{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/amazon-s3.json", "name": "Amazon S3", "score": 77.9, "shared": [ "storage.object", "storage.s3", "storage.presigned", "storage.share" ], "slug": "amazon-s3" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/cloudflare-r2.json", "name": "Cloudflare R2", "score": 77.1, "shared": [ "storage.object", "storage.s3", "storage.presigned", "storage.share" ], "slug": "cloudflare-r2" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/backblaze-b2.json", "name": "Backblaze B2", "score": 75.3, "shared": [ "storage.object", "storage.s3", "storage.presigned", "storage.share" ], "slug": "backblaze-b2" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/tigris.json", "name": "Tigris", "score": 44.4, "shared": [ "storage.object", "storage.s3", "storage.presigned", "storage.share" ], "slug": "tigris" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/azure-blob-storage.json", "name": "Azure Blob Storage", "score": 75.7, "shared": [ "storage.object", "storage.presigned", "storage.share" ], "slug": "azure-blob-storage" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/wasabi-hot-cloud-storage.json", "name": "Wasabi Hot Cloud Storage", "score": 61.2, "shared": [ "storage.object", "storage.s3", "storage.presigned" ], "slug": "wasabi-hot-cloud-storage" } ], "tool": { "slug": "digitalocean-spaces", "name": "DigitalOcean Spaces", "vendor": "DigitalOcean, LLC", "vendorUrl": "https://www.digitalocean.com", "kind": "http-api", "category": "file-storage", "summary": "DigitalOcean Spaces is S3-compatible object storage with a built-in CDN, sold as a $5 monthly subscription. Agents use it through AWS S3 SDKs with a Spaces access key, and manage keys through the DigitalOcean API or MCP server.", "url": "https://www.anchorterminal.com/tools/digitalocean-spaces", "markdownUrl": "https://www.anchorterminal.com/tools/digitalocean-spaces.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/digitalocean-spaces.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/digitalocean-spaces.json", "license": "Proprietary service under the DigitalOcean Terms of Service Agreement. The MCP server is MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://nyc3.digitaloceanspaces.com", "packages": [ { "registry": "npm", "name": "@digitalocean/mcp" } ], "auth": "api-key", "authNotes": "Self-serve Spaces access key and secret, signed as for AWS S3 (SigV4, or SigV2 for older clients). A person signs up in a browser and adds a payment method first. Keys are full access or limited to named buckets with Read or Read/Write/Delete, and are made in the control panel or through `/v2/spaces/keys` with a scoped DigitalOcean API token. The remote MCP server takes OAuth with a browser sign-in, or a bearer API token.", "pricing": "usage", "pricingNotes": "$5 a month for 250 GiB of storage and 1,024 GiB of outbound transfer across all buckets, then $0.02 a GiB-month and $0.01 a GiB. No request charges are listed. The CDN is included. Cold Storage is $0.007 a GiB-month plus $0.01 a GiB retrieved. A $5 sign-up credit lasts 90 days and needs a payment method, so there is no start without a card (https://docs.digitalocean.com/products/spaces/details/pricing/; https://docs.digitalocean.com/platform/billing/signup-credit/).", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Spaces docs, the API reference index or the pricing pages. A Stablecoin Payment Addendum of 25 November 2025 covers account payments through Stripe, not per-request payment (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.digitalocean.com/products/spaces/", "llmsTxt": "https://docs.digitalocean.com/llms.txt", "openapi": "https://docs.digitalocean.com/reference/api/reference/openapi.json", "capabilities": [ "storage.object", "storage.s3", "storage.presigned", "storage.share" ], "tags": [ "hosted", "closed-source", "s3-compatible", "cdn", "mcp", "oauth", "llms-txt", "openapi", "usage-priced", "status-page", "sla", "soc-2" ], "lastRelease": "2026-04-08", "graded": true, "anchor": { "graded": true, "score": 63.2, "grade": "B", "agentReady": false, "rank": 402, "ranked": true, "rankOf": 950, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 37, "payments": 20, "reliability": 77, "schema": 63, "security": 77, "transparency": 74 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 77, "points": 15.4, "reason": "Graded as a hosted API on the S3 surface. Status page at status.digitalocean.com with a readable history feed (20). The feed reaches back to 24 July 2026, 77 days. It shows failed write operations across services, Spaces among them, for 2 hours 26 minutes on 6 August, a 63-minute network disruption in BLR1 on 3 October that included Spaces, control panel access to Spaces failing for about two hours on 21 August and a Cold Storage billing display fault on 4 August. We read the 6 August event as one major incident (10). Limits published with numbers, 800 operations a second per new bucket and 5,000 requests an hour on the DigitalOcean API (15). Exponential backoff advised on `503 Slow Down`, and `retry-after` on the DigitalOcean API's 429. No retry or idempotency guidance for S3 writes (12). The Spaces SLA commits to 99.9 per cent monthly uptime per bucket (10). The S3 API and remote MCP servers are generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 63, "points": 10.24, "reason": "The DigitalOcean API has a public OpenAPI file, which covers access keys and CDN endpoints. The S3 surface has no description file. Its reference lists each supported operation with headers and the minimum permission level, and defers to AWS for the rest (15). `llms.txt` and a Markdown twin of every page (10). The S3 reference gives one line per operation with a link to AWS, and the MCP tool descriptions are a few words each, such as 'Delete a CDN' (10). Header tables per operation, enumerated grants on the keys API, and MCP tools with required fields, a maximum and output schemas (10). A request and response example for most operations, but no error codes in the S3 reference beyond `NotImplemented` for unsupported calls (8). Dated Spaces release notes and a versioned DigitalOcean API. The limits page and the compatibility page disagree on `ListObjectsV2` (10)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "Graded as an API, with the MCP server noted. Responses are sized by S3's own controls, `Range` and `HEAD` among the listed headers, and the Spaces MCP endpoint carries only ten compact tools (20). S3 listing with prefix and marker, and `per_page` up to 200 on the DigitalOcean API. The limits page lists `list-objects-v2` pagination as a known issue (14). `503 Slow Down` and `NotImplemented` are the only S3 errors described. The DigitalOcean API documents its error bodies (10). A `PUT` by key can be repeated, conditional copy headers are listed, and all ten MCP tools set read-only, idempotent or destructive hints with a risk class (16). AWS SDK examples in several languages and official DigitalOcean SDKs for TypeScript, Go and Python. Most AWS SDKs need `us-east-1` as a placeholder region to create a bucket (13)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 77, "points": 13.48, "reason": "Access keys are revocable, can be regenerated and can be limited to named buckets with Read or Read/Write/Delete. DigitalOcean API tokens take custom scopes, and the MCP server issues short-lived OAuth tokens. Three off because SigV2 is still accepted and a limited key cannot coexist with a bucket policy (27). Read-only keys, versioning and a one-week recovery period for destroyed buckets. No Object Lock or confirmation step in the API was found (14). Returns stored bytes, with no guidance on treating them as untrusted. The key creation tool's description warns about handling the secret (8). Bucket and CDN access logs in S3 format, off by default, and an account security history that the docs say can show the wrong IP address for deletes (11). security.txt valid to 2028 with an Intigriti programme as contact, and SOC 2 and SOC 3 reports named on the trust page. ISO 27001 was not named on the page read (17)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "No x402, MPP or L402. Stablecoin payment through Stripe is an account payment method (0). Prices per GiB are public without a login (20). The $5 sign-up credit needs a valid payment method before any resource is created (0). A person signs up in a browser. The keys API needs a token from that account (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 37, "points": 3.24, "reason": "Closed service. Its own release notes stop at 8 April 2026, 184 days before the check, which scores 0. The MCP server that carries the Spaces tools was tagged v1.2.0 on 7 October 2026 and its Spaces tools changed on 22 September, but that server cannot read or write objects, so it does not count as a release of the service graded here. No Spaces release notes in the last 90 days. The MCP server had seven tags in that time (10). Public release notes with an RSS feed, support tickets and a public repository with 193 commits in 90 days. Issue response times were not checked (10). Current official SDKs in three languages. The only MCP registry entry found for DigitalOcean is a third party's (10). The MCP repository has CI and release workflows and tests that guard tool annotations (7)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "note": "editorial 63, provenance 85", "reason": "Closed service under a Terms of Service Agreement updated on 22 August 2026 that leaves ownership of content with the customer. The MCP server is MIT (15). The DPA of 6 February 2026 gives deletion within 30 days of account deactivation and breach notice without undue delay. The privacy policy excludes customer content, and the terms give no retention period in days (22). No general deprecation policy. The terms promise notice of changes as far as reasonably practicable, and old rate limits are dated per data centre (8). A sub-processor list of 10 June 2026 with activity and location, Cloudflare for the CDN and Wasabi for Cold Storage among them, and 13 named storage regions (18)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded as an API, with the MCP server noted. Responses are sized by S3's own controls, `Range` and `HEAD` among the listed headers, and the Spaces MCP endpoint carries only ten compact tools (20). S3 listing with prefix and marker, and `per_page` up to 200 on the DigitalOcean API. The limits page lists `list-objects-v2` pagination as a known issue (14). `503 Slow Down` and `NotImplemented` are the only S3 errors described. The DigitalOcean API documents its error bodies (10). A `PUT` by key can be repeated, conditional copy headers are listed, and all ten MCP tools set read-only, idempotent or destructive hints with a risk class (16). AWS SDK examples in several languages and official DigitalOcean SDKs for TypeScript, Go and Python. Most AWS SDKs need `us-east-1` as a placeholder region to create a bucket (13).", "maintenance": "Closed service. Its own release notes stop at 8 April 2026, 184 days before the check, which scores 0. The MCP server that carries the Spaces tools was tagged v1.2.0 on 7 October 2026 and its Spaces tools changed on 22 September, but that server cannot read or write objects, so it does not count as a release of the service graded here. No Spaces release notes in the last 90 days. The MCP server had seven tags in that time (10). Public release notes with an RSS feed, support tickets and a public repository with 193 commits in 90 days. Issue response times were not checked (10). Current official SDKs in three languages. The only MCP registry entry found for DigitalOcean is a third party's (10). The MCP repository has CI and release workflows and tests that guard tool annotations (7).", "payments": "No x402, MPP or L402. Stablecoin payment through Stripe is an account payment method (0). Prices per GiB are public without a login (20). The $5 sign-up credit needs a valid payment method before any resource is created (0). A person signs up in a browser. The keys API needs a token from that account (0).", "reliability": "Graded as a hosted API on the S3 surface. Status page at status.digitalocean.com with a readable history feed (20). The feed reaches back to 24 July 2026, 77 days. It shows failed write operations across services, Spaces among them, for 2 hours 26 minutes on 6 August, a 63-minute network disruption in BLR1 on 3 October that included Spaces, control panel access to Spaces failing for about two hours on 21 August and a Cold Storage billing display fault on 4 August. We read the 6 August event as one major incident (10). Limits published with numbers, 800 operations a second per new bucket and 5,000 requests an hour on the DigitalOcean API (15). Exponential backoff advised on `503 Slow Down`, and `retry-after` on the DigitalOcean API's 429. No retry or idempotency guidance for S3 writes (12). The Spaces SLA commits to 99.9 per cent monthly uptime per bucket (10). The S3 API and remote MCP servers are generally available (10).", "schema": "The DigitalOcean API has a public OpenAPI file, which covers access keys and CDN endpoints. The S3 surface has no description file. Its reference lists each supported operation with headers and the minimum permission level, and defers to AWS for the rest (15). `llms.txt` and a Markdown twin of every page (10). The S3 reference gives one line per operation with a link to AWS, and the MCP tool descriptions are a few words each, such as 'Delete a CDN' (10). Header tables per operation, enumerated grants on the keys API, and MCP tools with required fields, a maximum and output schemas (10). A request and response example for most operations, but no error codes in the S3 reference beyond `NotImplemented` for unsupported calls (8). Dated Spaces release notes and a versioned DigitalOcean API. The limits page and the compatibility page disagree on `ListObjectsV2` (10).", "security": "Access keys are revocable, can be regenerated and can be limited to named buckets with Read or Read/Write/Delete. DigitalOcean API tokens take custom scopes, and the MCP server issues short-lived OAuth tokens. Three off because SigV2 is still accepted and a limited key cannot coexist with a bucket policy (27). Read-only keys, versioning and a one-week recovery period for destroyed buckets. No Object Lock or confirmation step in the API was found (14). Returns stored bytes, with no guidance on treating them as untrusted. The key creation tool's description warns about handling the secret (8). Bucket and CDN access logs in S3 format, off by default, and an account security history that the docs say can show the wrong IP address for deletes (11). security.txt valid to 2028 with an Intigriti programme as contact, and SOC 2 and SOC 3 reports named on the trust page. ISO 27001 was not named on the page read (17).", "transparency": "Closed service under a Terms of Service Agreement updated on 22 August 2026 that leaves ownership of content with the customer. The MCP server is MIT (15). The DPA of 6 February 2026 gives deletion within 30 days of account deactivation and breach notice without undue delay. The privacy policy excludes customer content, and the terms give no retention period in days (22). No general deprecation policy. The terms promise notice of changes as far as reasonably practicable, and old rate limits are dated per data centre (8). A sub-processor list of 10 June 2026 with activity and location, Cloudflare for the CDN and Wasabi for Cold Storage among them, and 13 named storage regions (18)." }, "sources": [ { "what": "docs index (llms.txt)", "url": "https://docs.digitalocean.com/llms.txt", "seen": "2026-10-09" }, { "what": "Spaces overview and latest updates", "url": "https://docs.digitalocean.com/products/spaces/", "seen": "2026-10-09" }, { "what": "Spaces pricing", "url": "https://docs.digitalocean.com/products/spaces/details/pricing/", "seen": "2026-10-09" }, { "what": "Spaces limits and known issues", "url": "https://docs.digitalocean.com/products/spaces/details/limits/", "seen": "2026-10-09" }, { "what": "Spaces feature list", "url": "https://docs.digitalocean.com/products/spaces/details/features/", "seen": "2026-10-09" }, { "what": "Spaces availability", "url": "https://docs.digitalocean.com/products/spaces/details/availability/", "seen": "2026-10-09" }, { "what": "Spaces S3 API reference", "url": "https://docs.digitalocean.com/reference/api/spaces/", "seen": "2026-10-09" }, { "what": "S3 compatibility", "url": "https://docs.digitalocean.com/products/spaces/reference/s3-compatibility/", "seen": "2026-10-09" }, { "what": "AWS SDK guide", "url": "https://docs.digitalocean.com/products/spaces/reference/aws-sdks/", "seen": "2026-10-09" }, { "what": "access keys guide", "url": "https://docs.digitalocean.com/products/spaces/how-to/manage-access/", "seen": "2026-10-09" }, { "what": "file permissions and presigned URLs", "url": "https://docs.digitalocean.com/products/spaces/how-to/set-file-permissions/", "seen": "2026-10-09" }, { "what": "access logs", "url": "https://docs.digitalocean.com/products/spaces/how-to/access-logs/", "seen": "2026-10-09" }, { "what": "Spaces release notes", "url": "https://docs.digitalocean.com/release-notes/spaces/", "seen": "2026-10-09" }, { "what": "Spaces Keys API reference", "url": "https://docs.digitalocean.com/reference/api/reference/spaces-keys/", "seen": "2026-10-09" }, { "what": "DigitalOcean API introduction (rate limits, pagination)", "url": "https://docs.digitalocean.com/reference/api/reference/public-apis/", "seen": "2026-10-09" }, { "what": "remote MCP configuration", "url": "https://docs.digitalocean.com/reference/mcp/configure-mcp/", "seen": "2026-10-09" }, { "what": "Spaces MCP tools", "url": "https://docs.digitalocean.com/reference/mcp/spaces-mcp-tools/", "seen": "2026-10-09" }, { "what": "SDK and client libraries", "url": "https://docs.digitalocean.com/reference/libraries/", "seen": "2026-10-09" }, { "what": "sign-up credit", "url": "https://docs.digitalocean.com/platform/billing/signup-credit/", "seen": "2026-10-09" }, { "what": "MCP server source at v1.2.0 (shallow clone, read not run)", "url": "https://github.com/digitalocean-labs/mcp-digitalocean", "seen": "2026-10-09" }, { "what": "pricing page", "url": "https://www.digitalocean.com/pricing/spaces-object-storage", "seen": "2026-10-09" }, { "what": "Spaces SLA", "url": "https://www.digitalocean.com/sla/spaces", "seen": "2026-10-09" }, { "what": "Terms of Service Agreement", "url": "https://www.digitalocean.com/legal/terms-of-service-agreement", "seen": "2026-10-09" }, { "what": "Service Terms", "url": "https://www.digitalocean.com/legal/tos-service-specific-terms", "seen": "2026-10-09" }, { "what": "Acceptable Use Policy", "url": "https://www.digitalocean.com/legal/acceptable-use-policy", "seen": "2026-10-09" }, { "what": "privacy policy", "url": "https://www.digitalocean.com/legal/privacy-policy", "seen": "2026-10-09" }, { "what": "Data Processing Agreement", "url": "https://www.digitalocean.com/legal/data-processing-agreement", "seen": "2026-10-09" }, { "what": "Stablecoin Payment Addendum", "url": "https://www.digitalocean.com/legal/stablecoin-payment-addendum", "seen": "2026-10-09" }, { "what": "sub-processor list", "url": "https://www.digitalocean.com/trust/subprocessors", "seen": "2026-10-09" }, { "what": "trust page", "url": "https://www.digitalocean.com/trust", "seen": "2026-10-09" }, { "what": "security.txt", "url": "https://www.digitalocean.com/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "status history feed", "url": "https://status.digitalocean.com/history.rss", "seen": "2026-10-09" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=digitalocean", "seen": "2026-10-09" }, { "what": "RDAP for digitalocean.com", "url": "https://rdap.verisign.com/com/v1/domain/digitalocean.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the DigitalOcean OpenAPI file itself. Its address is listed in `llms.txt`, and we read the rendered Spaces Keys reference instead", "unchecked: the certification reports page and the Intigriti programme page, so whether a paid bounty exists and which SOC 2 type applies were not confirmed", "unchecked: status history before 24 July 2026. The feed holds 25 entries, which covers 77 of the 90 days", "unchecked: issue response times on the MCP repository, which a clone does not show, and npm download figures", "Legal, trust and SLA pages on www.digitalocean.com were read through a summarising reader, so clause wording should be confirmed before quoting", "Whether Cold Storage has a separate 99.5 per cent SLA, as the product details page says. The Spaces SLA page gives 99.9 per cent without naming tiers", "Whether `ListObjectsV2` pagination works. The limits page and the compatibility page disagree", "`lastRelease` is the MCP server tag of 7 October 2026. The Spaces release notes last changed on 8 April 2026", "The lead said Spaces is usable through remote MCP servers and the CLI. The MCP tools cover keys and CDN endpoints only, and the docs say `doctl` cannot manage files", "The Acceptable Use Policy bars scraping of service content and testing without written consent. Read as a fact with no deduction. It matters before any probe is run", "One typed address, https://www.digitalocean.com/legal/service-level-agreement, returned 404. The SLA was then found through the Service Terms" ] }, "negative": 0, "verdict": "Per-bucket access keys with read or read-write-delete grants, an 800 operations a second limit per bucket and a 99.9 per cent SLA are all published. The MCP server manages keys and CDN endpoints only, not objects, and the S3 reference documents no error codes. A payment method is required before any bucket is created.", "bestFor": "Teams already on DigitalOcean that want object storage with a CDN and a flat $5 entry price for up to 250 GiB, with free transfer to Droplets in the same region.", "strengths": [ "Spaces access keys can be limited to named buckets with read or read-write-delete grants, and are created through `/v2/spaces/keys` or the control panel", "Limits are published with numbers, 800 operations a second per new bucket, with exponential backoff advised on `503 Slow Down`", "The Spaces SLA of 2 December 2025 gives 99.9 per cent monthly uptime per bucket, with credits of 10, 25 and 100 per cent", "Every docs page has a Markdown twin, indexed in `llms.txt`, and the S3 reference lists each supported operation with its minimum permission level", "All ten Spaces tools in the MCP server (MIT licence) carry read-only, idempotent or destructive hints and a risk class, checked by tests" ], "weaknesses": [ "The Spaces MCP server has ten tools for access keys and CDN endpoints. None reads, writes, lists or shares an object", "The access guide and the limits page say keys cannot be created through the API, while the API reference documents `POST /v2/spaces/keys`", "The limits page lists `list-objects-v2` pagination as unsupported, and the compatibility page says to use `ListObjectsV2` for new applications", "No error codes are documented in the S3 reference. Unsupported calls return `NotImplemented`, and no Object Lock was found", "The $5 sign-up credit needs a payment method first, and a subscription costs $5 a month once the first bucket exists", "The Acceptable Use Policy of 20 March 2026 bars scraping of service content and any probing or testing without written consent, which matters before any probe is run" ], "agentNotes": [ "Set the endpoint to `https://\u003cregion\u003e.digitaloceanspaces.com` and, in AWS SDKs other than Python's, set `region` to `us-east-1` when creating a bucket", "Ask for a limited access key with a Read or Read/Write/Delete grant on one bucket. A full access key can create, configure and delete every bucket", "Do the object work through the S3 API. The MCP server and `doctl` cannot upload, list, move or delete files", "Retry with exponential backoff on `503 Slow Down`, and keep below 800 operations a second per bucket", "Fetch presigned links from the origin host, not the CDN. The docs say presigned requests through the CDN are not cached and can double the bandwidth charge", "Avoid many tiny objects. Each bills as at least 4 KiB on Standard and 128 KiB on Cold Storage, which also has a 30-day minimum" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.2 } ], "editorialScores": { "ergonomics": 73, "maintenance": 37, "payments": 20, "reliability": 77, "schema": 63, "security": 77, "transparency": 63 }, "provenanceScore": 85 }, "connect": { "http": "import boto3\nsession = boto3.session.Session()\nclient = session.client('s3',\n region_name='nyc3',\n endpoint_url='https://nyc3.digitaloceanspaces.com',\n aws_access_key_id='YOUR_SPACES_KEY',\n aws_secret_access_key='YOUR_SPACES_SECRET')\nclient.upload_file('localfile.txt', 'my-bucket', 'uploaded.txt')", "config": { "mcpServers": { "spaces": { "url": "https://spaces.mcp.digitalocean.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/storage.object", "tool": "https://letme.dev/digitalocean-spaces" }, "sameCompany": [ "digitalocean-mcp" ], "notable": [ "A Spaces subscription is $5.00 a month with 250 GiB of storage and 1,024 GiB of outbound transfer across all buckets, then $0.02 a GiB-month and $0.01 a GiB (https://docs.digitalocean.com/products/spaces/details/pricing/)", "Cold Storage is $0.007 a GiB-month and $0.01 a GiB retrieved, with a 30-day minimum and objects under 128 KiB billed as 128 KiB. It has been generally available since 2 December 2025 (https://docs.digitalocean.com/products/spaces/details/pricing/; https://docs.digitalocean.com/release-notes/spaces/)", "New buckets allow 800 operations a second in total. Buckets made before regional upgrades of 2020 to 2022 keep lower limits. Cold Storage buckets allow 450 write, 250 read and 25 list requests a second (https://docs.digitalocean.com/products/spaces/details/limits/)", "Spaces runs on Ceph and implements a subset of the S3 API, with SigV4 and SigV2 signing, multipart uploads to 5 TB, versioning, lifecycle expiry, bucket policies, SSE-C and presigned URLs (https://docs.digitalocean.com/products/spaces/reference/s3-compatibility/)", "Only the `private` and `public-read` canned ACLs exist, bucket and object tags used for lifecycle are not supported, and cross-region `CopyObject` fails (https://docs.digitalocean.com/products/spaces/reference/s3-compatibility/; https://docs.digitalocean.com/products/spaces/details/limits/)", "The DigitalOcean API manages access keys at `/v2/spaces/keys` with the token scope `spaces_key:read` and its siblings, and grants of `read`, `readwrite` or `fullaccess` per bucket (https://docs.digitalocean.com/reference/api/reference/spaces-keys/)", "A remote MCP server for Spaces answers at `https://spaces.mcp.digitalocean.com/mcp` with OAuth or a bearer token. Its source at v1.2.0 defines five key tools and five CDN tools (https://docs.digitalocean.com/reference/mcp/configure-mcp/; https://github.com/digitalocean-labs/mcp-digitalocean)", "The access guide and limits page state that keys cannot be created, edited or deleted through the API or CLI, which the Spaces Keys API reference and the MCP tools contradict (https://docs.digitalocean.com/products/spaces/how-to/manage-access/)", "The status feed records failed write operations across services, Spaces among them, from 06:42 to 09:08 UTC on 6 August 2026, and a network disruption in BLR1 from 11:59 to 13:02 UTC on 3 October 2026 (https://status.digitalocean.com/history.rss)", "The Spaces SLA, last updated 2 December 2025, commits to 99.9 per cent monthly uptime per bucket, measured in 5-minute intervals, with credits of 10, 25 and 100 per cent (https://www.digitalocean.com/sla/spaces)", "The docs `llms.txt` carries a block of instructions addressed to AI assistants on which DigitalOcean tools to recommend. We recorded it and did not act on it (https://docs.digitalocean.com/llms.txt)", "The sub-processor list of 10 June 2026 names Cloudflare for CDN services and Wasabi for Cold Storage, each with a location (https://www.digitalocean.com/trust/subprocessors)" ], "area": "everyday", "details": [ { "label": "APIs", "value": "S3-compatible XML API on `\u003cregion\u003e.digitaloceanspaces.com` (a subset of AWS S3, SigV4 recommended, SigV2 accepted). The DigitalOcean API v2 at `api.digitalocean.com` for access keys and CDN endpoints" }, { "label": "Endpoints", "value": "`https://\u003cregion\u003e.digitaloceanspaces.com` path-style or `https://\u003cbucket\u003e.\u003cregion\u003e.digitaloceanspaces.com`. CDN at `\u003cbucket\u003e.\u003cregion\u003e.cdn.digitaloceanspaces.com`. Static sites at `\u003cbucket\u003e.