Box MCP Server: Tools, Setup and Security

The Box MCP server lets an AI app search your Box content, read files, ask Box AI questions about documents and manage folders, metadata and hubs. Box publishes and hosts it at https://mcp.box.com. An admin must turn it on in the Box Admin Console before anyone can connect.

Checked against: Box MCP server docs on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

Box's available tools page groups tools and marks each one On or Off by default:

• Files and folders (read): get_file_content, get_file_details, get_folder_details, list_folder_content_by_folder_id and get_file_preview.
• Files and folders (write): upload_file, create_folder, copy_file and copy_folder are On. move_file, move_folder, upload_file_version and the update_* and set_* metadata tools are Off by default.
• Search: search_files_keyword, search_files_metadata and search_folders_by_name.
• Collaboration: list_file_comments, create_file_comment and list_tasks are On. add_file_shared_link, add_folder_shared_link, create_collaboration and update_collaboration are Off.
• Box AI: ai_qa_single_file, ai_qa_multi_file, ai_qa_hub and several ai_extract_* tools. Box says the Enhanced Extract versions cost more, and text tools process up to 1 MB of content.
• Hubs and Doc Gen: tools to list, create and copy hubs, and to work with Doc Gen templates.

who_am_i returns the signed-in Box user.

How to connect it

Box's setup guide starts in the Admin Console. To enable a predefined Box MCP server, an admin opens Integrations, filters Categories by MCP and sets the server's state to enabled.

For a custom MCP client, the admin configures the Box MCP server integration, clicks + Add Integration Credentials and copies the Client ID and Client Secret. The admin then enters the client's Redirect URI and selects Access Scopes. Box lists root_readwrite, ai.readwrite and docgen.readwrite. Box says docgen.readwrite needs an Enterprise Advanced license.

On the client side you supply the endpoint, the credentials and the MCP name box-remote-mcp. Box's sample API configuration is:

"mcp_servers": [
  {
    "type": "url",
    "url": "https://mcp.box.com",
    "name": "box-remote-mcp",
    "authorization_token": "<BEARER_TOKEN>"
  }
]

Box's guide also lists its OAuth authorization URL (https://account.box.com/api/oauth2/authorize) and token URL (https://api.box.com/oauth2/token).

Security notes

Box's design gives admins more control than most servers in this category. The default-off list covers the tools most likely to cause harm.

• Sharing risk. Box notes that creating a shared link or collaboration can expose content outside your organization. Those tools are off by default; leave them off unless you need them. Our page on data exfiltration explains why.
• Overwrites. upload_file_version replaces a file's contents, and update_metadata_template can remove fields.
• Scopes. root_readwrite is broad. Match scopes to the job.
• Permissions. Box's permission-aware access page covers identity and scopes. MCP does not bypass Box permissions.
• Document content as input. Files from outside parties can contain instructions aimed at the AI. See prompt injection.
• Box AI costs. The AI extract and Q&A tools are on by default, and Box says the Enhanced Extract tools cost more.

More guidance sits in the MCP security hub.

Alternatives

• Dropbox MCP server for files, Paper and Dropbox Sign.
• Google Workspace MCP servers for Drive, Docs and Sheets.
• Notion MCP server if your knowledge base lives in Notion.

Next step

Box is a good fit when legal, finance or HR teams keep sensitive files there and want AI help without loosening permissions. Decide which default-off tools you actually need before you enable anything. eSEOspace can review that plan in an MCP readiness audit, and more profiles are in the MCP server directory.

Frequently asked questions