[dora-dotcom]

Adds openclaw/, a native OpenClaw plugin for box, the "verified route" asked for in #2's review. It replaces the CLI steps Grace hit in #box-dogfooding (5 Nov): no npx first, no stopping the Gateway, sign-in from a button.

What it is

• openclaw.plugin.json declares box's remote MCP server through the manifest mcpServers field: https://mcp.box.simular.ai/mcp, streamable-http, auth: "oauth", scope boxes. OpenClaw shows a Connect button under Accounts on the plugin's page for plugin-declared HTTP servers with auth: "oauth".
• skills/box/SKILL.md: the Claude plugin's skill, with the sign-in line pointing at the plugin page.
• src/index.ts: an empty definePluginEntry. The plugin registers no tools, hooks or commands.
• Published to ClawHub as @simular-ai/openclaw-box; the user runs openclaw plugins install @simular-ai/openclaw-box.

Tested on OpenClaw 2026.11.1 (isolated state dir, macOS)

• Installed from the npm pack tarball: plugin loaded, mcpServers.box read with url, transport and auth: "oauth"; the box skill shows as ready in openclaw skills list.
• Gateway running (loopback): plugin page → Accounts → Connect opened box's consent page ("OpenClaw MCP wants to use your box", Unverified, since OpenClaw registers itself), Allow → back to OpenClaw, page shows Connected. No Gateway stop, no mcp login.
• Agent tool call tested by Grace (6 Nov) on macOS, OpenClaw 2026.11.1, installed from ClawHub (openclaw plugins install clawhub:@simular-ai/openclaw-box): Connect → Accounts shows Connected; "take a screenshot of my box" returned the screenshot in ~10s. No npx, no Gateway stop.

Since the first push

• CI: build the plugin before installing it, and pin OpenClaw 2026.11.1 (the plugin's compat.pluginApi) in cli/e2e/clients.json. Ran the same steps locally.
• README: moving off the CLI setup now says to stop the Gateway before openclaw mcp unset box (Grace hit this).

Things to know

• The consent page shows "OpenClaw MCP · Unverified – this agent registered itself" with a plain "O" icon, same as the CLI route: OpenClaw registers its own OAuth client, so the plugin can't change it. Showing it as verified would be a box-side allowlist of known clients.
• openclaw plugins validate fails with "plugin entry does not expose tool or feature authoring metadata"; that command checks tool plugins from openclaw plugins init, and this one has no tools. Install and inspect pass.
• A CLI-made mcp.servers.box overrides the plugin's box server (operator config wins). The README tells people to keep one.
• compat.pluginApi is >=2026.11.1, the version tested. It could likely go lower; I haven't checked older hosts.
• Published 0.1.0 to ClawHub from this branch (commit 1e6c202) under the new @simular-ai publisher on 5 Nov; Plugin Inspector PASS, security scan clean, public since 6 Nov. Later releases should come from main after merge.

🤖 Generated with Claude Code