v0.1.1 — non-Claude harness OAuth setup

Non-Claude harness OAuth support

Field finding from a Hermes integration: Box's OAuth server does not support Dynamic Client Registration (DCR). Every non-Claude harness (Hermes, OpenClaw, Codex, Cursor, custom) must pre-register a Box Custom App in the developer console, then configure the harness's MCP server block with the resulting client_id / client_secret. The plugin now surfaces the right walkthrough per harness.

New

• /box-mcp-check --harness=auto|claude|hermes|generic — selects which setup narrative to surface. auto (default) preserves prior behavior. hermes surfaces Hermes-specific config including the auth: oauth silent-failure gotcha and post-OAuth reload requirement.
• references/harness-oauth-setup.md — new source-of-truth doc with Box dev-console steps, scope-label-to-OAuth-scope translation, per-harness redirect URIs and config blocks.

The Auth: none silent failure (Hermes)

Hermes requires both:

• oauth: block with client_id, client_secret, redirect_port
• Top-level auth: oauth key (separate from the credentials block)

Without the top-level auth: oauth, hermes mcp test box reports Auth: none and the server 401s — even though credentials parsed correctly. New skill flag and reference doc call this out prominently.

Model floor for setup

OAuth setup involves dev-console navigation, copying credentials, editing config, diagnosing silent failures. Verified working: Claude 4.5+. For weak-model deployments: do the one-time setup in a Claude 4.5+ session; any model can use the connection afterwards (tokens persist).

Why patch not minor

New flag is additive and optional. Zero behavior change for existing Claude Code / Cowork users (--harness=auto default matches prior behavior). Plugin manifest, all 12 skills' core behaviors, and zip shape are unchanged.

SHA256

box-memory-plugin.zip      50c8916ee47c39e5f2fe7bc03365dd75b7ac8601dc438e1f3b9b9693df5a99c9
box-memory-plugin.plugin   50c8916ee47c39e5f2fe7bc03365dd75b7ac8601dc438e1f3b9b9693df5a99c9
box-memory-skills.zip      19b3a87dda9ef5943e200d00e5ae01d6eddb132d48602832c549072530db74b7

Install

Same paths as v0.1.0 — see the README.

Verified: Claude plugin validate PASSES. Hermes + Claude 4.7 + Box Custom App + 30 tools live (2026-05-25).

v0.1.0 — Box-native: Box AI, Hubs, AI Studio, official MCP

Major release. After canvassing developer.box.com — Box AI, Box Skills (verdict: legacy, skip), official SDKs, MCP servers, Hubs, Doc Gen, webhooks, and 2026 H1 launches — the plugin now leverages Box's full product surface where it makes sense, and documents where it deliberately doesn't.

What ships in v0.1.0

4 new skills:

Skill	Purpose	Tier
box-ai-recall	Semantic Q&A via /2.0/ai/ask — multi-doc (≤25 files) or Hubs (≤20k files). Citations included.	Business+ AI Units
box-ai-extract	Structured metadata extraction via /2.0/ai/extract_structured. OCR for PDFs / TIFF / PNG / JPEG.	Business+ AI Units
box-ai-agent	Persistent AI Studio "memory librarian" agent with locked guardrails.	Enterprise Advanced
box-mcp-check	Verifies official Box MCP at mcp.box.com vs community/deprecated.	All

4 enhanced skills:

• box-init — --as-hub flag (Enterprise Plus); formalized boxMemory metadata template; new opt-in AI flags in workspace config
• box-recall — suggests AI fallback when local results sparse (opt-in)
• box-companion — uses Box AI Extract for PDFs/images on Business+ (replaces "couldn't parse" stubs)
• box-tier-detect — probes official-MCP, AI tools, AI Units, Hubs, AI Studio availability

2 new reference docs:

• references/webhooks.md — pattern for self-hosting a webhook receiver (Box → box-memory event-driven workflows)
• references/box-ai-units.md — Box AI cost model: per-plan allocations, per-skill consumption, opt-in controls

README + ops notes updated:

• Recommended Box MCP is now explicitly the official remote at mcp.box.com (Box-maintained, OAuth 2.0, full toolset including Box AI / Hubs / Doc Gen)
• CCG / OAuth / JWT auth recommendations for non-Claude agents
• LangChain + LlamaIndex integration pointers
• Operational notes 7 (Hub indexing warm-up) and 8 (SDK v10.6 tags breaking change) added

Plugin shape

	v0.0.1	v0.1.0	Anthropic customer-support
Skills	8	12	5
Uncompressed	35 KB	76 KB	79 KB
Compressed	19 KB	37 KB	33 KB

Right inside Anthropic's published-plugin range. 12 skills is heavy but each is lean (~3-9 KB).

