ClawKeep S3 / R2 Backup Skill

You can back up an AI agent workspace to S3-compatible storage using AES-256-GCM encryption before upload, ensuring providers only see opaque .enc chunks. This requires the ClawKeep CLI, an initialized workspace, and valid bucket credentials to start daemonized sync operations.

Yes, zero-knowledge encrypted backup works with Cloudflare R2, Backblaze B2, MinIO, AWS S3, and Wasabi. The process applies AES-256-GCM encryption locally before uploading, so the object storage provider never sees plaintext data or file metadata.

Point-in-time restores and named snapshots are set up by running the ClawKeep CLI to initialize your workspace, setting a password for key material, and starting the background watch daemon to automatically sync encrypted changes to your configured bucket.

Before starting encrypted syncs, you need to install the ClawKeep CLI, initialize a workspace with set-password key material, and configure an S3-compatible target with valid access credentials. You can then test the connection and start daemonized sync operations.

No, the cloud provider cannot see your file metadata during client-side encrypted backup. The process applies AES-256-GCM encryption before upload, transforming local workspaces and memory files into opaque .enc chunks so object stores only see encrypted data.

The best way to automate off-site archival for memory files and configs is using a daemonized watch daemon to continuously sync encrypted changes to S3-compatible targets. This creates private, point-in-time archival snapshots that support easy restores.