Connect ShareFile to Claude: Manage User Access and Secure Sharing

If you need to connect ShareFile to Claude to automate user provisioning, audit folder permissions, or orchestrate secure document sharing, you need a Model Context Protocol (MCP) server. This infrastructure layer acts as the translation layer between Claude's natural language tool calls and ShareFile's complex REST APIs. You can either spend weeks building and maintaining this server yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on connecting ShareFile to ChatGPT or explore our broader architectural overview on connecting ShareFile to AI Agents.

Giving a Large Language Model (LLM) read and write access to an enterprise file sharing platform like ShareFile introduces severe engineering challenges. You have to handle rigid OAuth 2.0 token lifecycles, map generic item schemas to specific LLM tool definitions, and deal with strict API rate limits without silently dropping tasks. Every time a new metadata field or sharing protocol is introduced, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for ShareFile, connect it natively to Claude, and execute complex IT administration workflows using natural language.

The Engineering Reality of the ShareFile API

A custom MCP server is a self-hosted integration layer that translates an LLM's JSON-RPC tool calls into vendor-specific HTTP requests. While the open MCP standard provides a predictable way for models to discover capabilities, the reality of implementing it against ShareFile's API architecture is uniquely painful.

If you decide to build a custom MCP server for ShareFile, you own the entire lifecycle of the integration. Here are the specific challenges you will face with the ShareFile API:

Polymorphic Item Hierarchies ShareFile does not have flat file structures. Everything in ShareFile is an Item, which can dynamically represent a Folder, a File, a Note, a Link, or a SymbolicLink. When an LLM requests the contents of a directory, the API returns a heterogeneous collection of these items. Native LLMs struggle to differentiate between navigating a standard folder versus resolving a SymbolicLink (which often redirects to a different zone or SharePoint connector). You have to build custom logic in your MCP server to parse these polymorphic arrays and present a unified schema to Claude, otherwise, the model will hallucinate file paths or fail to navigate connectors.

Complex Access Control Architecture Permissions in ShareFile are heavily layered. A user's access is governed by their account-level Roles (e.g., CanManageUsers), policy-based administration rules, and item-level AccessControls. To tell Claude whether a specific user can view a file, you cannot simply query the user record. You must traverse the folder hierarchy and evaluate the effective AccessControl array at the file level. Writing the logic to expose this correctly to an LLM without causing massive token bloat requires aggressive response filtering.

Strict Rate Limiting and Backoff Delegation ShareFile enforces strict limits on API requests to prevent abuse. If your AI agent gets stuck in a loop recursively auditing a massive folder tree, ShareFile will rapidly return HTTP 429 Too Many Requests errors.

Important factual note on rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When an upstream API returns HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The caller (your MCP client or AI agent) is completely responsible for implementing retry and exponential backoff logic.

Instead of building token management, polymorphic schema parsing, and authentication from scratch, you can use Truto. Truto normalizes the authentication layer and exposes ShareFile's endpoints as ready-to-use MCP tools, allowing you to focus on agent logic.

How to Generate a ShareFile MCP Server with Truto

Truto's MCP servers feature turns any connected integration into an MCP-compatible JSON-RPC endpoint. Rather than hand-coding tool definitions, Truto derives them dynamically from ShareFile's API documentation and OpenAPI schemas. A tool only appears in the MCP server if it has a corresponding documentation entry - ensuring only curated, well-described endpoints are exposed to Claude.

Each MCP server is scoped to a single connected ShareFile tenant account. The generated URL contains a cryptographic token that securely identifies which account to use, meaning the URL alone is enough to authenticate and serve tools to Claude.

You can create this server in two ways.

Method 1: Via the Truto UI

For IT admins or one-off workflows, generating an MCP server via the dashboard is the fastest route.

1. Log into your Truto account and navigate to your connected ShareFile integration.
2. Click into the specific Integrated Account you want to expose to Claude.
3. Navigate to the MCP Servers tab.
4. Click Create MCP Server.
5. Configure your server. You can give it a name, restrict it to specific operations (e.g., read only), or limit it to specific tags (e.g., users, access_controls).
6. Copy the generated MCP server URL. You will never see the raw token again, so save this URL securely.

