rclone for coding agents

A coding agent with shell access can use rclone, a command-line tool for working with cloud storage providers, to inspect or transfer files between its local workspace and cloud storage. In rclone, a remote is a named configuration that tells rclone how to connect to a storage provider.

For a read-only task, an agent can list files on a configured remote and report what it finds while leaving the cloud data unchanged. Rclone also supports commands that copy or synchronize files, so the command matters: sync, for example, can delete destination files that are missing from the source. The rclone documentation describes its commands and supported storage backends.

Install and configure rclone

Install rclone using the platform-specific instructions linked from the official documentation. Then confirm that the shell can find it:

rclone version

Before an agent uses a cloud remote, configure it in a trusted terminal:

rclone config

Rclone’s prompts ask you to create a remote, choose a storage provider, and enter or approve the authentication details the provider requires. The steps vary by provider. Follow the provider’s authorization screen and rclone’s prompts. Do not put credentials in an agent prompt.

Rclone stores remote settings and credentials in a configuration file. The configuration documentation explains where to find the file and how to encrypt it with a password. Anyone or any process that can read an unencrypted file can use the credentials inside it. Keep the file out of the repository, and allow only necessary processes to read it.

To see the configured remote names, run:

rclone listremotes

The command lists names such as workdrive:. In the examples below, workdrive is a placeholder for a remote you have configured, and project-archive is a placeholder for a path that exists on that remote.

List remote files without changing them

Before editing a local project or preparing a release, a coding agent can use rclone to check whether an archive contains a file. This command lists entries at the top level of the remote path:

rclone lsf workdrive:project-archive --max-depth 1

lsf lists file and directory names in a compact format. --max-depth 1 limits the listing to the specified directory rather than walking through its subdirectories. The command prints one entry per line, based on the remote’s contents. It reads the files without copying, deleting, or modifying them. It still sends a request to the storage provider, so the configured credentials must allow rclone to list that path.

A realistic prompt for the agent is:

Use the configured workdrive remote to list the top-level entries in project-archive with rclone. Report the names you find. Do not download, upload, or change any remote files.

The prompt names the task and its boundary without including authentication secrets. These commands follow rclone’s documented syntax and have not been run for this article.

Preview changes before syncing

For a later task that publishes local files, rclone offers write commands such as copy and sync. copy copies source files to the destination; sync also removes destination files absent from the source. Before choosing a command, read the rclone command reference and the documentation for that command.

Preview a proposed synchronization with --dry-run:

rclone sync ./release workdrive:release --dry-run

The local source is ./release; the remote destination is workdrive:release. The preview reports the actions rclone would take, but does not apply them. Check any planned deletions before running a real sync. After reviewing the preview, run the same command without --dry-run to make the changes:

rclone sync ./release workdrive:release

That second command changes remote contents and can delete destination files. Use it only when that is the intended result.

Give the agent only the access it needs

Rclone uses the permissions granted to the configured account or credentials. A shell-enabled agent can use those credentials if it can read the rclone config. Keep the config isolated, and do not give the agent access to unrelated credentials. If the provider or your organization does not permit rclone access, do not configure that remote for the agent.

Rclone gives an agent command-line tools to inspect and move files, but the operator decides whether a transfer is appropriate. The operator selects a remote and sets the path, then chooses a command. Before running a command that changes cloud data, the operator reviews a write preview.