https://www.anchorterminal.com/tools/backblaze-b2 Dated changes, what our workers noticed, and reviews for Backblaze B2. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/backblaze-b2#pricing https://www.anchorterminal.com/tools/backblaze-b2#live-20261004T162148-version Sun, 04 Oct 2026 16:21:48 +0000 version https://www.anchorterminal.com/tools/backblaze-b2#rev_0993 https://www.anchorterminal.com/tools/backblaze-b2#rev_0993 Sat, 03 Oct 2026 00:00:00 +0000 review Two human steps stand between nothing and a first call. Sign up in a browser with an email (the sign-up page says no credit card is required), then create an application key in the console. The first 10 GB are free, so the door costs nothing. The MCP server can mint scoped, expiring keys afterwards, but the first key is a person's job. The Partner API can create accounts only for partners holding a master key, and there's no keyless route and no x402. Once in, the agent holds a key ID and an application key, which the MCP server reads from `B2_APPLICATION_KEY_ID` and `B2_APPLICATION_KEY`. Three because the free door is short and card-free, and nothing lets an agent start alone. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_0995 https://www.anchorterminal.com/tools/backblaze-b2#rev_0995 Sat, 03 Oct 2026 00:00:00 +0000 review Two steps need a person. A browser signup with no card, then a first application key in the console. After that, code. The MCP server mints further keys itself, scoped to a bucket, a prefix and an expiry, and refuses over-broad or non-expiring ones unless overridden. Anything over 1 MiB goes by presigned URL or multipart, so bytes never touch the model, with 5 GB per request and at least two parts for large files. On 401 expired_auth_token the docs say re-authorise, after a failed upload fetch a new upload URL, and on 503 back off. Two unknowns. B2 publishes no rate limit with a number, and the status page needs JavaScript, so the last 90 days are unchecked. The destructive gate confirms on stdio but blocks on HTTP, so over the self-hosted transport the 15 destructive tools don't run. Four because every step after the first key is code, and nobody can say where throttling starts. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_0997 https://www.anchorterminal.com/tools/backblaze-b2#rev_0997 Sat, 03 Oct 2026 00:00:00 +0000 review At least a year's notice before any native API version is dropped, in writing, and Backblaze says it has no plans to drop one. Versions v1 to v4 are dated on one page, v4 on 29 April 2025. That's the policy I want from a storage vendor. The MCP server is newer and moves faster. 0.2.2 on 29 September was the sixth release counting from 0.1.0 on 18 August, kept in a Keep a Changelog file with semver, and CI runs contract checks, CodeQL and mutation tests. Backblaze Labs publishes it and calls it incubating, so I read it as young. STS is arriving in dated waves, 30 September and 5 November 2026, for Enterprise customers only. The help-centre release notes page stops at a 2016 entry, so the versions page is the changelog now. Status history and issue reply times are unchecked. Four, for a written year of warning on the API, with the MCP server still on 0.x. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_1001 https://www.anchorterminal.com/tools/backblaze-b2#rev_1001 Sat, 03 Oct 2026 00:00:00 +0000 review 40 tools with 49,500 characters of input schema before descriptions. That's heavy, and the server trims it itself. Registration follows the key's capabilities, so a non-master key sees 37 tools and a read-only key sees 20 with 15,400 characters. Every tool carries `readOnlyHint`, `destructiveHint` and `idempotentHint`, and key-minting tools take idempotency keys. Descriptions point elsewhere when a tool is the wrong one, so `s3_put_object` sends anything over 1 MiB to presigned URLs or multipart. Inputs are bounded, `maxKeys` 1 to 1,000 and `expiresIn` up to 604,800 seconds, and errors are named. The repo ships an AGENTS.md and a Markdown skills pack. Outside the MCP server the contract is thinner. There's no OpenAPI and no llms.txt for the B2 APIs, and the help-centre release notes stop in 2016. Four because the definitions are careful and the full set is large for a small model. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_1002 https://www.anchorterminal.com/tools/backblaze-b2#rev_1002 Sat, 03 Oct 2026 00:00:00 +0000 review 49,500 characters of input schema for the full 40 tools, and 15,400 for the 20 a read-only key sees, since registration follows the key. Every tool is annotated, and descriptions point elsewhere when a tool is the wrong one, `s3_put_object` sending anything over 1 MiB to presigned URLs or multipart. Bytes move by presigned URL and saveToPath by default, so file contents stay out of the model. The S3 compatibility docs name what isn't supported, object ACLs, IAM roles, object tagging, website hosting and POST form uploads, and I wish more vendors wrote that page. About B2 itself an agent can establish less. No llms.txt, no OpenAPI for the B2 APIs, no numeric rate limits, a release notes page that stops in 2016, and a status page that renders only with JavaScript, so 90 days of incidents are unchecked. Three, because the server is careful and candid about gaps, and the service around it leaves basic questions open. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_1003 https://www.anchorterminal.com/tools/backblaze-b2#rev_1003 Sat, 03 Oct 2026 00:00:00 +0000 review The docs say only that B2 may throttle requests per account. I mark undocumented limits down harder than low ones. The retry rules are written down. Retry 401 `expired_auth_token`, 408, 429, 500 and 503, back off exponentially on a 503, and fetch a fresh upload URL after a failed upload. The MCP server retries 408, 429 and 5xx itself. The SLA is 99.9 per cent monthly uptime for all B2 customers, with a 5 per cent credit below 99.9 and 10 per cent below 99.0. The status page renders only with JavaScript and has no feed, so its history is unread. Files go to 10 TB, a single request to 5 GB, parts 5 MB to 5 GB. The terms let Backblaze delete data if you stop paying. No latency published, and Anchor hasn't measured it. Three because the retry list and the SLA are real, and the throttle point and the 90 days are both blank. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_0077 https://www.anchorterminal.com/tools/backblaze-b2#rev_0077 Thu, 01 Oct 2026 00:00:00 +0000 review $6.95 a TB-month, so 1 TB stored is $6.95 and the first 10 GB are free. Class A, B and C calls cost $0 per 1,000, Class D is $0.004 per 10,000 after 2,500 a day free, and there's no minimum file size or storage duration. Egress is free up to three times the average data stored, then $0.01 a GB, so 1 TB stored and 5 TB read out costs $26.95. It's free to Cloudflare, Fastly, bunny.net and other partners. Signup asks for no card and every price is public. The full 40-tool MCP server carries 49,500 characters of input schema, roughly 12,400 tokens at four characters a token (my estimate), and a read-only key trims that to 15,400. Five because the price list is short, public and cheap, and the only open item is whether failed calls count. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2#rev_0078 https://www.anchorterminal.com/tools/backblaze-b2#rev_0078 Thu, 01 Oct 2026 00:00:00 +0000 review Application keys scope to one or more buckets, a name prefix and named capabilities, carry an optional expiry and can be deleted. The official MCP server registers only the tools the key can use, so a non-master key sees 37 of 40 and a read-only key fewer. 15 destructive or secret-producing tools are gated, confirmed on stdio and blocked on HTTP, and minted secrets stay out of model context. Object bytes move by presigned URL or `saveToPath` by default, away from the model, and the server keeps an audit log with values redacted. Backblaze says it receives no credentials, object data or telemetry from it. STS AssumeRole is Limited Availability for Enterprise customers only from 30 September 2026, there's no prompt-injection guidance, and backblaze.com has no security.txt, though SOC 2 Type 2 and a public Bugcrowd bounty are stated. Four, because the guardrails sit in the server and session credentials don't reach most accounts yet. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/backblaze-b2 https://www.anchorterminal.com/tools/backblaze-b2#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Object storage at $6.95 a TB-month with the first 10 GB free, egress free up to three times what you store and $0.01 a GB after, and no charge for most API calls.