What makes hybrids3 notable?

1K downloads. Trust evidence available

How should hybrids3 be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

hybrids3

Self-hosted lightweight object storage speaking three interfaces at once — the S3 API (boto3 / AWS-SDK compatible, AWS Sig V4), a plain HTTP API (curl-friendly, Bearer auth), and MCP (Streamable HTTP tools for agents). Buckets/objects with SQLite metadata and flat-file storage on disk; buckets are config-defined (no create/delete API), each with a public/private flag, a private key + public key pair, optional TTL expiry, and a max upload size. Auth is per-bucket keys plus a cross-bucket master key; presigned GET/PUT URLs for handing out single-object access. Use when the user wants to put/get/list/delete files in a self-hosted S3-compatible store, generate presigned upload/download links, drive their own boto3-compatible object storage, or connect an agent to object storage over MCP.

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

1.0k

Updated

Oct 11, 2026

Version

0.3.8

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1K downloads reported by the source. Last updated 10/11/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 11, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 11, 2026
Adoption signal: 1K downloadsadoption · observed Oct 11, 2026
Latest release: 0.3.8release · observed Aug 1, 2026
Handshake status: UNKNOWNsecurity

What changed

Newest first. Only changes that point at a source are listed.

Release 0.3.8release
- Removed the file: skill-card.md. - No functional or user-facing changes; documentation and interfaces remain the same.
Observed Aug 1, 2026 · source

Install and run

Setup complexity: low.

clawhub skill install s17fq93tmpky791n7516jcn08n83sfn2:hybrids3

Install using `clawhub skill install s17fq93tmpky791n7516jcn08n83sfn2:hybrids3` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/psyb0t/hybrids3 before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-psyb0t-hybrids3/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

145,417 characters of source documentation, loaded on request.

Extracted files

4 files captured from the source.

SKILL.md

---
name: hybrids3
description: Self-hosted lightweight object storage speaking three interfaces at once — the S3 API (boto3 / AWS-SDK compatible, AWS Sig V4), a plain HTTP API (curl-friendly, Bearer auth), and MCP (Streamable HTTP tools for agents). Buckets/objects with SQLite metadata and flat-file storage on disk; buckets are config-defined (no create/delete API), each with a public/private flag, a private key + public key pair, optional TTL expiry, and a max upload size. Auth is per-bucket keys plus a cross-bucket master key; presigned GET/PUT URLs for handing out single-object access. Use when the user wants to put/get/list/delete files in a self-hosted S3-compatible store, generate presigned upload/download links, drive their own boto3-compatible object storage, or connect an agent to object storage over MCP.
homepage: https://github.com/psyb0t/docker-hybrids3
user-invocable: true
permissions:
  - "network: outbound HTTP(S) to the configured HYBRIDS3_URL object-storage endpoint"
  - "object storage: read/write/delete objects (upload, download, list, delete) and generate presigned GET/PUT URLs, scoped to whatever bucket key is provided"
metadata:
  { "openclaw": { "emoji": "🪣", "primaryEnv": "HYBRIDS3_URL", "requires": { "bins": ["docker", "curl"] } } }
---

# hybrids3

Lightweight object storage that speaks three interfaces from one container: the **S3 API** (boto3 / any AWS SDK, AWS Signature V4), a **plain HTTP API** (`curl` + Bearer token), and **MCP** (Streamable HTTP tool definitions for AI agents). Metadata lives in SQLite, object bytes are flat files on disk.

Buckets are **configuration, not state** — they're defined in the server's `config.yaml` and there is no API to create or delete them. Each bucket carries: a `public`/private flag, a private `key` (Bearer token + S3 signing secret), a `public_key` (the `aws_access_key_id` identifier), an optional `ttl` (objects auto-expire after last write), and an optional `max_file_size`. A single cross-bucket `master_key` operates on every bucket and is the only credential that can list all buckets.

Object keys support nested paths (`reports/2024/jan.pdf`). Content type is auto-detected on upload (libmagic sniff + extension fallback). Presigned GET/PUT URLs hand out time-limited single-object access without exposing a key.

For installation, configuration, and container setup, see [references/setup.md](references/setup.md).

## Security & safety

- **Public buckets are world-readable.** A bucket with `public: true` serves `GET`/`HEAD`/`LIST` to anyone who can reach the port — no auth at all. Only store data there that's meant to be openly readable; keep sensitive data in a `public: false` bucket.
- **Bind loopback, not all interfaces.** The container listens on `8080`. Publishing it as `-p 8080:8080` / compose `"8080:8080"` makes it reachable from the network by default. Use `-p 127.0.0.1:8080:8080` (loopback) unless remote access is intentionally required, and for real deployments put the

_meta.json

{
  "ownerId": "kn79dhvmpjng4rp2jjk8k0v5xx80ccbk",
  "slug": "hybrids3",
  "version": "0.3.8",
  "publishedAt": 1785616193715
}

references/setup.md

# hybrids3 setup

Consumer-side reference for standing up an instance to talk to. If an operator already runs one, you only need its URL and a bucket key — skip to [OpenClaw / ClawHub Config](#openclaw--clawhub-config).

