Does boto3 work against XNS?

Yes, with endpoint_url set explicitly — omitting it defaults to s3.amazonaws.com and fails with 403 SignatureDoesNotMatch.

Is there a published OpenAPI spec?

Not yet. Agents must inherit from the AWS S3 spec and treat this gateway as a documented subset until one ships.

← S3 compatibility matrix S3 resource guide · Integration & tooling

boto3, AWS CLI, and a first-class MCP server — agents are the default customer

XNS ships a governed MCP server, not just an S3-compatible endpoint for a wrapper to sit in front of. boto3 and AWS CLI work with an explicit endpoint_url. Virtual-hosted and path-style addressing both work. Event notifications and access logging accept real configuration; delivery is still being wired. S3 Select, Inventory, Requester Pays, and Transfer Acceleration are out of model.

Shipped MCP server — 8 tools, IAM-governed boto3 & AWS CLI — confirmed working No OpenAPI/JSON-Schema spec published

What this area is

An S3 gateway is only as useful as the tools that already speak S3: boto3 and other AWS SDKs, the AWS CLI, backup tools (restic, rclone, kopia), analytics engines that read over HTTP (DuckDB httpfs), and infrastructure-as-code (Terraform). It also has to get the protocol plumbing right — virtual-hosted vs. path-style addressing, CORS, tagging, event notifications, access logging, metrics. Increasingly, the client generating the calls is not a human running a fixed command but an AI agent emitting new call sequences turn over turn — a different integration contract than a human configuring a tool once and walking away.

SDKs & CLI: boto3, other AWS SDKs, AWS CLI, restic/rclone/kopia, Terraform.
Protocol plumbing: Addressing, CORS, tagging, event notifications, access logging, metrics.
AI agents: New call sequences turn over turn — a different integration contract.

How XNS implements it

Standard SDK/CLI compatibility, plus a first-class, IAM-governed MCP server.

Addressing: path-style has always been supported; virtual-hosted-style (handled by the gateway’s vhost-rewrite middleware) rewrites to path-style before routing, with SigV4 verified against the original pre-rewrite URI. SDKs: boto3 with SigV4 + vhost addressing is confirmed working (endpoint_url must be set explicitly — the gateway is not s3.amazonaws.com). The MCP server is first-class and shipped, not a third-party SDK wrapper: every tool call resolves a principal via the same credential lookup as the S3 HTTP path, maps (tool, args) → (s3:action, ARN), runs the same IAM evaluator as the HTTP middleware, and writes an audit row with Origin="mcp". Degraded mode is fail-closed: a half-wired server errors rather than bypassing enforcement.

boto3 (SigV4 + vhost): Confirmed working; set endpoint_url explicitly.
AWS CLI: Confirmed working, including aws s3 presign and s3api subcommands.
MinIO Go SDK / mc CLI / restic: Confirmed working; StripTrailingSlash middleware specifically targets minio-go client quirks (mc, restic, kopia).
aws-sdk-js v2/v3, aws-sdk-go-v2, smithy-go, rclone, duckdb httpfs: Expected to work (same SigV4 path), not exhaustively tested against this gateway.
Shipped MCP server: 8 tools + resources/list + resources/read, IAM-governed, fail-closed. See the tool table alongside.

The 8 shipped MCP tools

Every tool call maps to a real s3:action and runs the same IAM evaluator as the HTTP path.

Where the gap actually is

No OpenAPI 3.x spec, JSON Schema bundle, or Smithy model is published — an agent bootstrapping from a machine-readable schema must inherit from the AWS S3 spec and treat this gateway as a subset; the operation matrix on the compatibility page is the authoritative subset definition until a spec ships. Per-agent scoped tokens exist on the MCP path (assume_role_scoped) and via OIDC (AssumeRoleWithWebIdentity), but non-MCP agents that share the customer's root SigV4 keys still have the full power of those keys — identity is implicit until an agent authenticates through one of the scoped paths.

