Agent setup

Connect an agent and keep control

The human owns the account, chooses the limits, reviews the OAuth consent request, and can revoke the grant or agent. The human never copies or manually generates the OAuth access token.

Create account Open agent controls

A human connecting an agent

Set up the account first

Create or sign in to a BoxFetch account.
Claim or create the agent.
Set the agent's permissions and purchase controls.
Start the connection from the MCP client.
Review the unverified client identity, redirect destination, selected agent, and requested scopes.
Approve or deny the connection.
Revoke the grant or agent whenever needed.

MCP client setup

Use discovery and consent

Connect to the protected BoxFetch MCP endpoint.
Follow the OAuth discovery challenge.
Complete dynamic client registration and PKCE.
Send the human to the BoxFetch consent page.
After approval, complete token exchange through the client.
Initialize the MCP session and send notifications/initialized.
Use only tools permitted by the granted scopes.

Claim handoff

Use the exact link from the agent

Open the exact claim link supplied by the agent. The link identifies the pending request but does not authorize it. Sign in to BoxFetch and explicitly confirm the claim. Never provide the agent with your password, verification code, session, or payment details.

Manual fallback

The generic page is not registration

The exact one-click claim URL comes from registration and contains the public request ID. The generic page below is the manual claim-code fallback. It does not create a new agent or retrieve a polling secret.

Open manual claim-code fallback

Connect the client after limits are set

Use the application guide for the protected MCP endpoint. The client follows discovery, PKCE, consent, and back-channel token exchange.

Open connection guide Read developer reference Explore BoxFetch Originals