Method 2: Via the Truto API

For developers embedding Claude into their own products, you can generate MCP servers programmatically. This is ideal for spinning up temporary, isolated tool servers for specific user sessions.

Make an authenticated POST request to the Truto API:

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ShareFile Security Auditor Agent",
    "config": {
      "methods": ["read", "update"],
      "tags": ["access_controls", "users", "items"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The API evaluates the request, validates that tools exist for the requested filters, and returns a ready-to-use URL:

{
  "id": "mcp_abc123",
  "name": "ShareFile Security Auditor Agent",
  "config": {
    "methods": ["read", "update"],
    "tags": ["access_controls", "users", "items"]
  },
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

How to Connect the MCP Server to Claude

Once you have the Truto MCP server URL, connecting it to Claude requires zero additional coding. You can configure this via the Claude desktop application interface, or by editing the underlying configuration file.

Method A: Via the Claude UI

If you are using Claude Desktop:

1. Open Claude Desktop and navigate to Settings.
2. Click on Integrations (or Connectors depending on your build).
3. Select Add MCP Server or Add custom connector.
4. Paste the Truto MCP URL (https://api.truto.one/mcp/...) into the Server URL field.
5. Click Add or Save.

Claude will immediately ping the endpoint, perform the MCP handshake, and discover the ShareFile tools.

Method B: Via Manual Config File

If you prefer managing configurations as code or are connecting a custom agent framework, you can add the server directly to Claude's configuration file (e.g., claude_desktop_config.json).

Since Truto provides an SSE (Server-Sent Events) URL, you need to use the official MCP SSE transport adapter:

{
  "mcpServers": {
    "sharefile-admin": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Restart Claude Desktop. The model will parse the config, execute the SSE wrapper, and ingest the ShareFile tool schemas.

Hero Tools for ShareFile Automation

When you connect ShareFile via Truto, Claude gains access to dozens of documented REST endpoints. To prevent context window exhaustion, Truto maps query parameters and request bodies into clean, flat JSON schemas that LLMs can easily populate.

Here are the highest-leverage tools available for ShareFile:

list_all_share_file_items

Retrieves the folder hierarchy for the current user. Because ShareFile returns polymorphic objects (Folders, Files, Notes), this tool is essential for navigating the directory structure and finding specific Id values needed for downstream operations.

"List all the items in my root ShareFile folder. If you find a folder named 'Q3 Financials', give me its internal ID."

share_file_access_controls_bulk_set

Creates or updates multiple AccessControl entries for a single item. This is critical for RBAC automation, allowing Claude to assign specific CanUpload, CanDownload, or CanManagePermissions flags to users or distribution groups.

"Grant the user alice@example.com upload and download permissions to the folder with ID 'fo-12345'. Revoke her ability to delete files."

share_file_users_update_roles

Appends specific administrative roles to an existing ShareFile user. This is used to elevate privileges programmatically, such as granting a user CanCreateFolders or CanManageUsers.

"Update the roles for user ID 'u-9876' to include the CanUseFileBox and CanCreateFolders permissions."

share_file_shares_send

Distributes a secure Send Share containing specific items to a list of email addresses. This creates the Share object and emails the recipients in one action, optionally enforcing login requirements or expiration dates.

"Create a secure send share for the file ID 'fi-5555'. Send it to external.auditor@firm.com, require them to log in, and set the share to expire in 7 days."

share_file_items_get_info

Retrieves the effective access controls for a specific folder. Instead of just returning the raw ACL, this tool calculates exactly what the current user is allowed to do (e.g., CanAddNode, CanDeleteChildItems), which is vital for pre-flight security checks.

"Check the effective access information for folder 'fo-9999'. Tell me if the current authenticated context has permission to manage permissions on this folder."

share_file_items_bulk_download

Initiates a bulk download of multiple items from a parent folder. Instead of forcing the LLM to process massive binary streams, this tool returns a 302 redirect URL that points directly to a generated ZIP archive of the requested files.

"Generate a bulk download link for file IDs 'fi-111' and 'fi-222' inside the parent folder 'fo-333'. Give me the direct URL to the ZIP archive."

To view the complete inventory of ShareFile endpoints, schemas, and required parameters, visit the ShareFile integration page.

Workflows in Action

Once Claude is connected to ShareFile via Truto, you can combine these tools to execute complex, multi-step operations that would normally require manual clicks through the ShareFile web interface.