Source: our internal agentic-tooling compatibility reference § Shipped MCP server, code-verified against the MCP server's tool, auth, and resource handlers.
Tool	s3:action	Caveat
list_buckets	s3:ListAllMyBuckets	Tenant-scoped on cost_center before IAM.
list_objects	s3:ListBucket	V1 first page only (max 1000), no pagination token yet.
get_object	s3:GetObject	UTF-8 text only, 10 MiB hard cap. Binary → use get_presigned_url.
put_object	s3:PutObject	UTF-8 text only, 10 MiB hard cap.
delete_object	s3:DeleteObject	—
create_bucket	s3:CreateBucket	—
get_presigned_url	s3:GetObject	Server-signed, not caller's key; GET only; expiry 1–604800s.
assume_role_scoped	STS	Policy allowlist {ReadOnly, WriteOnly, ReadWrite}; wildcard rejected; 900–43200s duration.

How we conform to the S3 protocol

Config CRUD is real across the board; delivery pipelines and edge features are the honest gaps.

Addressing, CORS, tagging, and config CRUD are measured against the public ceph/s3-tests suite and pass, test by test. Full per-test results are published on the compatibility matrix.

Source: ceph/s3-tests run baseline-53dedd8d / fullsuite-53dedd8d, build 53dedd8d, 2026-08-11, classified via our per-test verdict ledger (v2.2 — 575 node-ids, 549 counted). Agentic surface facts from our internal agentic-tooling compatibility reference, verified relayer@e3247d8f, 2026-08-10.

Config CRUD is real, not a stub, everywhere it's offered. GetBucketNotification/PutBucketNotification and GetBucketLogging/PutBucketLogging all persist real configuration. Notification delivery is wired end-to-end (HMAC-signed webhook, 4 attempts); access-logging delivery is still being wired — treat it as in progress, not shipped, until you've verified the specific path you need.

S3 Select, Inventory reports, Requester Pays, and Transfer Acceleration are deliberate scope exclusions, not gaps awaiting a fix — they're not routed on this gateway.

Full per-operation results, including what still fails, are on the S3 compatibility matrix.

How we compare

Same rows as the matrix — AWS S3, Ceph, MinIO, Wasabi, B2, Storj.

Source: the same competitor cells published on the S3 compatibility matrix — “Integration & tooling” section — researched from each vendor’s own documentation, 2026-06-14. Agentic/MCP support is not a matrix row — not compared here to avoid inventing competitor claims.

Competitor figures from each vendor’s official documentation, researched 2026-06-14. Reused verbatim from the S3 compatibility matrix.
Feature	XNS	AWS S3	Ceph RadosGW	MinIO	Wasabi	B2	Storj DCS
AWS CLI	✓	✓	✓	✓	✓	✓	◐ breaks on aws-cli v2.23+
Modern AWS SDK (current boto3)	✓	✓	✓	✓	✓	✓	◐ boto3 ≥1.36 CRC32 trailers break it
Virtual-hosted-style URLs	✓	✓	✓	✓	✓	✓	✓
Path-style URLs	✓	◐ legacy; new buckets must use vhost	✓	✓	✓	✓	✓
CORS configuration	✓	✓	✓	✓	◐ not configurable; blanket headers	✓	✗
Object tagging	◐	✓	✓	✓	✓	✗ GetObjectTagging returns empty	✓
Bucket tagging	◐	✓	✓	✓	✓	✗	✓
Event notifications	◐ config real, delivery in progress	✓	✓	✓	◐ external AWS SNS only	◐ native webhooks, not S3 API	✓
Server access logging	◐ config real, delivery in progress	✓	✓	✗	✓	? unknown	✗
Metrics / observability	✓ Prometheus	✓	✓	✓	◐	◐	✗
S3 Select	– out of model	◐ closed to new customers Jul 2024	◐ CSV/JSON; Parquet maturing	◐ Parquet off by default	? unknown	✗	✗
Inventory reports	– out of model	✓	✗	✗	✓	✗	✗
Requester Pays	– out of model	✓	✓	✗	? unknown	✗	✗
Transfer acceleration	– out of model	✓	✗	✗	? unknown	✗	–

How applications use it

SDK setup, CLI config, and a governed MCP tool call.

boto3 — always set endpoint_url explicitly

import boto3
# Training-data examples often omit endpoint_url and default to
# s3.amazonaws.com — that surfaces as 403 SignatureDoesNotMatch here.
s3 = boto3.client(
    "s3",
    endpoint_url="https://your-gateway:9000",
    aws_access_key_id="AKIA...",
    aws_secret_access_key="...",
)
s3.create_bucket(Bucket="agent-workspace")
s3.put_object(Bucket="agent-workspace", Key="notes.md", Body=b"# hello")
resp = s3.list_objects_v2(Bucket="agent-workspace")
for obj in resp.get("Contents", []):
    print(obj["Key"], obj["Size"])