## Requirements

- Docker
- A `config.yaml` (buckets, keys, master key — see [Configuration](#configuration))
- A persistent volume/dir for `/data` (object bytes + SQLite metadata)
- ~1 core / modest RAM — it's a thin FastAPI service, not a cluster

The container runs as **UID 1000** and expects:

- Config file mounted at `/config/config.yaml`
- Data at `/data`
- Listens on port `8080`

## Quick Install

Grab the example config, edit keys + buckets, run:

```bash
# fetch the example config
wget -O config.yaml \
  https://raw.githubusercontent.com/psyb0t/docker-hybrids3/master/config.example.yaml

# edit it — set master_key and each bucket's key
vi config.yaml

# run
docker run -d --name hybrids3 \
    -p 127.0.0.1:8080:8080 \
    -v ./config.yaml:/config/config.yaml:ro \
    -v hybrids3-data:/data \
    psyb0t/hybrids3

# verify
curl http://localhost:8080/health      # → {"status":"ok"}
```

**`-p 8080:8080` binds all interfaces** — the service becomes reachable from the network, not just localhost. Use `-p 127.0.0.1:8080:8080` (loopback-only) unless remote access is intentionally required, matching the fleet convention.

### docker-compose

```yaml
services:
  hybrids3:
    image: psyb0t/hybrids3
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - ./config.yaml:/config/config.yaml:ro
      - hybrids3-data:/data
    restart: unless-stopped

volumes:
  hybrids3-data:
```

**`"127.0.0.1:8080:8080"` binds loopback-only.** Use `"8080:8080"` only if remote access is intentionally required, matching the fleet convention above. For a real deployment where other hosts or services need to reach it, put hybrids3 on an internal Docker network and front it with a reverse proxy (see [Behind a Reverse Proxy](#behind-a-reverse-proxy)) rather than publishing the port on all interfaces.

**Uploads to a `public: true` bucket are world-readable.** Any bucket with `public: true` serves GET/HEAD/LIST with no authentication at all — anyone who can reach the port can read anything stored there. Don't put sensitive data in a public bucket, and keep the port bound to loopback (or behind an authenticating proxy) unless that's the intended exposure.

## Configuration

**All configuration is the YAML file — there are no application env vars.** Buckets are defined here and only here; there is no create/delete API. Change config and restart to add or remove a bucket.

Top-level keys:

| Field | Default | What it does |
|---|---|---|
| `master_key` | `""` | Cross-bucket god key — works on every bucket, only credential that lists all buckets. Keep secret. |
| `master_public_key` | `"master"` | Non-secret `aws_access_key_id` paired with `master_key` in S3 auth. Safe to share. |
| `cleanup_interval` | `60` (`1m`) | How often the background loop deletes

skill-card.md

## Description:

hybrids3 helps agents and developers work with a self-hosted object store through S3-compatible clients, a plain HTTP API, and MCP tools.

This skill is ready for commercial/non-commercial use.

## Publisher:

[psyb0t](https://clawhub.ai/user/psyb0t)

### License/Terms of Use:

MIT-0

## Use Case:

Developers, operators, and agent builders use this skill to upload, download, list, delete, and presign objects in a user-managed hybrids3 storage service. It is most useful when a workflow needs S3-compatible storage, curl-friendly HTTP access, or structured MCP object-storage tools.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Remote deployments can expose powerful storage credentials and objects if the endpoint or public buckets are reachable by unintended users.

Mitigation: Use loopback or HTTPS-only access, keep sensitive data in private buckets, and expose the service through a controlled reverse proxy when remote access is required.

Risk: Master keys, bucket keys, and query-string auth or presigned URLs can act as bearer credentials and may leak through prompts, logs, shell history, or shared links.

Mitigation: Use bucket-scoped keys instead of the master key, keep credentials in environment or approved secret storage, avoid ?auth= URLs, and issue short-lived presigned URLs.

Risk: Delete operations and presigned PUT uploads can remove or overwrite object data without an undo path.

Mitigation: Confirm the exact bucket and key before destructive actions, avoid bulk delete workflows, and require explicit user approval before replacing existing objects.

Risk: Using an untrusted or mutable container image source can introduce supply-chain risk.

Mitigation: Install only from trusted image sources and prefer a pinned image digest for deployments.

## Reference(s):

- [hybrids3 setup](references/setup.md)
- [hybrids3 homepage](https://github.com/psyb0t/docker-hybrids3)
- [ClawHub skill page](https://clawhub.ai/psyb0t/skills/hybrids3)

## Skill Output:

**Output Type(s):** [text, markdown, code, shell commands, configuration, guidance]

**Output Format:** [Markdown with inline code blocks, shell commands, JSON snippets, and configuration examples]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [May produce API requests or MCP tool guidance that affects objects in the configured storage endpoint.]

## Skill Version(s):

0.3.8 (source: server release evidence)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 3d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular