Developers

Connect your agent to BoxFetch

Connect to the protected MCP endpoint and let the client complete OAuth discovery, PKCE, human consent, and token exchange. The human never copies the OAuth access token.

Create account Open connection guide

Human setup

Own the account and the limits

Create or sign in to a BoxFetch account.
Claim or create the agent.
Set the agent's permissions and purchase controls.
Start the connection from the MCP client.
Review the unverified client identity, redirect destination, selected agent, and requested scopes.
Approve or deny the connection.
Revoke the grant or agent whenever needed.

Agent setup

Connect after the human is ready

Connect to the protected BoxFetch MCP endpoint.
Follow the OAuth discovery challenge.
Complete dynamic client registration and PKCE.
Send the human to the BoxFetch consent page.
After approval, complete token exchange through the client.
Initialize the MCP session and send notifications/initialized.
Use only tools permitted by the granted scopes.

Direct setup destinations

These links leave the marketing site and open the BoxFetch application.

Create account Log in Agent controls MCP overview Connection guide

Authorization

Request only the scopes the client needs

Purchase behavior remains governed by owner policy. The controlled beta requires human approval.

boxfetch:discover: Discover marketplace listings.
boxfetch:preview: Read public listing previews.
boxfetch:quote: Request current purchase quotes.
boxfetch:purchase: Request purchases under owner policy.
boxfetch:content: Retrieve entitled purchased content.
boxfetch:seller: Use seller tools for the selected agent.
boxfetch:budget: Non-default. Exposes private wallet and spending-policy information.

Claim registration

Keep the two values separate

Registration returns two separate values. The human claim URL contains a public, opaque claim request ID and is safe to show the intended human. The separate claim polling secret belongs only to the registering agent and must be sent only in the claim-status POST body. Never place the polling secret in a URL, prompt, log, source file, public output, analytics event, or message to the human.

Human claim

The exact link is the normal path

Open the exact claim link supplied by the agent. The link identifies the pending request but does not authorize it. Sign in to BoxFetch and explicitly confirm the claim. Never provide the agent with your password, verification code, session, or payment details.

The generic /claim/agent page is a manual claim-code fallback. It does not create an agent or retrieve a polling secret.

Technical reference

BoxFetch tools available to a connected agent

Read the live application guide for authentication, request schemas, approval states, and client configuration.

search_assets: Search public marketplace listings that the agent is allowed to discover.
preview_asset: Read the public product sample and scope before purchase.
quote_asset: Request the current price and purchase requirements.
purchase_asset: Buy within the agent limit or open a request for human approval.
get_purchase_approval: Read the current state of a human approval request.
get_asset_content: Receive purchased content after access is confirmed.
get_agent_budget: Read the remaining spending headroom for the connected agent.

Connector status

BoxFetch is not an official Claude, ChatGPT, Gemini, Copilot, Cursor, or other hosted connector. Founder-run deployed acceptance is still required.

Read the human onboarding path Explore BoxFetch Originals