AWS CLI

aws configure set aws_access_key_id AKIA...
aws configure set aws_secret_access_key ...
aws s3 mb s3://agent-workspace --endpoint-url https://your-gateway:9000
aws s3 cp ./notes.md s3://agent-workspace/notes.md --endpoint-url https://your-gateway:9000
aws s3 ls s3://agent-workspace --endpoint-url https://your-gateway:9000

MCP tool call (shipped server)

// An MCP client calling the shipped, IAM-governed server —
// every call resolves a principal and runs the same IAM evaluator
// as the HTTP S3 API, then writes an audit row with Origin="mcp".
{
  "tool": "assume_role_scoped",
  "arguments": {
    "bucket": "agent-workspace",
    "policy_name": "ReadOnly",
    "duration_seconds": 3600
  }
}
// Then, using the minted scoped session:
{ "tool": "list_objects", "arguments": { "bucket": "agent-workspace", "max_keys": 1000 } }
{ "tool": "get_presigned_url", "arguments": { "bucket": "agent-workspace", "key": "notes.md" } }

Use cases

Where this matters in practice.

AI coding agents reading/writing storage

Claude Code and similar agents emit boto3 or MCP tool calls directly against the gateway — the governed MCP path gives per-call audit and IAM enforcement instead of shared root keys.

Backup and sync pipelines

restic, rclone, and kopia point at the gateway as a standard S3 target with no proprietary client required.

Analytics over object storage

DuckDB httpfs and similar HTTP-range-aware readers query Parquet/CSV objects directly without downloading the whole file first.

Applications that lean on it heavily

Real software, named.

restic

Confirmed working S3 backend; benefits directly from the minio-go-targeted StripTrailingSlash compatibility fix.

DuckDB httpfs

Uses HTTPS + SigV4 to range-read Parquet/CSV objects for in-place analytics; expected to work, not exhaustively tested against this gateway.

Claude Code / AI coding agents

Emit boto3 calls or speak MCP directly to the shipped, IAM-governed 8-tool server — the intended first-class integration path for agent traffic.

Terraform (S3 provider)

Standard S3-compatible provider configuration works for bucket/object resources.

FAQ

Integration and tooling questions, answered directly.

Does boto3 just work against XNS?

Yes, with one required change: set endpoint_url explicitly. Training-data code that omits it defaults to s3.amazonaws.com and fails with 403 SignatureDoesNotMatch, which looks like an auth bug but is a missing endpoint.

Does XNS ship an MCP server for AI agents?

Yes — a first-class, IAM-governed MCP server with 8 fixed tools, not a third-party SDK wrapper. Every call resolves a principal through the same credential lookup and IAM evaluator as the HTTP S3 API and writes an audited row.

Is there a published OpenAPI or JSON Schema spec?

Not yet. Agents that bootstrap from a schema must inherit from the AWS S3 official spec and treat this gateway as a documented subset — the operation matrix on the compatibility page is the authoritative definition until a spec ships.

Are event notifications and access logging delivered, or just configured?

Configuration is real and persists on both — not a stub. Delivery (webhook push for notifications, log-file delivery for access logs) is wired for notifications end-to-end with HMAC-signed webhook delivery; treat delivery pipelines as in-progress rather than assume parity until you’ve verified the specific path you need.

What integration surfaces are explicitly out of model?

S3 Select, Inventory reports, Requester Pays, and Transfer Acceleration are deliberate scope exclusions, not gaps awaiting a fix.

See the full conformance picture.

The integration rows above are one section of the full S3 compatibility matrix — object operations, versioning, lifecycle, encryption, access control, and replication all get the same treatment.

Back to the compatibility matrix

Get started

Explore the platform

The full platform

Everything you need to go from evaluation to production.

How it works →The Relayer, erasure coding, and your Virtual Private Datacenter.S3 compatibility →Head-to-head S3 feature matrix vs the field.Eleven nines →Durability, computed — not rounded up.What's new →Everything built since you last looked.Releases →Every build, newest first — what changed and when.

Claims on this page last verified September 4, 2026