# Helix 0.103.0: Signed URLs with s3Sign

> `s3Sign()` on an authed AWS credential returns a signed, time-limited object URL, so browsers and services upload or download directly. A matching MCP tool mints one from chat.

- Released: 18 Aug 2026 (2026-08-18)
- Packages: @trayai/helix-cli@0.103.0, @trayai/helix-sdk@0.103.0

## Headline changes

### Added: Signed object URLs with `s3Sign`

`ctx.http.authed(alias).s3Sign(url, options?)` returns a presigned S3 URL for an AWS S3 credential: a time-limited URL that grants access to one object with no credentials attached, so uploads and downloads go directly to S3 rather than through your function. Sign `GET` for downloads (the default) or `PUT` for uploads, with a configurable `expiresIn` (default 15 minutes, maximum one week). The result is `{ url, method, expiresAt }`, and the URL only works with the method it was signed for.

Docs: https://helix.tray.ai/documentation/reference/context/http/

## Other changes

### Added

- `tray_s3_sign` MCP tool
  The CLI's MCP server gains `tray_s3_sign`, which mints a presigned S3 URL from chat using your local Helix login, with no dev server running. Pass a credential alias, the object URL, and optionally a method and `expiresIn`.

---

Canonical: https://helix.tray.ai/documentation/releases/01030/
This file: https://helix.tray.ai/documentation/releases/01030.md
The full changelog: https://helix.tray.ai/documentation/releases.md