Update to Roboflow

{
  "description": "Use when connecting cloud storage (AWS S3 / S3-compatible or Google Cloud Storage) to Roboflow to mirror images into a workspace — creating storage credentials, defining datasources (bucket-mirror configs), selecting objects with glob rules, validating access, and running/scheduling mirror jobs.",
  "included_files": [],
  "name": "roboflow-cloud-storage",
  "skill_md_contents": "---\nname: roboflow-cloud-storage\ndescription: Use when connecting cloud storage (AWS S3 / S3-compatible or Google Cloud Storage) to Roboflow to mirror images into a workspace — creating storage credentials, defining datasources (bucket-mirror configs), selecting objects with glob rules, validating access, and running/scheduling mirror jobs.\n---\n\n> **For agents:** This skill is authored in [`roboflow/computer-vision-skills`](https://github.com/roboflow/computer-vision-skills). If your client already has it loaded as a skill (for example from a Roboflow plugin), use that copy. The `roboflow://skills/<name>/...` MCP resources serve the same skills for clients that don't have them loaded.\n\n# Cloud Storage (Datasources & Credentials)\n\nMirror a cloud bucket's contents into a Roboflow workspace so new objects flow\nin automatically. Two pieces work together:\n\n- **Credential** — the secret Roboflow uses to reach the bucket (stored,\n  masked server-side, reusable across datasources).\n- **Datasource** — a *bucket-mirror configuration*: which bucket (via a\n  credential), which objects (glob rules), and how they sync. \"Datasource\" is\n  the user-facing name; the platform stores it as a bucket-mirror config.\n\n> Imports land at the **workspace** level. The datasource API cannot target a\n> specific project/dataset today.\n\n> Only want to run a model/Workflow over the files and collect the outputs,\n> without importing anything into Roboflow? That is batch processing — see the\n> `roboflow-batch-processing` skill. Mirroring composes with it too: imported\n> files become Asset Library images, and bulk predictions over them run as\n> Asset Library batch processing jobs (same skill).\n\n## Fast path — one call\n\n`connect_cloud_storage` does the whole flow in one shot: (optionally) create a\ncredential, create the datasource, validate access, and start the first mirror\nrun. Prefer it for new setups.\n\n- Reuse a credential: pass `credential_id` (from `credentials_list`).\n- Create a new credential: pass `credential_name` + `credential_type` (the\n  secret is collected securely out-of-band — see Security).\n- Describe the datasource so it can be created first: `bucket_type` (`s3`/`gcs`),\n  `bucket_name`, `region`, plus optional `mirror_configs` glob rules (see\n  Datasources). The datasource must exist before anything can be validated or\n  triggered — there is nothing to mirror without it.\n- `trigger` (default true) starts a mirror run **only if validation passes**;\n  triggering consumes credits.\n- Returns `{credentialId, credentialCreated, datasourceId, validation,\n  triggered, batchIds?}`. If a new credential was created but a later step\n  failed, you get `status: \"partial\"` with the ids so you can clean up with\n  `credentials_delete` / `datasource_delete`.\n\n## Credentials\n\n### Security — secrets never enter the chat\nThe secret (keys, service-account JSON, password) is collected **out-of-band**\nvia MCP elicitation, never as a tool argument and never in the transcript or\nmodel context. `credentials_list` returns only masked, non-secret fields.\nIf your client can't elicit securely, the tool returns\n`manual_entry_required` with a URL to create the credential in the app\n(`app.roboflow.com/<workspace>/settings/datasources`), then call\n`credentials_list` to get its id.\n\n### Credential types\n\n| `credential_type` | Provider | Secret fields collected |\n|---|---|---|\n| `IAM` | AWS S3 | `accessKeyId`, `secretAccessKey`, `sessionToken?