\u003cregion\u003e-static.digitaloceanspaces.com`" }, { "label": "Regions", "value": "13 for Standard Storage (NYC3, AMS3, SFO2, SFO3, SGP1, LON1, FRA1, TOR1, BLR1, SYD1, ATL1, RIC1, MKC1). Cold Storage in all of them except BLR1" }, { "label": "Credentials", "value": "Access key and secret, up to 200 an account. Full access, or limited to named buckets with Read or Read/Write/Delete. The secret is shown once and can be regenerated. Limited keys cannot be combined with bucket policies" }, { "label": "MCP server", "value": "Remote at `https://spaces.mcp.digitalocean.com/mcp`, OAuth or `Authorization: Bearer` with an API token. Ten tools at v1.2.0, `spaces-key-*` and `spaces-cdn-*`, none for objects. Also runs locally as `npx @digitalocean/mcp --services spaces`. MIT licence" }, { "label": "Rate limits", "value": "800 operations a second per new bucket, with `LIST` limited further under load. Cold Storage 450 write, 250 read and 25 list requests a second per bucket. The DigitalOcean API allows 5,000 requests an hour and 250 a minute per token, with `retry-after` on 429" }, { "label": "Object limits", "value": "`PUT` up to 5 GB, multipart to 5 TB in 10,000 parts of at least 5 MiB. 100 buckets an account. 100 million unversioned or 50 million versioned objects a bucket. Incomplete multipart uploads are deleted after 30 days" }, { "label": "Presigned URLs", "value": "SigV2 and SigV4. The control panel makes links valid for 1 hour, 6 hours, 1 day, 3 days or 7 days. Uploads through the CDN with a presigned URL are capped at 8,100 KiB" }, { "label": "Minimums", "value": "$5 a month while any bucket exists, prorated hourly. 4 KiB per object on Standard. On Cold Storage 128 KiB per object and per read, and 30 days of storage" }, { "label": "Sign-up credit", "value": "$5, expiring 90 days after sign-up. A valid payment method must be added before any resource is created" }, { "label": "Deletion controls", "value": "Bucket versioning (API only), lifecycle expiry by time, and a one-week pending period in which a destroyed bucket can be recovered. No Object Lock found in the reviewed documentation" }, { "label": "Logging", "value": "Bucket access logs in Amazon S3 server access log format and CDN logs in CloudFront format, off by default, set through `PutBucketLogging` or Terraform, usually written within one hour" }, { "label": "SLA", "value": "99.9 per cent monthly uptime per bucket. Credit of 10 per cent from 99.0 to 99.9, 25 per cent from 95.0 to 99.0 and 100 per cent below 95.0. Claims need written notice within 24 hours of the start of downtime" }, { "label": "Certifications", "value": "SOC 2 and SOC 3 reports and Global PRP named on the trust page. DigitalOcean states eligibility for HIPAA and DORA workloads. ISO 27001 was not named on the page read" }, { "label": "Sub-processors", "value": "More than 30 with activity and location in the list of 10 June 2026, Cloudflare (CDN), Wasabi (Cold Storage), Amazon Web Services and Stripe among them. The DPA of 6 February 2026 allows 30 days to object to a new one" } ], "unitPrices": [ { "item": "Spaces subscription", "unit": "month", "usd": 5, "note": "Includes 250 GiB of storage and 1,024 GiB of outbound transfer across all buckets" }, { "item": "Standard storage beyond 250 GiB", "unit": "gb-month", "usd": 0.02, "note": "Per GiB" }, { "item": "Cold Storage", "unit": "gb-month", "usd": 0.007, "note": "Per GiB, 30-day minimum, plus $0.01 a GiB retrieved" }, { "item": "Outbound transfer beyond 1,024 GiB", "unit": "gb", "usd": 0.01, "note": "Per GiB. Inbound transfer is free" } ], "provenance": { "legalEntity": "DigitalOcean, LLC", "domain": "digitalocean.com", "domainRegistered": "2000-04-12", "endpointOnVendorDomain": false, "terms": "https://www.digitalocean.com/legal/terms-of-service-agreement", "privacy": "https://www.digitalocean.com/legal/privacy-policy", "statusPage": "https://status.digitalocean.com", "changelog": "https://docs.digitalocean.com/release-notes/spaces/", "securityTxt": "valid", "checked": "2026-10-09", "notes": [ "The Terms of Service Agreement, last updated 22 August 2026, names DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021.", "The privacy policy, last updated 1 January 2025, says it does not apply to content customers process in the services. The Data Processing Agreement of 6 February 2026 at https://www.digitalocean.com/legal/data-processing-agreement covers that content.", "Storage endpoints are on digitaloceanspaces.com. The DigitalOcean API and the MCP server are on digitalocean.com.", "security.txt at https://www.digitalocean.com/.well-known/security.txt gives an Intigriti programme and security@digitalocean.com as contacts and Expires 2028-04-05.", "RDAP for digitalocean.com gives a registration date of 2000-04-12.", "status.digitalocean.com disallows /api/ and /embed/ in robots.txt. We read /history.rss, which holds 25 entries from 24 July to 5 October 2026.", "The Acceptable Use Policy of 20 March 2026 forbids harvesting or scraping content of the services and probing or testing DigitalOcean systems without written consent." ], "score": 85, "checks": [ { "check": "Legal entity named", "value": "DigitalOcean, LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "digitalocean.com, registered 2000-04-12 (26 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "nyc3.digitaloceanspaces.com is not on digitalocean.com", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.digitalocean.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.digitalocean.com/legal/terms-of-service-agreement", "state": "read", "readAt": "2026-10-09", "statedDate": "2026-08-22", "words": 9662, "points": 10, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated on August 22, 2026", "says": "Last updated 2026-08-22" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This TOS and any dispute related thereto (including under Section 13) is governed by the laws of the State of Delaware without regard to conflict of law principles.", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT WILL WE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUES, BUSINESS, DATA OR GOODWILL, ARISING OR RELATING TO THE BETA SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "DigitalOcean may suspend or terminate access to the Services if your use poses a security risk, threatens the integrity or availability of the Services, or may harm DigitalOcean systems or infrastructure." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "By continuing to access or use the Websites or Services after the date specified in the notice or updated TOS, you are agreeing to accept and be bound by the updated TOS and all of the terms incorporated therein.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not use, and will not permit Authorized Users or End Users to use, AI Features in any circumstance where failure or inaccuracy of an AI Feature could reasonably be expected to result in death, personal injury, or severe physical, property, or environmental damage, or to produce legal or similarly significant…" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "The Service Level Agreements do not apply to Beta Services." } ], "toKnow": [ { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "While we prefer to give advance notice of termination, we reserve the right, in our sole discretion, to terminate your access to all or any part of the Websites and/or Services at any time, with or without notice, effective immediately." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "One requirement of our TOS is that you must agree to resolve disputes arising under this TOS through binding arbitration directly between you and DigitalOcean." } ], "notes": [ { "date": "2026-10-08", "text": "Liability is capped at the amount paid for the services at issue in the month before the event behind the claim.", "quote": "our aggregate liability to you for all claims arising out of or relating to this TOS or the Websites and Services, whether in contract, tort, or otherwise, is limited to the amount you have paid to us for the Services at issue in the month prior to the event or circumstance giving rise to the claim." }, { "date": "2026-10-08", "text": "The customer grants DigitalOcean permission to use its name, logos and trademarks in promotional and marketing materials.", "quote": "2.3 You grant us permission to include your name, logos, and trademarks in our promotional and marketing materials and communications." }, { "date": "2026-10-08", "text": "Termination may lead to the immediate forfeiture and destruction of the data associated with the account.", "quote": "Any such termination may result in the immediate forfeiture and destruction of data associated with your Account." } ] }, { "kind": "privacy", "url": "https://www.digitalocean.com/legal/privacy-policy", "state": "read", "readAt": "2026-10-09", "statedDate": "2025-01-01", "words": 3606, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated on January 1, 2025", "says": "Last updated 2025-01-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We may collect and receive information about users of our Services (“users,” “you,” or “your”) from various sources, including: (i) information you provide through your user account on the Services (your “Account”) if you register for the Services;" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "All Account data will be deleted within 90 days of purging.", "says": "Names a period of 90 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share information with third-party vendors and service providers that provide services on our behalf, such as helping to provide our Services, for promotional and/or marketing purposes, and to provide you with information relevant to you such as product announcements, software updates, special offers, or other…" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "To learn more about these programs, or opt-out of personalized ads, visit the Digital Advertising Alliance’s Self-Regulatory program for Online Behavioral Advertising at www.aboutads.info, or the Network Advertising Initiative at www.networkadvertising.org." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Right to access, correct, update, or request deletion of your Personal Information, which you can do at any time by emailing privacy@digitalocean.com." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about this Privacy Policy or DigitalOcean’s data collection, use, and disclosure practices, please contact us at privacy@digitalocean.com.", "says": "privacy@digitalocean.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…or permits DigitalOcean to access, the parties agree that by executing the DPA they also execute the Standard Contractual Clauses, which will be incorporated by reference and form an integral part of the DPA.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "These advertising partners may set and access their own cookies, pixel tags, and similar technologies on our Services, and they may otherwise collect or have access to information about you which they may collect over time and across different online services." } ], "notes": [ { "date": "2026-10-08", "text": "The policy does not cover information or content that customers process when using the services.", "quote": "This Privacy Policy (the “Privacy Policy”) does not apply to information or content our customers may process when using our Services." }, { "date": "2026-10-08", "text": "Public activity on an account may stay stored and publicly accessible after the account is terminated.", "quote": "If you terminate your Account, any public activity on your Account prior to deletion may remain stored on our servers and may remain accessible to the public." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/digitalocean-spaces.json", "live": { "slug": "digitalocean-spaces", "probe": { "target": "https://nyc3.digitaloceanspaces.com", "method": "get", "lastAt": "2026-10-10T01:37:49.97232435Z", "lastOk": true, "lastStatus": 200, "lastMs": 257, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 252, "p95ms24h": 318, "samples24h": 102, "samples30d": 102, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.digitalocean.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-10T01:33:36.330044838Z" }, "versions": [ { "registry": "npm", "name": "@digitalocean/mcp", "version": "1.3.0", "seenAt": "2026-10-09T16:49:55.367691357Z" } ], "npmWeekly": 6361, "pages": [ { "url": "https://docs.digitalocean.com/release-notes/spaces/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:37:15.694494826Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f985fd3f520e" }, { "url": "https://docs.digitalocean.com/products/spaces/details/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-09T18:37:13.39335158Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4009725f24fb" } ], "updatedAt": "2026-10-10T01:37:49.97232435Z" } }, "verify": { "accepts": "a page on digitalocean.com or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/digitalocean-spaces.svg", "body": { "slug": "digitalocean-spaces", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/digitalocean-spaces", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/digitalocean-spaces\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/digitalocean-spaces.svg\" alt=\"DigitalOcean Spaces on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![DigitalOcean Spaces on Anchor Terminal](https://www.anchorterminal.com/badges/digitalocean-spaces.svg)](https://www.anchorterminal.com/tools/digitalocean-spaces)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/digitalocean-spaces\"\u003eDigitalOcean Spaces on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/digitalocean-spaces", "json": "https://www.anchorterminal.com/tools/digitalocean-spaces.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/digitalocean-spaces.md", "slim": "https://www.anchorterminal.com/tools/digitalocean-spaces.min.md" }, "markdown": "## Overview\n\n**Grade B · 63.2/100 · rank #402 of 950 · #9 in File storage \u0026 sharing · not agent-ready · confidence medium**\n\n\nMore from DigitalOcean, LLC, listed separately because each is its own product: [DigitalOcean MCP Server](https://www.anchorterminal.com/tools/digitalocean-mcp.md) (Cloud \u0026 infrastructure).\n\n## Assessment\n\nPer-bucket access keys with read or read-write-delete grants, an 800 operations a second limit per bucket and a 99.9 per cent SLA are all published. The MCP server manages keys and CDN endpoints only, not objects, and the S3 reference documents no error codes. A payment method is required before any bucket is created.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | DigitalOcean, LLC (https://www.digitalocean.com) |\n| Kind | HTTP API |\n| Category | File storage \u0026 sharing (https://www.anchorterminal.com/categories/file-storage) |\n| Transport | HTTP, Streamable HTTP |\n| Endpoint | `https://nyc3.digitaloceanspaces.com` |\n| Auth | API key · Self-serve Spaces access key and secret, signed as for AWS S3 (SigV4, or SigV2 for older clients). A person signs up in a browser and adds a payment method first. Keys are full access or limited to named buckets with Read or Read/Write/Delete, and are made in the control panel or through `/v2/spaces/keys` with a scoped DigitalOcean API token. The remote MCP server takes OAuth with a browser sign-in, or a bearer API token. |\n| Pricing | Pay per use ($5 / mo) · $5 a month for 250 GiB of storage and 1,024 GiB of outbound transfer across all buckets, then $0.02 a GiB-month and $0.01 a GiB. No request charges are listed. The CDN is included. Cold Storage is $0.007 a GiB-month plus $0.01 a GiB retrieved. A $5 sign-up credit lasts 90 days and needs a payment method, so there is no start without a card (https://docs.digitalocean.com/products/spaces/details/pricing/; https://docs.digitalocean.com/platform/billing/signup-credit/). |\n| x402 | No · No x402, MPP or L402 in the Spaces docs, the API reference index or the pricing pages. A Stablecoin Payment Addendum of 25 November 2025 covers account payments through Stripe, not per-request payment (checked 2026-10-09). |\n| Licence | Proprietary service under the DigitalOcean Terms of Service Agreement. The MCP server is MIT |\n| Packages | npm: `@digitalocean/mcp` |\n| Docs | https://docs.digitalocean.com/products/spaces/ |\n| llms.txt | https://docs.digitalocean.com/llms.txt |\n| Last release | 2026-04-08 |\n| APIs | S3-compatible XML API on `\u003cregion\u003e.digitaloceanspaces.com` (a subset of AWS S3, SigV4 recommended, SigV2 accepted). The DigitalOcean API v2 at `api.digitalocean.com` for access keys and CDN endpoints |\n| Endpoints | `https://\u003cregion\u003e.digitaloceanspaces.com` path-style or `https://\u003cbucket\u003e.\u003cregion\u003e.digitaloceanspaces.com`. CDN at `\u003cbucket\u003e.\u003cregion\u003e.cdn.digitaloceanspaces.com`. Static sites at `\u003cbucket\u003e.\u003cregion\u003e-static.digitaloceanspaces.com` |\n| Regions | 13 for Standard Storage (NYC3, AMS3, SFO2, SFO3, SGP1, LON1, FRA1, TOR1, BLR1, SYD1, ATL1, RIC1, MKC1). Cold Storage in all of them except BLR1 |\n| Credentials | Access key and secret, up to 200 an account. Full access, or limited to named buckets with Read or Read/Write/Delete. The secret is shown once and can be regenerated. Limited keys cannot be combined with bucket policies |\n| MCP server | Remote at `https://spaces.mcp.digitalocean.com/mcp`, OAuth or `Authorization: Bearer` with an API token. Ten tools at v1.2.0, `spaces-key-*` and `spaces-cdn-*`, none for objects. Also runs locally as `npx @digitalocean/mcp --services spaces`. MIT licence |\n| Rate limits | 800 operations a second per new bucket, with `LIST` limited further under load. Cold Storage 450 write, 250 read and 25 list requests a second per bucket. The DigitalOcean API allows 5,000 requests an hour and 250 a minute per token, with `retry-after` on 429 |\n| Object limits | `PUT` up to 5 GB, multipart to 5 TB in 10,000 parts of at least 5 MiB. 100 buckets an account. 100 million unversioned or 50 million versioned objects a bucket. Incomplete multipart uploads are deleted after 30 days |\n| Presigned URLs | SigV2 and SigV4. The control panel makes links valid for 1 hour, 6 hours, 1 day, 3 days or 7 days. Uploads through the CDN with a presigned URL are capped at 8,100 KiB |\n| Minimums | $5 a month while any bucket exists, prorated hourly. 4 KiB per object on Standard. On Cold Storage 128 KiB per object and per read, and 30 days of storage |\n| Sign-up credit | $5, expiring 90 days after sign-up. A valid payment method must be added before any resource is created |\n| Deletion controls | Bucket versioning (API only), lifecycle expiry by time, and a one-week pending period in which a destroyed bucket can be recovered. No Object Lock found in the reviewed documentation |\n| Logging | Bucket access logs in Amazon S3 server access log format and CDN logs in CloudFront format, off by default, set through `PutBucketLogging` or Terraform, usually written within one hour |\n| SLA | 99.9 per cent monthly uptime per bucket. Credit of 10 per cent from 99.0 to 99.9, 25 per cent from 95.0 to 99.0 and 100 per cent below 95.0. Claims need written notice within 24 hours of the start of downtime |\n| Certifications | SOC 2 and SOC 3 reports and Global PRP named on the trust page. DigitalOcean states eligibility for HIPAA and DORA workloads. ISO 27001 was not named on the page read |\n| Sub-processors | More than 30 with activity and location in the list of 10 June 2026, Cloudflare (CDN), Wasabi (Cold Storage), Amazon Web Services and Stripe among them. The DPA of 6 February 2026 allows 30 days to object to a new one |\n| Capabilities | storage.object, storage.s3, storage.presigned, storage.share |\n| Tags | hosted, closed-source, s3-compatible, cdn, mcp, oauth, llms-txt, openapi, usage-priced, status-page, sla, soc-2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/digitalocean-spaces.