Move the box MCP URL to https://mcp.box.simular.ai/mcp and migrate old relay entries #18

Activity

1. chenchenSimular

   added 2 commits that reference this issue on Nov 4, 2026

   Move box to https://mcp.box.simular.ai/mcp and migrate old relay entr…

   ...

   ab377f2

   cli: Gemini CLI support, clear permission errors, Codex hint without …

   ...

   0085bfa
2. catoxliu commented on Nov 4, 2026

   

   catoxliu

   on Nov 4, 2026

   Last edited by catoxliu

   More actions

   One more client hits this, and the public install page still hands out the old URL

   Reproduced today on Windows following https://box.simular.ai/install, with pi 1.5.0 (Node 22.22.3) — an MCP client the CLI has no id for:

   $ pi mcp add box --url https://relay.simular.cloud/mcp
   $ pi mcp login box
   Sign-in to MCP server "box" failed: Protected resource
   https://mcp.box.simular.ai/mcp does not match MCP server
   https://relay.simular.cloud/mcp
   

   So the RFC 9728 mismatch is not specific to Claude Code, Codex and OpenCode: any client that validates the protected-resource metadata against the URL it was configured with fails, and pi validates it. Changing only the URL to https://mcp.box.simular.ai/mcp signed in on the first attempt (issuer https://mcp.box.simular.ai, 31 tools, shell verified working on the box).

   Two things still send people to the old address when they set up today:

   1. The public install guide. https://box.simular.ai/install (served as Markdown to agents that curl it) still says https://relay.simular.cloud/mcp in "Connect with one command", in "Server URL and sign-in", and in every per-app snippet, including the "Any other MCP client" section. That page is the one agents are instructed to follow, so an agent setting box up for someone writes the broken URL into their config — which is exactly how I hit this. It lives outside this repo (box-portal?), so it may need a change there in addition to Move box to https://mcp.box.simular.ai/mcp and migrate old relay entries #19.
   2. The published CLI. npm latest is 0.1.2 (2026-11-03T10:03Z), published before the move; DEFAULT_MCP_URL in cli/src/constants.js and both READMEs on main still name relay. Expected while Move box to https://mcp.box.simular.ai/mcp and migrate old relay entries #19 is unmerged — flagging it only because until 0.1.3 ships, npx @simular-ai/box connect writes the URL that cannot sign in.

   Nothing new for the migration table on #19: a pi entry added by hand is in the "added by hand" row (user edits the URL, or pi mcp remove box && pi mcp add box --url https://mcp.box.simular.ai/mcp). OUR_HOSTS already contains mcp.box.simular.ai, so connect accepts the fixed entry rather than treating it as a foreign box.

   Optional: a pi client. pi reads/writes the same shape as Cursor — ~/.pi/agent/mcp.json, container mcpServers, entry { "url": ... } — and it does OAuth itself (DCR + PKCE, or its Client ID Metadata Document), so a cli/src/clients/pi.js would be close to a copy of cursor.js:

   export default jsonClient({
     id: 'pi',
     name: 'pi',
     auth: 'oauth',
     file: (ctx) => path.join(ctx.home, '.pi', 'agent', 'mcp.json'),
     container: ['mcpServers'],
     entry: (ctx) => ({ url: ctx.url }),
     bins: ['pi'],
     dirs: (ctx) => [path.join(ctx.home, '.pi', 'agent')],
     next: (ctx) => [`Run /mcp, pick ${ctx.name} and choose Sign in (or \`pi mcp login ${ctx.name}\`), then start a new chat.`],
   })

   No bins entry exists on this machine's PATH check the way the other clients do it (pi lives at ~/.pi/agent/bin/pi), so the detection rule may need to look in that folder. Nice-to-have; feel free to keep this comment to the URL move.

   Repro details, in case they help doctor's probe: both hosts answer an unauthenticated initialize with 401 and

   www-authenticate: Bearer resource_metadata="https://mcp.box.simular.ai/.well-known/oauth-protected-resource/mcp", scope="boxes"
   

   and that document replies {"authorization_servers":["https://mcp.box.simular.ai"],"resource":"https://mcp.box.simular.ai/mcp","resource_name":"Box","scopes_supported":["boxes"]}. Happy to test the 0.1.3 migration against a hand-added pi config once it is released.