` |\n| `AssumeRole` | AWS S3 | `roleArn`, `externalId`, `sessionName?` |\n| `AssumeRoleWithWebIdentity` | AWS S3 | `roleArn`, `webIdentityAudience`, `webIdentityRoleArn`, `externalId`, `sessionName?` |\n| `gcs` | Google Cloud Storage | `projectId`, `credentialFile` (full service-account JSON) |\n| `usernamePassword` | S3-compatible | `username`, `password` |\n| `apiKey` | S3-compatible | `apiKey` |\n\n> **AWS PrivateLink (`require_vpce`)** requires an\n> `AssumeRoleWithWebIdentity` credential; the server rejects the datasource\n> otherwise.\n\n## Datasources\n\n### Bucket\n- `bucket_type`: `s3` or `gcs`\n- `bucket_name` (no scheme/path), `region` (e.g. `us-east-1`)\n- `endpoint`: custom URL for S3-compatible providers (S3 only)\n\n### Mirror rules (`mirror_configs`)\nOptional list; omit to mirror the **whole bucket** with default settings. Each\nrule selects a subset and controls sync behavior:\n\n- **`glob_patterns`** (list) — the key field. Selects objects, e.g.\n  `[\"images/**/*.jpg\", \"batch-*/**\"]`. Set it to avoid importing unwanted files\n  or to split a bucket into multiple rules. Omit only when you truly want\n  everything.\n- `glob_file_path` — alternative: path to a manifest file in the bucket whose\n  lines list object paths to import.\n- `id` — rule id (auto-generated; pass an existing id on update to edit in place).\n- `settings` (omitted keys use server defaults):\n  - `removeOrphanedSourcesWhenDisappeared` (default true) — delete mirrored\n    images when the source object is removed.\n  - `namingStrategy` (`fullPath`|`fileName`|`eTag`|`metadata`, default\n    `fullPath`); `namingStrategyMetadataKey` required when `metadata`.\n  - `updateImageWhenNewer` (true) / `updateImageStrategy` (`overwrite`).\n  - `updateMetadataWhenNewer` (true) / `updateMetadataStrategy`\n    (`mergeBucketWins` default; also `overwrite`|`merge`|`mergeUserWins`|\n    `untilFirstChange`|`append`).\n  - `runScheduledEvery` (hours, default 0 = off) — >0 enables a recurring mirror\n    (fixed 24h cadence today; only on/off is honored).\n\n## Lifecycle & validation\n\n1. **Create** (`datasource_create`, or `connect_cloud_storage`). Nothing is\n   mirrored yet.\n2. **Validate** (`datasource_validate`) — checks `listFiles`, `headFile`,\n   `getFile`, and per-rule `headGlobFile`; returns `{checks, errors}`. Run it to\n   self-diagnose a bad credential/bucket **before** triggering.\n3. **Trigger** (`datasource_trigger`) — starts the mirror job; **consumes\n   compute/storage credits**. Returns `{batchIds}`.\n4. **Poll** (`datasource_job_get` with a `batchId`) — `status`\n   (running/completed/failed), per-stage `counters`, `errors`, timestamps.\n\n**Update** (`datasource_update`): only fields you pass change; to change the\nbucket pass `bucket_type` + `bucket_name` + `region` together.\n**Delete** (`datasource_delete`): removes the config, **not** already-mirrored\nimages. Deleting a credential still referenced by a datasource makes its runs\nfail.\n\n## MCP Tools Available\n\n| Tool | Purpose |\n|------|---------|\n| `connect_cloud_storage` | End-to-end: credential + datasource + validate + first run |\n| `credentials_list` | List masked cloud-storage credentials |\n| `get_aws_storage_credential_setup_link` | Get a Roboflow app link for AWS storage credential setup; enter secrets in the app |\n| `credentials_delete` | Delete a credential |\n| `datasources_list` / `datasource_get` | List / inspect datasource configs |\n| `datasource_create` / `datasource_update` / `datasource_delete` | Manage a datasource |\n| `datasource_validate` | Check bucket access before a run |\n| `datasource_trigger` | Start a mirror run (consumes credits) |\n| `datasource_job_get` | Poll a mirror run's status and counters |\n\n## Related Pages\n\n- `roboflow://skills/roboflow-data-management/SKILL` — what to do with the images once mirrored (tags, splits, versions, search)\n- `roboflow://skills/roboflow-product-navigation/SKILL` — the app's `settings/datasources` page\n"
}