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-09 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 77 | 15.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 63 | 10.2 |\n| Agent ergonomics | 13% | 16.2 | 73 | 11.9 |\n| Security \u0026 auth | 14% | 17.5 | 77 | 13.5 |\n| Payments \u0026 pricing | 10% | 12.5 | 20 | 2.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 37 | 3.2 |\n| Transparency \u0026 trust (editorial 63, provenance 85) | 7% | 8.8 | 74 | 6.5 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **63.2 → B** |\n\n### Why each score\n\n- Reliability 77: Graded as a hosted API on the S3 surface. Status page at status.digitalocean.com with a readable history feed (20). The feed reaches back to 24 July 2026, 77 days. It shows failed write operations across services, Spaces among them, for 2 hours 26 minutes on 6 August, a 63-minute network disruption in BLR1 on 3 October that included Spaces, control panel access to Spaces failing for about two hours on 21 August and a Cold Storage billing display fault on 4 August. We read the 6 August event as one major incident (10). Limits published with numbers, 800 operations a second per new bucket and 5,000 requests an hour on the DigitalOcean API (15). Exponential backoff advised on `503 Slow Down`, and `retry-after` on the DigitalOcean API's 429. No retry or idempotency guidance for S3 writes (12). The Spaces SLA commits to 99.9 per cent monthly uptime per bucket (10). The S3 API and remote MCP servers are generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 63: The DigitalOcean API has a public OpenAPI file, which covers access keys and CDN endpoints. The S3 surface has no description file. Its reference lists each supported operation with headers and the minimum permission level, and defers to AWS for the rest (15). `llms.txt` and a Markdown twin of every page (10). The S3 reference gives one line per operation with a link to AWS, and the MCP tool descriptions are a few words each, such as 'Delete a CDN' (10). Header tables per operation, enumerated grants on the keys API, and MCP tools with required fields, a maximum and output schemas (10). A request and response example for most operations, but no error codes in the S3 reference beyond `NotImplemented` for unsupported calls (8). Dated Spaces release notes and a versioned DigitalOcean API. The limits page and the compatibility page disagree on `ListObjectsV2` (10).\n- Agent ergonomics 73: Graded as an API, with the MCP server noted. Responses are sized by S3's own controls, `Range` and `HEAD` among the listed headers, and the Spaces MCP endpoint carries only ten compact tools (20). S3 listing with prefix and marker, and `per_page` up to 200 on the DigitalOcean API. The limits page lists `list-objects-v2` pagination as a known issue (14). `503 Slow Down` and `NotImplemented` are the only S3 errors described. The DigitalOcean API documents its error bodies (10). A `PUT` by key can be repeated, conditional copy headers are listed, and all ten MCP tools set read-only, idempotent or destructive hints with a risk class (16). AWS SDK examples in several languages and official DigitalOcean SDKs for TypeScript, Go and Python. Most AWS SDKs need `us-east-1` as a placeholder region to create a bucket (13).\n- Security \u0026 auth 77: Access keys are revocable, can be regenerated and can be limited to named buckets with Read or Read/Write/Delete. DigitalOcean API tokens take custom scopes, and the MCP server issues short-lived OAuth tokens. Three off because SigV2 is still accepted and a limited key cannot coexist with a bucket policy (27). Read-only keys, versioning and a one-week recovery period for destroyed buckets. No Object Lock or confirmation step in the API was found (14). Returns stored bytes, with no guidance on treating them as untrusted. The key creation tool's description warns about handling the secret (8). Bucket and CDN access logs in S3 format, off by default, and an account security history that the docs say can show the wrong IP address for deletes (11). security.txt valid to 2028 with an Intigriti programme as contact, and SOC 2 and SOC 3 reports named on the trust page. ISO 27001 was not named on the page read (17).\n- Payments \u0026 pricing 20: No x402, MPP or L402. Stablecoin payment through Stripe is an account payment method (0). Prices per GiB are public without a login (20). The $5 sign-up credit needs a valid payment method before any resource is created (0). A person signs up in a browser. The keys API needs a token from that account (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 37: Closed service. Its own release notes stop at 8 April 2026, 184 days before the check, which scores 0. The MCP server that carries the Spaces tools was tagged v1.2.0 on 7 October 2026 and its Spaces tools changed on 22 September, but that server cannot read or write objects, so it does not count as a release of the service graded here. No Spaces release notes in the last 90 days. The MCP server had seven tags in that time (10). Public release notes with an RSS feed, support tickets and a public repository with 193 commits in 90 days. Issue response times were not checked (10). Current official SDKs in three languages. The only MCP registry entry found for DigitalOcean is a third party's (10). The MCP repository has CI and release workflows and tests that guard tool annotations (7).\n- Transparency \u0026 trust 74: Closed service under a Terms of Service Agreement updated on 22 August 2026 that leaves ownership of content with the customer. The MCP server is MIT (15). The DPA of 6 February 2026 gives deletion within 30 days of account deactivation and breach notice without undue delay. The privacy policy excludes customer content, and the terms give no retention period in days (22). No general deprecation policy. The terms promise notice of changes as far as reasonably practicable, and old rate limits are dated per data centre (8). A sub-processor list of 10 June 2026 with activity and location, Cloudflare for the CDN and Wasabi for Cold Storage among them, and 13 named storage regions (18).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/digitalocean-spaces.md (JSON https://www.anchorterminal.com/fixes/digitalocean-spaces.json)\n\n### What we couldn't check\n\n- unchecked: the DigitalOcean OpenAPI file itself. Its address is listed in `llms.txt`, and we read the rendered Spaces Keys reference instead\n- unchecked: the certification reports page and the Intigriti programme page, so whether a paid bounty exists and which SOC 2 type applies were not confirmed\n- unchecked: status history before 24 July 2026. The feed holds 25 entries, which covers 77 of the 90 days\n- unchecked: issue response times on the MCP repository, which a clone does not show, and npm download figures\n- Legal, trust and SLA pages on www.digitalocean.com were read through a summarising reader, so clause wording should be confirmed before quoting\n- Whether Cold Storage has a separate 99.5 per cent SLA, as the product details page says. The Spaces SLA page gives 99.9 per cent without naming tiers\n- Whether `ListObjectsV2` pagination works. The limits page and the compatibility page disagree\n- `lastRelease` is the MCP server tag of 7 October 2026. The Spaces release notes last changed on 8 April 2026\n- The lead said Spaces is usable through remote MCP servers and the CLI. The MCP tools cover keys and CDN endpoints only, and the docs say `doctl` cannot manage files\n- The Acceptable Use Policy bars scraping of service content and testing without written consent. Read as a fact with no deduction. It matters before any probe is run\n- One typed address, https://www.digitalocean.com/legal/service-level-agreement, returned 404. The SLA was then found through the Service Terms\n\n### Sources\n\n- docs index (llms.txt): \u003chttps://docs.digitalocean.com/llms.txt\u003e (seen 2026-10-09)\n- Spaces overview and latest updates: \u003chttps://docs.digitalocean.com/products/spaces/\u003e (seen 2026-10-09)\n- Spaces pricing: \u003chttps://docs.digitalocean.com/products/spaces/details/pricing/\u003e (seen 2026-10-09)\n- Spaces limits and known issues: \u003chttps://docs.digitalocean.com/products/spaces/details/limits/\u003e (seen 2026-10-09)\n- Spaces feature list: \u003chttps://docs.digitalocean.com/products/spaces/details/features/\u003e (seen 2026-10-09)\n- Spaces availability: \u003chttps://docs.digitalocean.com/products/spaces/details/availability/\u003e (seen 2026-10-09)\n- Spaces S3 API reference: \u003chttps://docs.digitalocean.com/reference/api/spaces/\u003e (seen 2026-10-09)\n- S3 compatibility: \u003chttps://docs.digitalocean.com/products/spaces/reference/s3-compatibility/\u003e (seen 2026-10-09)\n- AWS SDK guide: \u003chttps://docs.digitalocean.com/products/spaces/reference/aws-sdks/\u003e (seen 2026-10-09)\n- access keys guide: \u003chttps://docs.digitalocean.com/products/spaces/how-to/manage-access/\u003e (seen 2026-10-09)\n- file permissions and presigned URLs: \u003chttps://docs.digitalocean.com/products/spaces/how-to/set-file-permissions/\u003e (seen 2026-10-09)\n- access logs: \u003chttps://docs.digitalocean.com/products/spaces/how-to/access-logs/\u003e (seen 2026-10-09)\n- Spaces release notes: \u003chttps://docs.digitalocean.com/release-notes/spaces/\u003e (seen 2026-10-09)\n- Spaces Keys API reference: \u003chttps://docs.digitalocean.com/reference/api/reference/spaces-keys/\u003e (seen 2026-10-09)\n- DigitalOcean API introduction (rate limits, pagination): \u003chttps://docs.digitalocean.com/reference/api/reference/public-apis/\u003e (seen 2026-10-09)\n- remote MCP configuration: \u003chttps://docs.digitalocean.com/reference/mcp/configure-mcp/\u003e (seen 2026-10-09)\n- Spaces MCP tools: \u003chttps://docs.digitalocean.com/reference/mcp/spaces-mcp-tools/\u003e (seen 2026-10-09)\n- SDK and client libraries: \u003chttps://docs.digitalocean.com/reference/libraries/\u003e (seen 2026-10-09)\n- sign-up credit: \u003chttps://docs.digitalocean.com/platform/billing/signup-credit/\u003e (seen 2026-10-09)\n- MCP server source at v1.2.0 (shallow clone, read not run): \u003chttps://github.com/digitalocean-labs/mcp-digitalocean\u003e (seen 2026-10-09)\n- pricing page: \u003chttps://www.digitalocean.com/pricing/spaces-object-storage\u003e (seen 2026-10-09)\n- Spaces SLA: \u003chttps://www.digitalocean.com/sla/spaces\u003e (seen 2026-10-09)\n- Terms of Service Agreement: \u003chttps://www.digitalocean.com/legal/terms-of-service-agreement\u003e (seen 2026-10-09)\n- Service Terms: \u003chttps://www.digitalocean.com/legal/tos-service-specific-terms\u003e (seen 2026-10-09)\n- Acceptable Use Policy: \u003chttps://www.digitalocean.com/legal/acceptable-use-policy\u003e (seen 2026-10-09)\n- privacy policy: \u003chttps://www.digitalocean.com/legal/privacy-policy\u003e (seen 2026-10-09)\n- Data Processing Agreement: \u003chttps://www.digitalocean.com/legal/data-processing-agreement\u003e (seen 2026-10-09)\n- Stablecoin Payment Addendum: \u003chttps://www.digitalocean.com/legal/stablecoin-payment-addendum\u003e (seen 2026-10-09)\n- sub-processor list: \u003chttps://www.digitalocean.com/trust/subprocessors\u003e (seen 2026-10-09)\n- trust page: \u003chttps://www.digitalocean.com/trust\u003e (seen 2026-10-09)\n- security.txt: \u003chttps://www.digitalocean.com/.well-known/security.txt\u003e (seen 2026-10-09)\n- status history feed: \u003chttps://status.digitalocean.com/history.rss\u003e (seen 2026-10-09)\n- MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=digitalocean\u003e (seen 2026-10-09)\n- RDAP for digitalocean.com: \u003chttps://rdap.verisign.com/com/v1/domain/digitalocean.com\u003e (seen 2026-10-09)\n\n## Who's behind it (provenance 85/100, checked 2026-10-09)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | DigitalOcean, LLC | 20/20 |\n| Domain age | digitalocean.com, registered 2000-04-12 (26 years) | 15/15 |\n| Endpoint on the vendor's domain | nyc3.digitaloceanspaces.com is not on digitalocean.com | 0/15 |\n| Terms of service | read, states 7 of the 7 things a reader expects | 10/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.digitalocean.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe Terms of Service Agreement, last updated 22 August 2026, names DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021.\n\nThe privacy policy, last updated 1 January 2025, says it does not apply to content customers process in the services. The Data Processing Agreement of 6 February 2026 at https://www.digitalocean.com/legal/data-processing-agreement covers that content.\n\nStorage endpoints are on digitaloceanspaces.com. The DigitalOcean API and the MCP server are on digitalocean.com.\n\nsecurity.txt at https://www.digitalocean.com/.well-known/security.txt gives an Intigriti programme and security@digitalocean.com as contacts and Expires 2028-04-05.\n\nRDAP for digitalocean.com gives a registration date of 2000-04-12.\n\nstatus.digitalocean.com disallows /api/ and /embed/ in robots.txt. We read /history.rss, which holds 25 entries from 24 July to 5 October 2026.\n\nThe Acceptable Use Policy of 20 March 2026 forbids harvesting or scraping content of the services and probing or testing DigitalOcean systems without written consent.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.digitalocean.com/legal/terms-of-service-agreement), read 2026-10-09, dated 2026-08-22, states 7 of the 7 things a reader expects.\n\n- To know. Says access can be ended without notice or for any reason. \"While we prefer to give advance notice of termination, we reserve the right, in our sole discretion, to terminate your access to all or any part of the Websites and/or Services at any time, with or without notice, effective immediately.\"\n- To know. Requires arbitration or waives class actions. \"One requirement of our TOS is that you must agree to resolve disputes arising under this TOS through binding arbitration directly between you and DigitalOcean.\"\n- Gives the date it was last updated. Last updated 2026-08-22.\n- Names the governing law or courts. The law of the State of Delaware.\n- States a limit on its liability. Rules out indirect and consequential losses, with no cap named in this sentence.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Also in the text (2026-10-08). Liability is capped at the amount paid for the services at issue in the month before the event behind the claim. \"our aggregate liability to you for all claims arising out of or relating to this TOS or the Websites and Services, whether in contract, tort, or otherwise, is limited to the amount you have paid to us for the Services at issue in the month prior to the event or circumstance giving rise to the claim.\"\n- Also in the text (2026-10-08). The customer grants DigitalOcean permission to use its name, logos and trademarks in promotional and marketing materials. \"2.3 You grant us permission to include your name, logos, and trademarks in our promotional and marketing materials and communications.\"\n- Also in the text (2026-10-08). Termination may lead to the immediate forfeiture and destruction of the data associated with the account. \"Any such termination may result in the immediate forfeiture and destruction of data associated with your Account.\"\n\n**Privacy policy** (https://www.digitalocean.com/legal/privacy-policy), read 2026-10-09, dated 2025-01-01, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"These advertising partners may set and access their own cookies, pixel tags, and similar technologies on our Services, and they may otherwise collect or have access to information about you which they may collect over time and across different online services.\"\n- Gives the date it was last updated. Last updated 2025-01-01.\n- Says how long data is kept. Names a period of 90 days.\n- Gives a privacy contact. privacy@digitalocean.com.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). The policy does not cover information or content that customers process when using the services. \"This Privacy Policy (the “Privacy Policy”) does not apply to information or content our customers may process when using our Services.\"\n- Also in the text (2026-10-08). Public activity on an account may stay stored and publicly accessible after the account is terminated. \"If you terminate your Account, any public activity on your Account prior to deletion may remain stored on our servers and may remain accessible to the public.\"\n\n## Live (updated 2026-10-10 01:37 UTC)\n\n- Right now: up, HTTP 200, 257 ms, checked 2026-10-10 01:37 UTC (get on `https://nyc3.digitaloceanspaces.com`)\n- Uptime 24h 100.0% (102 probes) · 30 days 100.0% (102 probes) · p50 252 ms · p95 318 ms\n- Vendor status page: none, All Systems Operational\n- npm `@digitalocean/mcp` 1.3.0\n- Watching changelog \u003chttps://docs.digitalocean.com/release-notes/spaces/\u003e\n- Watching pricing \u003chttps://docs.digitalocean.com/products/spaces/details/pricing/\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/digitalocean-spaces.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Spaces subscription | $5 | per month (plan) | Includes 250 GiB of storage and 1,024 GiB of outbound transfer across all buckets |\n| Standard storage beyond 250 GiB | $0.02 | per GB per month | Per GiB |\n| Cold Storage | $0.007 | per GB per month | Per GiB, 30-day minimum, plus $0.01 a GiB retrieved |\n| Outbound transfer beyond 1,024 GiB | $0.01 | per GB of traffic | Per GiB. Inbound transfer is free |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Spaces access keys can be limited to named buckets with read or read-write-delete grants, and are created through `/v2/spaces/keys` or the control panel\n- Limits are published with numbers, 800 operations a second per new bucket, with exponential backoff advised on `503 Slow Down`\n- The Spaces SLA of 2 December 2025 gives 99.9 per cent monthly uptime per bucket, with credits of 10, 25 and 100 per cent\n- Every docs page has a Markdown twin, indexed in `llms.txt`, and the S3 reference lists each supported operation with its minimum permission level\n- All ten Spaces tools in the MCP server (MIT licence) carry read-only, idempotent or destructive hints and a risk class, checked by tests\n\n## Weaknesses\n\n- The Spaces MCP server has ten tools for access keys and CDN endpoints. None reads, writes, lists or shares an object\n- The access guide and the limits page say keys cannot be created through the API, while the API reference documents `POST /v2/spaces/keys`\n- The limits page lists `list-objects-v2` pagination as unsupported, and the compatibility page says to use `ListObjectsV2` for new applications\n- No error codes are documented in the S3 reference. Unsupported calls return `NotImplemented`, and no Object Lock was found\n- The $5 sign-up credit