Architecture

OneBucket sits between your clients and your backends. Clients speak S3 or MCP to a single endpoint; OneBucket resolves each request to wherever the data actually lives — cloud, on-prem, or edge — and moves or caches data according to policy.

​

The Adaptive Data Fabric

The fabric is the core abstraction: location-independent access to unstructured data. It has three jobs:

• Connect natively — native S3 and MCP interfaces reach every cloud, on-prem, and edge source, with no application changes.
• Place by policy — policy-driven placement and adaptive movement keep data in the right place at the right time.
• Access anywhere — intelligent caching and replication make distributed data feel local.

Your applications see one logical bucket namespace. Behind it, objects may live in AWS S3, Azure Blob, Google Cloud Storage, Wasabi, Akave, on-prem, edge, or air-gapped stores — and may move between them without the client noticing.

​

Access interfaces

OneBucket exposes three endpoints. Each has a global hostname — geoproximity DNS routes every request to the cluster nearest the caller — and a per-cluster form that pins a specific cluster: Your policy is active on every cluster, so the global hostnames are the right default; pin a cluster only when you need requests to land in a specific location. s3. — the data plane. The full S3 API with AWS SigV4 auth: buckets, objects, multipart uploads, versioning, and presigned URLs. This is what applications, SDKs, and S3 tools talk to — see S3 API compatibility. core. — objects over MCP. An MCP server that gives AI agents the object operations in natural language: list, read, and upload objects, presign URLs, and copy, move, migrate, prefetch, or locate them across backends — see the Claude connector. synapse. — events over MCP. An MCP server for what happened: list, get, and tail the events your OneBucket emits, filterable by time, bucket, and action — the audit and monitoring companion to core.. Both MCP endpoints authenticate via the OneBucket authorization server (“axon”) using standard OAuth 2.1 with PKCE; the S3 gateway uses your access key / secret key pair. See How authentication works.

​

Placement and movement

Objects are placed and moved by policy rather than by hand:

• Policy-driven placement decides which backend holds an object when it is written.
• Adaptive movement relocates data as access patterns and policies change.
• Explicit operations — copy, move, and migrate — let you relocate objects across backends on demand. These run asynchronously: they return once queued, so a destination may not be readable immediately.
• locate reports which configured backends currently hold an object.

​

Caching and replication

To cut egress cost and latency, OneBucket serves repeat reads locally:

• Edge caching keeps hot objects close to where they are read.
• Prefetch warms the cache ahead of demand (prefetch via MCP, or as part of policy).
• Replication keeps copies in multiple backends where policy requires it.

​

Governance and audit

Access control is enforced once, at the fabric — one policy layer across every backend. Every operation is scoped to your organization and access key; cross-organization access is not possible. Detailed events stream from the events endpoint, so you can audit activity with list_events, get_event, and tail_events, filterable by time, bucket, and action.

​

Next steps