Multi-tenant control plane for S3-compatible object storage: tenant-scoped credentials, Cedar policies, quotas, audit and events. Not an S3 proxy — clients move bytes over presigned URLs. Connect API,
A multi-tenant control plane for S3-compatible object storage. Applications authenticate with a Paladin credential scoped to a tenant instead of holding storage credentials; Paladin checks each request against the tenant's Cedar policies, resolves the backend and bucket the tenant is on, meters usage against quotas, and writes an audit trail.
Paladin does not proxy traffic to S3. Object bytes move between the client and the storage backend over presigned URLs that Paladin signs; the API carries metadata only. Paladin itself calls S3 to manage buckets and objects — create and delete buckets, open and close multipart uploads, verify a completed upload, copy and delete objects server-side — never to relay a client's upload or download. ARCHITECTURE.md lists every call.
Access is granted through users, API tokens and capability tokens — short-lived, budgeted and individually revocable. The capability primitive is capability/, a separate Go module with no database driver and no storage SDK among its dependencies. Besides the Connect API, the console and the Go and Python SDKs, the same operations are exposed over the Model Context Protocol, so AI agents can use them as tools.
Paladin is one Go binary. Each role below runs as its own Deployment (paladin serve ), next to a web console:
Role What it does -------------------- api the data plane (object metadata, presigned upload and download URLs) and IAM (sign-in, users, API tokens) admin tenants, buckets, storage backends, quotas, policies, capabilities, audit mcp the api and admin operations, as tools for AI agents worker bac
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/oleg-tkachuk--paladin.html)
Self-hosted MongoDB backup and disaster recovery: streaming mongodump to disk or S3, safe-clone restores, encryption, alerts, web dashboard and MCP server. Single Go binary.
Ignitic-AI/igniticAI agents that run your e-commerce ops — Shopify, ads, CRM & support via 190+ MCP tools. Open-source, self-hosted, one docker compose up.
okf-memory/okf-agent-memoryGit-native persistent memory for AI coding agents. Implements Google OKF v0.2 with sub-300µs in-memory BM25 search, embedded MCP server, and progressive disclosure. Slashes token bloat by 80% with zer
hoangann2000/figma-mcp-consoleMCP server that lets your AI assistant read and write Figma in real time — no API token, no rate limits. Works with Claude, Cursor, Copilot, Codex and any MCP client.
Resetnak/cooldeckKeyboard-first terminal dashboard for Coolify: deployments, live logs across your whole fleet, and an MCP server for your agent
Evermemoai/evermemoA tiny, universal memory engine for humans and AI agents — CLI, HTTP API, MCP server, and shared memory hub in one small Go binary
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.