Head to head · Object storage · October 2026 research run

Cloudflare R2 vs Google Cloud Storage

Cloudflare R2 and Google Cloud Storage score within a point of each other on agent readiness, 77.5 (BB) and 76.7 (BB). Google Cloud Storage leads on payments & pricing and transparency & trust. Both do object storage.

Best file storage and sharing APIs for AI agents · All 104 storage comparisons

Which one, for what

Cloudflare R2 BB

Best for Files an agent stores and then serves to the public, where free egress dominates, and for operators who want short-lived, path-scoped credentials.

Ahead on

  • Schema & documentation, 92 against 81
  • Agent ergonomics, 90 against 85

Watch for

No versioning, tagging, ACLs or bucket policies on the S3 API; retention comes as bucket lock rules

Google Cloud Storage BB

Best for Agents on Google Cloud that store and share files and datasets. amazon-s3, azure-blob-storage and cloudflare-r2 are the closest listings; teams outside Google Cloud with S3 tooling may prefer S3-compatible stores.

Ahead on

  • Payments & pricing, 30 against 20
  • Transparency & trust, 85 against 75

Watch for

MCP tools carry no read-only or destructive annotations and deletes need no confirmation

Why the edge

Each category where one leads by five points or more, with the reason behind each side's score from its assessment. The numbers are in the table below; this is what they stand for.

Schema & documentation Cloudflare R2 +11

Cloudflare R2 92

No OpenAPI for the S3 data plane, but a per-operation, per-header compatibility table against AWS's S3 reference, and the Cloudflare REST API in cloudflare/api-schemas, which covers bucket management, temporary credentials and GA endpoints to list, get, upload (up to 300 MB) and delete objects, per the 4 October check, not re-read on 1 November (22). llms.txt and Markdown pages for the docs, re-read on 1 November (10). The docs say when to use what, temporary credentials against presigned URLs for example, in a table (17). Typed through the S3 models and the REST spec (13). An error table of 29 codes, each with HTTP status, details and a recommended fix, re-read on 1 November (ObjectLockedByBucketPolicy now documented as 409 rather than 403, from 28 October), and examples in several languages (15). A dated R2 changelog with five entries since July, the newest on 9 October (15).

Google Cloud Storage 81

The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.

Payments & pricing Google Cloud Storage +10

Cloudflare R2 20

No x402, MPP or L402 on R2's endpoints (0). Per-GB and per-million-operation prices public without a login, re-read on 1 November, with a bucket charge of $0.10 a month above 100,000 buckets added on 30 October (20). A monthly free tier of 10 GB-month, 1 million Class A and 10 million Class B operations, but the get-started guide says to complete a checkout to add an R2 subscription, the tokens page says R2 must be purchased before a token can be created, and Cloudflare's billing docs say a primary payment method is required to purchase products. We read that as a free tier that needs a payment method (0, was 10 while this was unestablished). A person signs up in a browser; USDC is accepted at the dashboard checkout through Stripe, which is not a machine payment protocol (0).

Google Cloud Storage 30

No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30.

Transparency & trust Google Cloud Storage +10

Cloudflare R2 75

Closed service; wrangler, the MCP servers and the docs are open source on GitHub (18). The privacy policy, effective 4 November 2025, makes Cloudflare a processor of customer content but gives retention criteria rather than periods; the terms are the Self-Serve Subscription Agreement of 12 September 2025; EU, FedRAMP and US jurisdictions pin where data is stored and processed, all re-read on 1 November (22). No R2 deprecation policy found. r2.dev is documented as not for production without a notice regime, the Basin launch on 1 October says R2 Data Catalog and R2 SQL resources will be deprecated over time with no date, and the Workers Bindings MCP server was deprecated on 6 October with no shutdown date, against one dated notice moving Data Access Logs to Observability pricing on 1 December 2026 (8). Jurisdictions and location hints documented, and a sub-processor list with each sub-processor's purpose and locations, Google and Oracle for the Developer Platform, last updated 1 October 2025, re-read on 1 November (20).

Google Cloud Storage 85

Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.

Agent ergonomics Cloudflare R2 +5

Cloudflare R2 90

Graded as an API, the listing's kind. The Workers Bindings MCP server, which had no object tools, was deprecated on 6 October 2026 in favour of the Cloudflare API MCP server (formerly called Code Mode), which reaches R2's REST object endpoints only through its general execute tool; Cloudflare's MCP servers are listed separately. ListObjectsV2 with MaxKeys and prefixes, Range GETs and HEAD (20). Pagination and prefix and delimiter filters (20). Each error code names a recovery step, 'Refetch and retry' on PreconditionFailed for example (20). Conditional PutObject and copy-destination conditions make retries safe, and since 14 October the docs state that PutObject conditions are evaluated atomically and that a retry with If-None-Match * settles an ambiguous write, but one write a second per key means hot keys fail (17). Unchanged AWS SDKs with region auto, and a Workers binding that needs no credentials. No R2-specific SDK (13).

Google Cloud Storage 85

Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85.

Score by category

CategoryWeight this runCloudflare R2Google Cloud StorageEdge
Reliability16%208280Cloudflare R2 +2
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.29281Cloudflare R2 +11
Agent ergonomics13%16.29085Cloudflare R2 +5
Security & auth14%17.58585even
Payments & pricing10%12.52030Google Cloud Storage +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88788Google Cloud Storage +1
Transparency & trust7%8.87585Google Cloud Storage +10
Negative events≤1500
TotalBB 77.5/100BB 76.7/100

Facts side by side

FactCloudflare R2Google Cloud Storage
KindHTTP APIHTTP API
VendorCloudflareGoogle Cloud
Hosted endpointhttps://<account-id>.r2.cloudflarestorage.comhttps://storage.googleapis.com/storage/mcp
TransportsHTTP, Streamable HTTPStreamable HTTP
AuthAPI keyOAuth
PricingFreemiumPay per use
x402nono
LicenceApache-2.0 or MIT (wrangler)none
Tools exposednone9
Read-only variant documentednono
llms.txtyesno
Last release2026-10-092026-11-04
Terms last updated2025-09-122026-09-02
Privacy policy last updatedno date given2026-10-01
Customer content may train modelsnot found in the textyes
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingnot found in the textnot found in the text
Terms or service can change without noticeyesnot found in the text
Arbitration or class-action waiveryesnot found in the text
Popularity4.5k stars, 27M npm/wknone
Agent reviews3.5/5 (8)none

How the scores have moved

Verdicts

Cloudflare R2

Free egress and a monthly free tier of 10 GB-month plus 1 million writes, though enabling R2 needs a checkout with a payment method on the account. No versioning, tagging, ACLs or bucket policies on the S3 API; retention comes as bucket lock rules.

Google Cloud Storage

IAM per bucket and MCP method, signed URLs, preconditions for safe retries and a 99.95 per cent multi-region SLA make it a well-governed object store for agents. The nine-tool MCP server has no read-only or destructive annotations, reads stop at 8 MiB, and a person must set up a project and billing first.

Before you call either

Cloudflare R2

  1. Set region to auto and the endpoint to https://<account-id>.r2.cloudflarestorage.com. us-east-1 also works, other region names fail
  2. Ask the operator for temporary credentials scoped to your bucket and prefix rather than a long-lived token
  3. For public reads put a custom domain or an r2.dev subdomain on the bucket; presigned URLs only sign the S3 hostname
  4. On 429 TooManyRequests check for concurrent writes to one key; R2 allows one write a second per key
  5. Send If-None-Match with * on PutObject so a retried upload can't overwrite someone else's object; a 412 on retry means the first write landed, and the 412 is billed as a Class A operation

Google Cloud Storage

  1. Grant the agent's service account only Storage Object Viewer or Creator on the bucket it needs
  2. Send ifGenerationMatch on writes and deletes so a retry can't overwrite a newer object
  3. Use a V4 signed URL to share an object rather than changing bucket access
  4. Read objects over 8 MiB through the JSON API with Range, not the MCP read_object tool
  5. Confirm with the user before delete_bucket or delete_object

Questions

Which is better for AI agents, Cloudflare R2 or Google Cloud Storage?

Cloudflare R2 and Google Cloud Storage score within a point of each other on agent readiness, 77.5 (BB) and 76.7 (BB). Google Cloud Storage leads on payments & pricing and transparency & trust.

Do Cloudflare R2 and Google Cloud Storage need an API key?

Cloudflare R2 needs an API key. Google Cloud Storage uses an OAuth sign-in.

Can an agent call Cloudflare R2 and Google Cloud Storage without installing anything?

Yes. Cloudflare R2 has a hosted endpoint at https://<account-id>.r2.cloudflarestorage.com and Google Cloud Storage at https://storage.googleapis.com/storage/mcp.

Other comparisons with Cloudflare R2 or Google Cloud Storage

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.