Bunny Storage vs Google Cloud Storage

Bunny Storage 45

Each zone has a read-write and a read-only password, also used as the S3 secret, with a read-only S3 password since 30 July 2026. No expiry or prefix scope, and revoking means resetting. The account API key has full access (20). Read-only passwords, and deleting the zone root needs allowRootDelete=true, but nothing finer (12). Returns stored bytes, with no guidance on treating them as untrusted (8). No audit log of storage or API key use found (3). bunny.net/.well-known/security.txt redirects to an HTML page on 4 November, and the docs name no disclosure policy, bounty or certification (2). 20+12+8+3+2 = 45.

Google Cloud Storage 85

IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85.

Bunny Storage 61

No MCP server. An HTTP listing returns the whole folder as one JSON array; S3 ListObjectsV2 can page and filter by prefix (12). The docs give no pagination for HTTP listings; S3 has continuation tokens and prefixes, in preview (10). The S3 error table and the limits page's rate-limit responses give codes an agent can act on, while the HTTP API still documents three (12). A PUT by path is safe to repeat, the Checksum header rejects corrupt uploads, S3 takes conditional requests, and DeleteObjects reports each key separately (14). One PUT with one header, and official SDKs for TypeScript, PHP, .NET and Java (13). 12+10+12+14+13 = 61.

Google Cloud Storage 85

Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85.

Bunny Storage 61

Closed service, terms and privacy policy naming BunnyWay d.o.o. in Slovenia (15). Privacy policy updated 5 August 2026 and deletion after termination in the terms, per the 30 September check. No DPA read this run (18). No deprecation policy found; the changelog marks previews but sets no notice periods (5). Storage regions chosen per zone and an EEA routing filter for pull zones; we didn't read a sub-processor list (14).

Google Cloud Storage 85

Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.

Bunny Storage 67

No OpenAPI for the storage data plane; the storage API reference is a Markdown page, and the core spec covers zone management, now including a Get Storage Zone Regions call (12). llms.txt with Markdown pages, re-read on 4 November (10). The HTTP API page says what each call does in a line or two (12). Path-based calls with a few headers, little to type (9). curl examples for each call. The HTTP API page still documents only 201, 400 and 401, but the S3 page now has an error table (412, 400 BadDigest, MetadataTooLarge, 501, 503 SlowDown and others) and the limits page gives the response for each rate limit (12). A dated changelog, with storage entries on 14 August and 23 October 2026; the storage API itself carries no version (12). 12+10+12+9+12+12 = 67.

Google Cloud Storage 81

The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.

Bunny Storage 75

Last storage API change on 23 October 2026, S3 bulk deletes with DeleteObjects, object metadata and a Get Storage Zone Regions API, 12 days before this check (30). In the 90 days from 6 August, storage changelog entries on 14 August and 23 October, @bunny.net/storage-sdk 0.3.2 (tag 23 September), and Bunny CLI releases that change its storage commands (0.14.0 on 20 August to 0.20.3 on 23 October), counted in full since the SDK and CLI releases change code, and the changelog entries and the SDK release alone make three (20). A dated public changelog; we didn't test support (10). Official storage SDKs for TypeScript (0.3.2, September 2026), PHP (3.4.0, July 2024), .NET (last commit February 2022) and Java (1.0.3, April 2022), so only one is current (8). The TypeScript SDK's repository runs CI and changesets; the .NET and Java libraries are untouched since 2022 (7). 30+20+10+8+7 = 75.

Google Cloud Storage 88

Release notes on 4 November 2026 (30). Entries on 30 October, 13 October, 30 September, 10 September and 3 September (20). A closed service with dated release notes and paid support; issue trackers for the client libraries are public (15). Official client libraries in many languages (15). Libraries ship with end-to-end checksums by default since 30 September (8). 30 + 20 + 15 + 15 + 8 = 88.

Bunny Storage 40

No x402, MPP or L402 (0). Per-GB storage prices public without a login, re-read on the storage pricing page ($0.01 a GB-month Standard in one region) (20). A 14-day trial with no credit card, per the SLA page on 4 November (20). A person signs up in a browser (0). 0+20+20+0 = 40.

Google Cloud Storage 30

No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30.