B2 Incident Response

When to use

• The user suspects leaked B2 credentials, unauthorized bucket access, public exposure, ransomware, accidental deletion, or unexpected egress.
• The user asks to contain a B2 incident before doing cleanup or restore work.
• The user needs an evidence-preserving incident checklist using the MCP tool surface.

Byte path

• Object data MUST move directly between the client or workload runner and B2 using presigned URLs, multipart upload URLs, or an external B2/S3 client.
• MUST NOT route object data through the model or MCP server. Incident work uses metadata, key inventory, bucket policy state, version listings, retention state, and aggregate report data.
• Do not print sensitive object contents, key secrets, presigned URLs, access tokens, or customer data into chat. Preserve evidence with metadata summaries and external logs.

Safety gates