Repository navigation
Move box to https://mcp.box.simular.ai/mcp and migrate old relay entries - #19
Merged
Merged
Conversation
The box MCP server moved from relay.simular.cloud to mcp.box.simular.ai. The old address now returns protected-resource metadata naming the new URL, so MCP clients refuse to sign in through it. - CLI default URL, Claude Code / Hermes / dsh plugin configs and docs point at the new URL; plugin versions bumped (claude 0.1.1, hermes 0.1.1, dsh 0.2.1). - connect rewrites a box entry at the old address (it stays "ours"), and says the app may ask to sign in again. For Claude Code it runs `claude plugin marketplace update` + `claude plugin update` when the installed plugin still points at the old URL. - doctor flags an entry at the old address, and an endpoint whose metadata names a different resource. - Install matrix seeds a box at the old address for every client and, for Claude Code, installs the old plugin from a local git marketplace built from this checkout, so it tests this branch's plugin and the update path. Refs #18 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review follow-up: if the marketplace still serves the old .mcp.json (a fork or pinned ref), connect now fails with the fix instead of reporting success and re-running the update on every connect. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chenchenSimular
added a commit
that referenced
this pull request
Nov 4, 2026
…the CLI (#17) * cli: Gemini CLI support, clear permission errors, Codex hint without the CLI - gemini-cli client on our JSON writer: ~/.gemini/settings.json, mcpServers.box = {type: "http", url}; connect, doctor and remove, with the same foreign-server guard, backups and box-control cleanup. The next hint is `/mcp auth box` in a trusted folder. - When a config can't be written (EACCES/EPERM), connect says so; for Codex it prints the steps to add box in the Codex app's Settings. - The Codex sign-in hint points at the app when `codex` is not on PATH. - gemini-cli joins the real-client install matrix on Linux, macOS and Windows (@google/gemini-cli@0.66.0). Closes #16 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cli: name the config (not a temp file) when it can't be changed; cover EBUSY From review of #17: the permission message printed err.path, which can be a temp file or a file whose folder is the real problem. It now names the client's config and says the file or its folder may belong to another user. EBUSY (Windows, app holds the file) gets the same help. The Codex app steps are offered for the case where the app holds the file. Refs #16 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Release @simular-ai/box 0.1.3 (Gemini CLI) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Move box to https://mcp.box.simular.ai/mcp and migrate old relay entries (#19) * Move box to https://mcp.box.simular.ai/mcp and migrate old relay entries The box MCP server moved from relay.simular.cloud to mcp.box.simular.ai. The old address now returns protected-resource metadata naming the new URL, so MCP clients refuse to sign in through it. - CLI default URL, Claude Code / Hermes / dsh plugin configs and docs point at the new URL; plugin versions bumped (claude 0.1.1, hermes 0.1.1, dsh 0.2.1). - connect rewrites a box entry at the old address (it stays "ours"), and says the app may ask to sign in again. For Claude Code it runs `claude plugin marketplace update` + `claude plugin update` when the installed plugin still points at the old URL. - doctor flags an entry at the old address, and an endpoint whose metadata names a different resource. - Install matrix seeds a box at the old address for every client and, for Claude Code, installs the old plugin from a local git marketplace built from this checkout, so it tests this branch's plugin and the update path. Refs #18 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cli: check the Claude Code plugin's URL after updating it Review follow-up: if the marketplace still serves the old .mcp.json (a fork or pinned ref), connect now fails with the fix instead of reporting success and re-running the update on every connect. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #18. Stacked on #17 (base
chenchen/gemini-cli). Both ship together as CLI 0.1.3.Why
box's MCP server moved to
https://mcp.box.simular.ai/mcp(OAuth issuerhttps://mcp.box.simular.ai). The oldhttps://relay.simular.cloud/mcpstill answers. But its protected-resource metadata now nameshttps://mcp.box.simular.ai/mcpas the resource, so Claude Code, Codex and OpenCode refuse to sign in through it ("Protected resource ... does not match expected https://relay.simular.cloud"). That is why the install matrix on #17 failed.What
DEFAULT_MCP_URL),claude/.mcp.json,hermes/mcp.json,dsh/cordis.patch.yml, READMEs, tests and the install matrix. Staging staysstaging.relay.simular.cloud(no staging mcp host exists).claude0.1.0 → 0.1.1. A bump is required:claude plugin updatecompares versions.hermes0.1.0 → 0.1.1.dsh0.2.0 → 0.2.1. The README linksdsh-v0.2.1, so tagdsh-v0.2.1right after merge.relay.simular.cloudmoves to a newOLD_HOSTSlist. It still counts as box by Simular, so the foreign-boxguard accepts both the old and new URL as ours, and so does the oldbox-control.connectrewrites an entry at the old address. It prints "box moved from https://relay.simular.cloud/mcp to https://mcp.box.simular.ai/mcp. may ask you to sign in to box again."box@simular-boxplugin still points at the old URL,connectrunsclaude plugin marketplace update simular-box, thenclaude plugin update box@simular-box --scope <its scope>. It then re-reads the plugin, and fails with a fix if the URL is still old (for example a forked or pinned marketplace). Then it says to restart Claude Code. I checked this against Claude Code 2.1.316 with a git marketplace:plugin updatealone reports "already at the latest version" until the marketplace is updated.doctorreports an entry at the old address as "box's old address, which no longer signs in; box is now at …". The endpoint probe now also fails when the metadataresourcedoesn't match the URL (RFC 9728), which is exactly this outage.removeremoves entries at either address.boxat the old address.connectmust move it and print the sign-in note.url.<base>.insteadOfmaps a fake https URL to the local repo throughGIT_CONFIG_*env vars, set only in the isolated test environment.What migrates automatically and what doesn't
npx @simular-ai/box@0.1.3 connect. The user signs in again in the app.box@simular-boxconnect(marketplace + plugin update, then restart). Without the CLI, only once the user runs/plugin marketplace update simular-boxand/plugin update box@simular-box. Claude Code does not auto-update third-party marketplaces by default.hermes/, copied by hand)connectonly edits config.yaml.dsh-v0.2.1tarball (after the tag), and box-portal's link needs bumping.doctorflags any it can read.Tests
removeof an old entry.Review
An independent review (simular-code-review plus a secure-coding invariant review) found nothing blocking. One suggestion is fixed in the second commit: re-check the plugin's URL after the update instead of reporting success blindly. Security: the set of hosts treated as ours is unchanged (same three hosts). The update commands use fixed arguments with an allowlisted scope. The git insteadOf mapping exists only in the test env.
Not verified
🤖 Generated with Claude Code