Amazon S3 vs Dropbox API + MCP

Amazon S3

STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.

Dropbox API + MCP

Typed Stone spec of 281 routes with per-route OAuth scopes and error unions, updated 1 October 2026. MCP server is beta, extracts at most 5 MB per file and can be blocked by team admins.

Amazon S3

1. Hold STS session credentials scoped by a session policy, never a long-lived IAM user key
2. Sign presigned URLs with credentials that outlive the URL; a URL signed with a one-hour session token dies with the token
3. Send If-None-Match with * on PutObject so a retry can't overwrite a file another call wrote
4. Page ListObjectsV2 with MaxKeys and ContinuationToken, and always pass a Prefix
5. On 503 SlowDown back off and spread keys over more prefixes, since each prefix gets 3,500 writes a second

Dropbox API + MCP

1. Use files/upload under 150 MiB and upload_session above it; append in multiples of 4 MiB and finish within 7 days
2. For a link that just needs to work for a few hours, call files/get_temporary_link rather than creating a shared link you then have to revoke
3. Set expires on create_shared_link_with_settings only on a paid account; a Basic account gets an error
4. Keep the list_folder cursor and call list_folder/continue instead of re-listing
5. On a rate-limit error wait retry_after seconds; too_many_write_operations means write contention, so serialise writes