# Sigil Data

> Sigil Data is an S3-compatible object storage service built for both humans
> and AI agents on XPR Network. Your XPR wallet is your identity — no API
> keys, no captcha, no signup form. Simple monthly subscription tiers,
> paid in XPR/XMD/USDC — see Pricing below (per-GB-day billing was
> replaced 2026-07-05).

Live at https://storagesigil.pro (web dashboard) and
https://s3.storagesigil.pro (S3-compatible / MCP endpoint), both HTTPS.

## What it is

- **S3-compatible object storage** — works with `aws-cli`, `rclone`, `boto3`,
  Cyberduck, anything that speaks AWS Signature V4.
- **XPR keypair is your identity.** No separate API keys. MCP requests are
  XPR-signed; S3 requests use SigV4 with a secret derived from your XPR
  private key via HKDF-SHA256.
- **Native MCP server** — 11 tools, designed agent-first. AI agents sign in
  with their existing XPR keypair (from `create-xpr-agent`), deposit XPR,
  and start storing without any human configuration step.
- **Per-GB-day XPR billing** has been **replaced** (2026-07-05) with a simple
  monthly subscription model — see Pricing below. Multi-token (XPR / XMD /
  USDC) payments with live USD-quote at checkout, settled internally in XMD.

## For humans
1. Create a free XPR wallet at webauth.com (~30 seconds, biometric).
2. Complete KYC inside the WebAuth app (one-time identity verification).
3. Sign in at storagesigil.pro — one tap in WebAuth.
4. Stay on Free (1 GB) or subscribe to a paid tier — see Pricing below.
   Multi-token: pay in XPR / XMD / USDC, settled in XMD internally.
5. Use the web dashboard, or any S3-compatible tool, to store and retrieve.

## For AI agents
1. Use an existing XPR keypair from `create-xpr-agent`, or generate one.
2. Link to a KYC'd human wallet via `agentcore` (the human funds the balance).
3. Connect to the MCP server (stdio) — `auth_sign_in` → sign challenge →
   `auth_sign_in_submit` → `subscribe` (or stay on Free) → `storage_put`.
4. Or register a SigV4 secret via `register_sigv4` and use any S3 client
   against the endpoint.

## MCP tools (11)
- `auth_sign_in` — request a challenge
- `auth_sign_in_submit` — submit signed challenge, get `agent_id`
- `auth_refresh` — refresh session
- `subscribe` — subscribe to a tier (Free / Pro / Pro+ / Max / Max+), paying in XPR / XMD / USDC
- `get_subscription` — current tier, storage cap, bytes used, renewal date
- `storage_put` — upload an object (hard cap enforced on writes)
- `storage_get` — download an object
- `storage_delete` — delete an object
- `storage_list` — list objects in a folder
- `get_usage` — current bytes stored, broken down by folder
- `register_sigv4` — register a SigV4 secret derived from your XPR key

## Pricing (updated 2026-07-13 — family tier ladder, see mailsigil.pro)

Simple monthly subscription. No per-byte metering, no daily cron, no
surprise bills. Tiers Pro+ and up ALSO include Sigil Mail Pro (a 50GB
email mailbox at mailsigil.pro) at no extra charge — one payment, both
products. The bundle is one-way: a Sigil Mail Pro subscription does not
grant anything on Sigil Data.

| Tier   | Storage | Price       | Includes Sigil Mail Pro? |
|--------|---------|-------------|---------------------------|
| Free   | 1 GB    | $0 / month  | no |
| Pro    | 50 GB   | $3 / month  | no |
| Pro+   | 100 GB  | $5 / month  | **yes** |
| Max    | 500 GB  | $9 / month  | **yes** |
| Max+   | 1 TB    | $14 / month | **yes** |

Subscriptions can be paid in **XPR**, **XMD**, or **USDC** — quoted at
checkout using a live XPR/USD price feed, settled internally in XMD. No
egress fees, no API call fees. Hard cap on writes (tier storage limit,
real backend enforcement — not cosmetic); no overdraft math required.

Tier keys used in the API/MCP tools are ASCII: `free`, `pro`, `proplus`,
`max`, `maxplus` (never "pro+"/"max+" — the `+` is display-only, it isn't
valid in a querystring or on-chain memo).

## Auth (no separate API keys)

### MCP / XPR-signed
1. `auth_sign_in` → returns `{ challenge_id, challenge }`
2. Sign `challenge` with your XPR private key
3. `auth_sign_in_submit` with `{ challenge_id, signature }` → returns `agent_id`
4. All subsequent calls include `agent_id` (or `public_key`)

### HTTP / SigV4 (aws-cli compat)
1. Derive `sigv4_secret = HKDF-SHA256(xpr_priv, "agent-storage-sigv4-v1", xpr_pub, 32)` base64
2. Sign `register_sigv4:<pub>:<secret>` with your XPR key
3. `register_sigv4` MCP tool — server verifies, stores secret
4. Use `aws-cli` / `rclone` / etc. with `AWS_ACCESS_KEY_ID=<xpr_pub>`,
   `AWS_SECRET_ACCESS_KEY=<secret>`, endpoint `https://s3.storagesigil.pro`

## Related
- **Sigil Mail** (https://mailsigil.pro) — sibling product, agent-native
  email on XPR Network. Same wallet-login identity model.
- Source of the backend service: `agent-storage` (TypeScript, Node 22).

## Status (2026-07-08)
Live in production on Hetzner, alongside Sigil Mail. `s3.storagesigil.pro`
serves the S3-compatible/MCP backend; `storagesigil.pro` serves the
landing page and web dashboard. Both HTTPS.