Scenario 1: Automating Secure Client Onboarding

When a new client signs a contract, IT needs to provision a secure workspace, configure strict access controls, and notify the client securely.

"Create a new top-level folder called 'Acme Corp Secure Drop'. Once created, grant john@acme.com upload and download access, but ensure he cannot delete files. Finally, send him a secure link to the folder that expires in 30 days."

How Claude executes this:

sequenceDiagram
    participant Claude as Claude Desktop
    participant Truto as Truto MCP Server
    participant Upstream as ShareFile API

    Claude->>Truto: Call tool: create_a_share_file_item (Name: "Acme Corp Secure Drop")
    Truto->>Upstream: POST /Items(parent_id)
    Upstream-->>Truto: Returns Folder ID (fo-123)
    Truto-->>Claude: Result: fo-123 created

    Claude->>Truto: Call tool: share_file_access_controls_bulk_set (Principal: john@acme.com, CanUpload: true, CanDelete: false)
    Truto->>Upstream: POST /Items(fo-123)/AccessControls/BulkSet
    Upstream-->>Truto: Success
    Truto-->>Claude: Result: Permissions applied

    Claude->>Truto: Call tool: share_file_shares_send (Items: fo-123, Emails: john@acme.com)
    Truto->>Upstream: POST /Shares
    Upstream-->>Truto: Success
    Truto-->>Claude: Result: Secure email dispatched

1. Claude calls create_a_share_file_item to build the directory.
2. Claude extracts the resulting Id and calls share_file_access_controls_bulk_set to apply the required permissions for the client email.
3. Claude calls share_file_shares_send to orchestrate the email delivery of the workspace link.

Scenario 2: Security Audit and Revocation

If a contractor leaves the company unexpectedly, a security analyst needs to locate their access, verify what files they could view, and instantly revoke their permissions across the environment.

"Find the user ID for contractor@agency.com. Check which shared folders they have access to. Once you have the list, completely remove their access controls from all those folders."

How Claude executes this:

flowchart TD
    A["User Prompt"] --> B["get_single_share_file_user_by_id<br>(query: contractor@agency.com)"]
    B --> C["share_file_users_get_all_shared_folders<br>(query: user ID)"]
    C --> D["share_file_access_controls_bulk_delete_for_principal<br>(body: array of folder IDs)"]
    D --> E["Return confirmation to user"]

1. Claude calls get_single_share_file_user_by_id searching for the email to retrieve the internal ShareFile user ID.
2. Claude calls share_file_users_get_all_shared_folders using the retrieved user ID to enumerate their access footprint.
3. Claude calls share_file_access_controls_bulk_delete_for_principal, passing the user ID and the array of folder IDs to instantly strip all permissions.

Security and Access Control

Giving an AI agent administrative rights to enterprise file storage is a massive security risk. Truto provides strict governance mechanisms on the MCP token itself to limit blast radius:

• Method Filtering: You can restrict the server configuration to methods: ["read"]. The MCP server will strictly refuse to generate or execute create, update, or delete tools, effectively making the AI agent read-only.
• Tag Filtering: You can scope the MCP server to specific resource tags. For example, setting tags: ["users"] ensures the LLM can only interact with identity endpoints, completely blocking access to file contents.
• API Token Authentication (require_api_token_auth): By default, possessing the MCP URL grants access. By enabling this flag, the client must also pass a valid Truto API session token in the headers, meaning a leaked URL cannot be abused by unauthenticated users.
• Automatic Expiration (expires_at): You can generate ephemeral MCP servers that automatically self-destruct after a set timeframe. Truto's durable alarms guarantee the token and configuration are purged from storage at the exact second of expiration.

The Smart Way to Automate File Infrastructure

Building a custom integration for ShareFile means wrestling with complex inheritance hierarchies, mapping custom metadata formats, and writing exponential backoff logic just to survive routine rate limits. Exposing this via an MCP server adds the burden of schema translation and context window management.

By using Truto, you offload the infrastructure entirely. The authentication, API proxying, tool generation, and security boundaries are fully managed. Your engineering team can focus on writing better agent prompts and designing robust business logic, rather than updating JSON schemas every time Citrix deprecates a ShareFile endpoint.