needs a payment method first, and a subscription costs $5 a month once the first bucket exists\n- The Acceptable Use Policy of 20 March 2026 bars scraping of service content and any probing or testing without written consent, which matters before any probe is run\n\n## Before you call it (notes for agents)\n\n1. Set the endpoint to `https://\u003cregion\u003e.digitaloceanspaces.com` and, in AWS SDKs other than Python's, set `region` to `us-east-1` when creating a bucket\n2. Ask for a limited access key with a Read or Read/Write/Delete grant on one bucket. A full access key can create, configure and delete every bucket\n3. Do the object work through the S3 API. The MCP server and `doctl` cannot upload, list, move or delete files\n4. Retry with exponential backoff on `503 Slow Down`, and keep below 800 operations a second per bucket\n5. Fetch presigned links from the origin host, not the CDN. The docs say presigned requests through the CDN are not cached and can double the bandwidth charge\n6. Avoid many tiny objects. Each bills as at least 4 KiB on Standard and 128 KiB on Cold Storage, which also has a 30-day minimum\n\n## Connect\n\nFirst request:\n\n```bash\nimport boto3\nsession = boto3.session.Session()\nclient = session.client('s3',\n region_name='nyc3',\n endpoint_url='https://nyc3.digitaloceanspaces.com',\n aws_access_key_id='YOUR_SPACES_KEY',\n aws_secret_access_key='YOUR_SPACES_SECRET')\nclient.upload_file('localfile.txt', 'my-bucket', 'uploaded.txt')\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"spaces\": {\n \"url\": \"https://spaces.mcp.digitalocean.com/mcp\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/digitalocean-spaces. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Amazon S3 | BB | 77.9 | 16 | storage.object, storage.s3, storage.presigned, storage.share | no | https://www.anchorterminal.com/tools/amazon-s3.md |\n| Cloudflare R2 | BB | 77.1 | 23 | storage.object, storage.s3, storage.presigned, storage.share | no | https://www.anchorterminal.com/tools/cloudflare-r2.md |\n| Backblaze B2 | BB | 75.3 | 49 | storage.object, storage.s3, storage.presigned, storage.share | no | https://www.anchorterminal.com/tools/backblaze-b2.md |\n| Tigris | E | 44.4 | 876 | storage.object, storage.s3, storage.presigned, storage.share | no | https://www.anchorterminal.com/tools/tigris.md |\n| Azure Blob Storage | BB | 75.7 | 41 | storage.object, storage.presigned, storage.share | no | https://www.anchorterminal.com/tools/azure-blob-storage.md |\n| Wasabi Hot Cloud Storage | C | 61.2 | 478 | storage.object, storage.s3, storage.presigned | no | https://www.anchorterminal.com/tools/wasabi-hot-cloud-storage.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- A Spaces subscription is $5.00 a month with 250 GiB of storage and 1,024 GiB of outbound transfer across all buckets, then $0.02 a GiB-month and $0.01 a GiB (source: \u003chttps://docs.digitalocean.com/products/spaces/details/pricing/\u003e)\n- Cold Storage is $0.007 a GiB-month and $0.01 a GiB retrieved, with a 30-day minimum and objects under 128 KiB billed as 128 KiB. It has been generally available since 2 December 2025 (source: \u003chttps://docs.digitalocean.com/products/spaces/details/pricing/\u003e, \u003chttps://docs.digitalocean.com/release-notes/spaces/\u003e)\n- New buckets allow 800 operations a second in total. Buckets made before regional upgrades of 2020 to 2022 keep lower limits. Cold Storage buckets allow 450 write, 250 read and 25 list requests a second (source: \u003chttps://docs.digitalocean.com/products/spaces/details/limits/\u003e)\n- Spaces runs on Ceph and implements a subset of the S3 API, with SigV4 and SigV2 signing, multipart uploads to 5 TB, versioning, lifecycle expiry, bucket policies, SSE-C and presigned URLs (source: \u003chttps://docs.digitalocean.com/products/spaces/reference/s3-compatibility/\u003e)\n- Only the `private` and `public-read` canned ACLs exist, bucket and object tags used for lifecycle are not supported, and cross-region `CopyObject` fails (source: \u003chttps://docs.digitalocean.com/products/spaces/reference/s3-compatibility/\u003e, \u003chttps://docs.digitalocean.com/products/spaces/details/limits/\u003e)\n- The DigitalOcean API manages access keys at `/v2/spaces/keys` with the token scope `spaces_key:read` and its siblings, and grants of `read`, `readwrite` or `fullaccess` per bucket (source: \u003chttps://docs.digitalocean.com/reference/api/reference/spaces-keys/\u003e)\n- A remote MCP server for Spaces answers at `https://spaces.mcp.digitalocean.com/mcp` with OAuth or a bearer token. Its source at v1.2.0 defines five key tools and five CDN tools (source: \u003chttps://docs.digitalocean.com/reference/mcp/configure-mcp/\u003e, \u003chttps://github.com/digitalocean-labs/mcp-digitalocean\u003e)\n- The access guide and limits page state that keys cannot be created, edited or deleted through the API or CLI, which the Spaces Keys API reference and the MCP tools contradict (source: \u003chttps://docs.digitalocean.com/products/spaces/how-to/manage-access/\u003e)\n- The status feed records failed write operations across services, Spaces among them, from 06:42 to 09:08 UTC on 6 August 2026, and a network disruption in BLR1 from 11:59 to 13:02 UTC on 3 October 2026 (source: \u003chttps://status.digitalocean.com/history.rss\u003e)\n- The Spaces SLA, last updated 2 December 2025, commits to 99.9 per cent monthly uptime per bucket, measured in 5-minute intervals, with credits of 10, 25 and 100 per cent (source: \u003chttps://www.digitalocean.com/sla/spaces\u003e)\n- The docs `llms.txt` carries a block of instructions addressed to AI assistants on which DigitalOcean tools to recommend. We recorded it and did not act on it (source: \u003chttps://docs.digitalocean.com/llms.txt\u003e)\n- The sub-processor list of 10 June 2026 names Cloudflare for CDN services and Wasabi for Cold Storage, each with a location (source: \u003chttps://www.digitalocean.com/trust/subprocessors\u003e)\n\n- #10 of 14 in Best file storage and sharing APIs for AI agents: https://www.anchorterminal.com/best/file-storage/index.md\n- All 75 storage comparisons: https://www.anchorterminal.com/compare/file-storage/index.md\n\n## Compare\n\n- [Box API + MCP vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/box-api-vs-digitalocean-spaces.md): B 69.4 vs B 63.2\n- [DigitalOcean Spaces vs Dropbox API + MCP](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-dropbox-api.md): B 63.2 vs B 68.2\n- [DigitalOcean Spaces vs Fastio](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-fast-io.md): B 63.2 vs C 55.2\n- [DigitalOcean Spaces vs Google Drive API + MCP](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-google-drive-api.md): B 63.2 vs A 79.6\n- [DigitalOcean Spaces vs OneDrive and SharePoint files (Microsoft Graph)](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-onedrive-sharepoint.md): B 63.2 vs B 65.3\n- [Amazon S3 vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/amazon-s3-vs-digitalocean-spaces.md): BB 77.9 vs B 63.2\n- [Azure Blob Storage vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/azure-blob-storage-vs-digitalocean-spaces.md): BB 75.7 vs B 63.2\n- [Backblaze B2 vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/backblaze-b2-vs-digitalocean-spaces.md): BB 75.3 vs B 63.2\n- [Bunny Storage vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/bunny-storage-vs-digitalocean-spaces.md): C 58.3 vs B 63.2\n- [Cloudflare R2 vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/cloudflare-r2-vs-digitalocean-spaces.md): BB 77.1 vs B 63.2\n- [DigitalOcean Spaces vs Tigris](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-tigris.md): B 63.2 vs E 44.4\n- [DigitalOcean Spaces vs Wasabi Hot Cloud Storage](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-wasabi-hot-cloud-storage.md): B 63.2 vs C 61.2\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on digitalocean.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"digitalocean-spaces\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/digitalocean-spaces\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/digitalocean-spaces.svg\" alt=\"DigitalOcean Spaces on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![DigitalOcean Spaces on Anchor Terminal](https://www.anchorterminal.com/badges/digitalocean-spaces.svg)](https://www.anchorterminal.com/tools/digitalocean-spaces)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/digitalocean-spaces\"\u003eDigitalOcean Spaces on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say DigitalOcean Spaces is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/digitalocean-spaces-dark.png\n- Light: https://www.anchorterminal.com/assets/share/digitalocean-spaces-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "File storage \u0026 sharing", "url": "https://www.anchorterminal.com/categories/file-storage" }, { "name": "DigitalOcean Spaces", "url": "" } ], "description": "DigitalOcean Spaces is S3-compatible object storage with a built-in CDN, sold as a $5 monthly subscription. Agents use it through AWS S3 SDKs with a Spaces access key, and manage keys through the DigitalOcean API or MCP server.", "facts": [ "rank #402 of 950", "API key auth", "0 desk reviews" ], "h1": "DigitalOcean Spaces", "image": "https://www.anchorterminal.com/assets/og/tools-digitalocean-spaces.png", "path": "/tools/digitalocean-spaces", "published": "2026-10-01", "section": "tools", "title": "DigitalOcean Spaces review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-10", "url": "https://www.anchorterminal.com/tools/digitalocean-spaces" }, "tokens": { "markdown": 9300, "slim": 2130 }, "version": 1 }