to the service, and the web console. Agent tools are becoming a third place, increasingly where work starts. The company wants infrastructure to be available inside the tool a developer already has open. That includes everyday tasks that produce outputs, AI workflows that read and write data as they run, and applications that need somewhere to put user uploads, generated assets, and datasets. Customers have also asked how their own agents can administer their storage. MCP allows one implementation to serve all these cases, so the same credentials, scoping, transfer path, and destructive operation policy apply everywhere a team works.
In a practical example, suppose an AI agent has prepared a customer export. Instead of giving it a general-purpose credential and writing surrounding storage logic, a developer could ask it to prepare a private destination, keep the file for 30 days, and provide a secure way to upload it. Depending on the application key permissions and the server policy, the agent can create a private bucket or select an existing one, apply lifecycle rules that automatically expire objects or retention settings that protect them from deletion, generate a short-lived upload URL, verify the export arrived, and return a short-lived download URL. For a large export, the actual bytes move directly to B2 using the short-lived URL rather than passing through the model conversation or the MCP server, which keeps bulk data on the right path. If a follow-up request says delete that export, the server can require confirmation before proceeding or block destructive operations entirely, depending on configuration. The same principle applies to changes that weaken protection, such as clearing retention or introducing lifecycle rules that schedule deletion.
The server includes up to 40 tools across the B2 Native API, B2's S3 Compatible API, and purpose-built storage analytics. The available surface adjusts to the connected key and policy settings, so not every tool must be exposed. Storage management covers creating and configuring buckets, listing and managing objects, defining lifecycle rules, working with retention and legal holds, and using Object Lock, a feature that makes objects immutable for a set period, where stronger protection is needed. Large files can be moved with short-lived upload and download URLs or multipart transfers, which split a large file into pieces that upload in parallel. Access is limited by connecting a scoped B2 application key, and a non-master key is the right starting point for normal storage work. Destructive actions can be gated with a policy that requires confirmation, blocks the operation, or allows it in a trusted environment; local use defaults to confirmation, while hosted HTTP deployments default to blocking these calls. Usage inspection can find storage growth, egress leaders (buckets or paths with the most data leaving the service), the largest files, and unfinished multipart uploads that may still consume storage.
Safety starts with the key. The server makes tools available to an agent but should not weaken access controls. The connected B2 application key remains the first boundary, and B2 application keys can be limited by bucket, capability, file prefix, and duration. That gives developers a practical way to apply least privilege, the practice of giving a tool only the minimum permissions it needs, to agentic workflows. The server adds another layer for operations that deserve friction: destructive and protection-weakening actions can require explicit confirmation or be refused before execution. For hosted deployments, the project includes additional controls and guidance for credential handling, authentication, allowed hosts and origins, rate limits, and logging. The goal is not to pretend an agent can never make a bad request, but to give developers clear, enforceable boundaries.
Organizations that already store application data, backups, media, or archives in B2 do not need a separate storage product for agents. The MCP server works with standard B2 application keys and existing buckets. You can connect an existing key, but in most agentic workflows it is worth creating a narrower key. A reporting agent might need read access to a specific prefix, which is a starting path that limits which objects a key can reach. An export workflow might need permission to write to one private bucket and generate a short-lived download link. A cleanup agent might need list access but no delete capability until a human approves the action.
For Claude Desktop, Backblaze provides a one-click install: download the b2-mcp.mcpb file from the latest release and double-click it. Claude Desktop opens, offers to install the extension, and prompts for the Application Key ID and Application Key, with Region and master key optional. There is no config file to edit and nothing is pasted into the conversation. If the system has not associated .mcpb files with Claude Desktop, users can open Settings, Extensions, and install from there or drag the file onto that window. For any MCP client, the fastest start is to run npx -y @backblaze-labs/b2-mcp with a supported Node.js runtime, a non-master B2 application key, and an MCP-compatible client. Claude Desktop users can add a configuration block with B2_APPLICATION_KEY_ID and B2_APPLICATION_KEY environment variables, then restart. Backblaze stresses that the application key should never be pasted into the model conversation; keep it in the client configuration or a deployment's secret-management layer. A deliberately simple first prompt is to ask the agent to list the buckets this key can access. Copy-and-paste setup instructions are provided for Cursor, VS Code, Cline, Windsurf, Zed, Continue, Goose, Claude.ai, and hosted deployments, and the code is available on GitHub and as an npm package.