AgentDrive

Connect AgentDrive to Claude

AgentDrive is shared cloud storage for agents. Its hosted MCP server lets Claude — or any MCP client — work in the drives you have granted it: list folders, read and write files, upload real ones, follow what changed, and share. Connecting takes a URL and an authorization screen.

Before you connect

A Token Canopy account and a workspace — sign up at app.tokencanopy.com. There is no waitlist. You will pick which workspace this connection belongs to while authorizing.
A drive. Create one in the console, or let the connection create its own — whoever creates a drive gets manager access to it, so a connection that starts with nothing can still start work.
A tolerance for a moving contract. AgentDrive is in beta on a v0 API, and v0 can still change before it is called stable.

The server

Server URL: https://drive.mcp.tokencanopy.com/mcp
Transport: Streamable HTTP
Authorization: OAuth 2.0, PKCE, dynamic client registration
Authorization server: https://auth.tokencanopy.com/oidc

It is one URL for everyone — the drives you see come from your authorization, not from a URL of your own. An MCP client discovers the rest for itself: the server publishes a protected-resource document naming its authorization server and scopes, and registers your client automatically. Connector UIs need only the URL; command-line clients add the server and then start their login flow.

Adding it to Claude

In Claude, open Settings → Connectors and choose to add a custom connector.
Paste https://drive.mcp.tokencanopy.com/mcp as the server URL and connect.
Sign in to Token Canopy if you are not already, then approve the authorization screen described below.

In Claude Code, add the connection to your user profile and then log in:

claude mcp add --transport http --scope user agentdrive https://drive.mcp.tokencanopy.com/mcp
claude mcp login agentdrive

Adding it to Codex

codex mcp add agentdrive --url https://drive.mcp.tokencanopy.com/mcp
codex mcp login agentdrive

Codex may first print a scope rejection and then retry with the AgentDrive scopes it discovered. The first scope rejection is expected; open the second authorization URL. The initial request has identity scopes but no AgentDrive permission, so refusing it keeps the grant boundary fail-closed.

Any other MCP client that speaks Streamable HTTP and OAuth connects the same way, with the same URL.

What you are approving

Authorizing shows a screen headed Authorize AgentDrive MCP with two choices:

Workspace. Which of your workspaces this connection acts in. The authorization stays with that workspace; to use a different one, authorize again.
Access level. Read and write, or Read only to hold the connection to reads of whatever the client asked for. The screen can only ever narrow a request — no choice on it adds a permission the client did not ask for.

What the client asks for is spelled out as scopes, and a tool exists for a connection only if the scopes it needs were granted. A read-only authorization lists seven tools; a full one lists all twenty-four. Asking for a tool that was not listed is refused rather than run.

Scope	Lets the client
`drives:read`	See which drives exist and what they are called.
`drives:write`	Create, delete, and restore drives in the workspace.
`content:read`	List folders, search, and read files and their versions.
`content:write`	Create, change, move, upload, delete, and restore files.
`changes:read`	Follow the drive change feed.
`sharing:read`	See who has access.
`sharing:write`	Create share links, and publish or unpublish files and folders.
`usage:read`	See how much a drive holds, against its limits.

Scopes are a ceiling, not a key. Underneath them, the grants on each drive still decide what this connection can actually reach — a connection authorized for content:write can still only write in drives you have been granted, and it never sees the ones you have not.

The tools

Reading

Tool	What it does	Needs
List drives`list_drives`	The drives this authorization can reach, each with a usage summary. Its state filter also lists deleted drives — with the revision needed to restore one, and no usage summary, which only an active drive has.	`drives:readusage:read`
List folder contents`list_directory`	The folders and files directly under one folder, by id or by path. Omit both for the root. Its state filter is where deleted entries — and the revision needed to restore them — are found.	`content:read`
Search a drive`search_drive`	Search one drive through its own search index.	`content:read`
Read a file`read_artifact`	A file's metadata and, when asked for, a bounded amount of its content.	`content:read`
List file versions`list_artifact_versions`	The immutable versions kept for one file, newest first.	`content:read`
List recent changes`list_changes`	A page of the drive change feed. Keep the returned cursor to resume where you left off.	`changes:read`
List access grants`list_access_grants`	Who currently has access to a drive, or to one file or folder.	`sharing:read`

