> ## Documentation Index > Fetch the complete documentation index at: https://docs.onebucket.io/llms.txt > Use this file to discover all available pages before exploring further. # OneBucket MCP > Endpoints, sign-in and the full tool list for the OneBucket MCP servers, shared by every MCP client. OneBucket runs two remote MCP servers: **data**, for objects, and **events**, for activity. Any MCP client that supports remote servers with OAuth can use them. This page covers what is the same for every client; the client pages cover only how to add the server. > **[Claude](https://docs.onebucket.io/connectors/claude.md)** > > Add OneBucket as a custom connector. > **[ChatGPT](https://docs.onebucket.io/connectors/chatgpt.md)** > > Desktop app and web. > **[Muse](https://docs.onebucket.io/connectors/muse.md)** > > Connect from Muse chat. ## Endpoints | Server | Global | Pinned to a region | | - | - | - | | Data (objects) | `https://data.onebucket.io` | `https://data..onebucket.io` | | Events (activity) | `https://synapse.onebucket.io` | `https://synapse..onebucket.io` | Regions today are `us-ashburn-1`, `us-sanjose-1` and `ap-singapore-1`, for example `https://data.us-ashburn-1.onebucket.io`. The full list is in [Endpoints](https://docs.onebucket.io/reference/apis.md#endpoints). > [!WARNING] > > Use the root URL exactly as shown. The MCP service is served at the root, so `https://data.onebucket.io/mcp` will not connect. Global hostnames route each request to the nearest live region, and your policies are active in every region. Pin a region only when requests must land in one place. The two servers are separate connections: connecting data does not give access to events. ## Sign-in Both servers use standard MCP authorization: OAuth 2.1 with PKCE. Clients discover the authorization server from the MCP endpoint (RFC 9728 and RFC 8414), so in most clients you only enter the URL. | Setting | Data | Events | | - | - | - | | Authorization server | `https://oauth.onebucket.io` | `https://oauth.onebucket.io` | | Scope | `mcp` | `mcp` | | Resource | `https://data.onebucket.io` | `https://synapse.onebucket.io` | | Client registration | Dynamic (DCR) at `https://oauth.onebucket.io/register` | Same | * **No pre-registered app.** Clients register themselves through Dynamic Client Registration as public clients, with no secret. * **No pasted tokens.** Never paste a token, secret or password into a chat or a connector dialog. Leave bearer-token and header fields empty. * **Exact resource.** The resource sent in the authorization, token and refresh requests must match the endpoint exactly. Tokens are bound to that one audience. * **Scoped and revocable.** Every call is scoped to your organization and access key. Revoke a session at any time from your [OneBucket console](https://app.onebucket.io) or with `onebucket sessions` in the [CLI](https://docs.onebucket.io/reference/cli.md). Disconnecting a client removes its access; it never deletes buckets or objects. ## Tools Every data tool is governed by the [policy](https://docs.onebucket.io/concepts/policies.md) of the bucket it touches. Read tools are annotated read-only, so clients can run them without asking; clients ask for confirmation before write tools. ### Reading | Tool | Parameters | Returns | | - | - | - | | `list` | `bucket`, `prefix`, `delimiter`, `max_keys`, `continuation_token` | Buckets, or objects in a bucket. Each item carries `locations`, the backends that hold it. Omit `bucket` to list buckets. | | `head` | `bucket`, `key` | Content type, size, ETag, last modified and custom attributes, without the content. | | `get` | `bucket`, `key` | The content inline when small enough (see [limits](#limits)), otherwise a presigned GET URL. | | `presign` | `bucket`, `key`, `method` (`GET` or `PUT`) | A URL valid for about one hour, for transfers that bypass the model. | | `locate` | `bucket`, `key` | Which configured backends hold the object. S3 endpoints are probed with a HEAD; other endpoints are listed but not probed. | ### Writing | Tool | Parameters | Behavior | | - | - | - | | `put` | `bucket`, `key`, `content`, `content_type` | Inline text upload; omit `content` to get a presigned PUT URL for larger or binary files. | | `create` | `bucket` | Creates a bucket. | | `copy` | `source_bucket`, `source_key`, `dest_key` | Copies to a new key in the same bucket. Asynchronous. | | `move` | `source_bucket`, `source_key`, `dest_key` | Renames within the same bucket; the source is deleted only after the copy lands. Asynchronous. | | `migrate` | `bucket`, `key`, `target_endpoint`, `source_endpoint` | Copies the object to a named backend and keeps the source. `source_endpoint` defaults to the origin sync endpoint. Asynchronous. | | `prefetch` | `bucket`, `key` | Warms the cache so the next read is local. Asynchronous. | | `delete` | `bucket`, `key` | Deletes an object, or the bucket itself when `key` is omitted. | > [!WARNING] > > `delete` and `move` are destructive: `move` removes the source object, and `delete` without a key deletes the bucket. Approve each write explicitly, and check the current state with a read before retrying a write that failed or timed out. ### Events The events server is read-only. Each request produces one **gateway** event for the request as the client made it, plus one **backend** event for each endpoint it reached; all share one `reqId`, and backend events carry the `endpoint`. Filter or group by layer so one transfer is not counted twice. | Tool | Parameters | Returns | | - | - | - | | `list_events` | `since`, `until`, `bucket`, `action`, `status`, `statusCode`, `accessKey`, `user`, `limit`, `cursor` | Events, most recent first, with a `nextCursor` when more exist. | | `get_event` | `eventId` | One event. | | `tail_events` | `cursor`, `limit`, `waitSeconds` | New events, oldest first. Long-polls until events arrive; always returns a `nextCursor`. | | Filter | Values | | - | - | | `status` | `ok` (served), `denied` (401 or 403), `error` (any status 400 or above) | | `action` | An S3 action, for example `s3:PutObject` | | `since`, `until` | RFC 3339 timestamps. `since` defaults to 24 hours ago. | | `limit` | 1 to 100, default 50 | | `waitSeconds` | 0 to 360, default 60 | Only gateway events name the caller, so filtering by `accessKey` or `user` returns gateway events only. ## Limits | | Limit | | - | - | | Inline `get`, text | 512 KB | | Inline `get`, image and audio | 700 KB | | Inline `get`, PDF and other binary | 10 KB | | Inline `put` | 700 KB of UTF-8 text | | Presigned URL validity | About one hour | Above these limits, the tool returns a presigned URL so the transfer goes directly between the client and OneBucket, bypassing the model. `copy`, `move`, `migrate` and `prefetch` return once the job is queued, so a destination may not be readable for a short time. ## Verify a connection Start with a read-only request, which proves the connection without changing data. Ask your assistant: *"List my OneBucket buckets."* It should return the buckets your key can reach, with the backends that hold each one. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.