Verification

Artifact	SHA256
box-memory-plugin.zip	0c495fc5a5f758f97a0446feac91a015e2f8f5a67c3fc2e638cff219f45a0d37
box-memory-skills.zip	6cb8eb457f2bacb1460235a4878cc22e68a608c26c907731ee5e98236daeca11

Verify before install: shasum -a 256 box-memory-plugin.zip.

Install

Claude Code

mkdir -p ~/.claude/plugins/box-memory
curl -L -o /tmp/box-memory-plugin.zip \
  https://github.com/mrdulasolutions/BOX/releases/latest/download/box-memory-plugin.zip
unzip -o /tmp/box-memory-plugin.zip -d ~/.claude/plugins/box-memory/

Cowork

Settings → Plugins → Add plugin → upload box-memory-plugin.zip.

Connect Box MCP

Use Box's official remote MCP at mcp.box.com — Settings → Connectors → Box. After connecting, run /box-mcp-check to confirm scopes (you want root_readwrite, ai.readwrite, docgen.readwrite for the full toolset).

Migration from v0.0.1

• No workspace data migration. _box-memory.json schema is forward-compatible.
• New AI features are opt-in via settings.ai_recall_enabled etc. (default false).
• Reinstall the plugin zip; existing workspaces continue working.

Air-gapped variant

Need air-gapped / on-prem workflow? See mrdulasolutions/BOX-Onprem — same model, local Box Drive only, zero outbound calls to Box during skill execution. Box AI features are not available in that variant by design (Box AI is server-side).

Box Skills (the framework, not our skills)

Verdict from research: skip. Docs are 404, SDK frozen since 2019, BoxWorks 2025 never mentioned it. Box AI, AI Agents, and Automate are where Box's investment is. We integrate those instead.

v0.0.1 — Initial release: Box.com as agent memory + file storage

A Claude Code / Claude Cowork plugin that turns Box.com into agent memory + file storage. Markdown memories with YAML frontmatter and Obsidian-style wikilinks, paired companion .md files for binaries (no chunking, no RAG), instant recall via per-folder index files (all Box tiers) or metadata templates (Business+).

8 skills

Each skill is also a /box-* slash command in Claude Code and Cowork.

Skill	Purpose
box-init	Bootstrap a Box workspace with tier-aware setup
box-status	Show workspace state (tier, counts, index health)
box-tier-detect	Probe Box account capabilities
box-write	Save a memory (markdown + frontmatter + wikilinks)
box-recall	Find memories — multi-strategy lookup that bypasses Box's 10-min search lag
box-companion	Generate a paired markdown describing a binary file
box-team	Manage multi-team subtrees
box-index-rebuild	Refresh per-folder indexes when drift is detected

Architecture

Plugin = thin invocation contract; GitHub repo = deep knowledge. Each SKILL.md is ~4 KB and links to detailed procedures, schemas, and operational notes hosted in the repo. Agents fetch the deep content on demand via raw.githubusercontent.com URLs when a workflow gets non-trivial. Updates to operational quirks propagate without re-uploading a new plugin version.

Install paths

Claude Code

mkdir -p ~/.claude/plugins/box-memory
curl -L -o /tmp/box-memory-plugin.zip \
  https://github.com/mrdulasolutions/BOX/releases/latest/download/box-memory-plugin.zip
unzip -o /tmp/box-memory-plugin.zip -d ~/.claude/plugins/box-memory/

Claude Cowork plugin (org admin)

Cowork → settings → Plugins → Add plugin → upload box-memory-plugin.zip. Same artifact as Claude Code.

Claude Cowork personal skills (any user)

Upload individual box-<skill>.zip files via Cowork → Settings → Skills → Upload skill. Pick which skills you want.

Any other agent

box-memory-skills.zip unpacks to a skills/ directory with all 8 skill subdirectories — drop into any agent that points at a skills folder.

Tier-aware, never tier-gated

Every feature has a working path on every Box tier:

• Personal / Free — per-folder _index.json for instant recall (bypasses Box's universal 10-min search indexing lag)
• Business+ — optional boxMemory metadata template enables Metadata Query API for SQL-like queries
• Enterprise — retention policies, legal holds available; HIPAA BAA + FedRAMP Moderate available
• Enterprise Plus — FedRAMP High, DoD IL4, ITAR available

Repo

Full source, design rationale, schemas, tier matrix, and operational notes: https://github.com/mrdulasolutions/BOX

Acknowledgments

This v0.0.1 is the result of substantial debugging of Cowork's plugin validation, which is stricter than Claude Code's local claude plugin validate and stricter than the official schemastore.org schema. The minimal-plugin reproducer that isolated the cause is preserved at scripts/build-minimal.sh — useful for anyone debugging similar "plugin validation failed" errors against Cowork.