Writing

Tool	What it does	Needs
Create drive`create_drive`	A new drive in this workspace. The agent that creates it and its sponsor both get manager access.	`drives:write`
Delete drive`delete_drive`	Delete one drive and everything in it. Requires the current revision and manager access to that drive.	`drives:write`
Restore drive`restore_drive`	Bring back a deleted drive, using the revision the delete returned. Needs manager access to that drive.	`drives:write`
Create folder`create_folder`	One folder under a parent folder or path.	`content:write`
Create a file`create_artifact`	A new file from inline content, capped at 1 MiB. It never overwrites an existing file.	`content:write`
Replace file contents`replace_artifact_content`	A new version of an existing file. Requires the current revision, and never creates a file.	`content:write`
Update file metadata`update_artifact_metadata`	Metadata or labels on an existing file. Requires the current revision, and never touches content, name, or place.	`content:write`
Move or rename`move`	Move or rename one file or folder. Requires the current revision.	`content:write`
Delete file or folder`delete`	Delete one file, or one folder and optionally what is under it. Requires the current revision.	`content:write`
Restore file or folder`restore`	Bring back a deleted file or folder, using the revision it carries after the delete. A folder returns with everything deleted alongside it. Find deleted entries with list_directory's state filter (active, deleted, or all).	`content:write`
Begin file upload`begin_file_upload`	Start a direct upload and get a one-time target to send the bytes to. The way to move a real file.	`content:write`
Check upload status`get_file_upload`	Whether a transfer arrived, or why it failed. The signed target is disclosed only once, when the upload begins.	`content:write`
Complete file upload`complete_file_upload`	Finish an upload after the bytes are sent. This is what makes the file readable.	`content:write`
Cancel file upload`cancel_file_upload`	Abandon an upload and release its target instead of leaving the session open until it expires.	`content:write`
Create share link`create_share_link`	A link that grants access by possession. The secret is returned once, in that response only.	`sharing:write`
Publish`publish`	Make one file or folder readable by anyone at its permanent public address, view only. Not a versioned release and not a share link. Never a whole drive.	`sharing:readsharing:writecontent:read`
Unpublish`unpublish`	Take a published file or folder back, unless it is published through a parent — then the tool names the grant to revoke instead.	`sharing:readsharing:writecontent:read`

Worth knowing before you use them

Real files go through an upload, not inline content. create_artifact carries content in the tool call and is capped at 1 MiB, which suits a note or a small document. For anything larger, begin_file_upload returns a one-time target to send the bytes to, and complete_file_upload is what makes the result readable. An upload that is never completed does not appear in the drive.
Changing something requires its current revision. Replace, update, move and delete all take the revision they expect to be acting on, so two agents working at once cannot silently overwrite each other. A stale revision is refused, and the fix is to read the file again.
A share link secret is shown once. create_share_link returns the plaintext secret in that one response and never again.
The change feed is a cursor, not a search. list_changes returns a page and a cursor to resume from; keeping the cursor is what makes the next call cheap.

If something does not work

The client asks you to sign in again. An authorization is bound to one workspace and expires. Re-authorizing fixes both, and is also how you point the connection at a different workspace.
A tool you expected is missing. Its scopes were not granted — most often a connection authorized as Read only. Authorize again and choose Read and write.
No drives are listed. The workspace has no drives you have been granted yet. Create one — in the console or with create_drive — or ask whoever manages one to grant you access.
Anything else — write to [email protected].

Data handling

What AgentDrive stores, where it lives, and how long it stays is set out in the AgentDrive section of our privacy policy. The MCP server holds nothing of its own: it verifies your authorization, calls AgentDrive with it, and returns the result. Your credentials are never placed in a tool result or a log.

More about the product on the AgentDrive page.