Box MCP Server

Enterprise content is usually the last thing an agent can reach. It sits behind permissions, retention rules and audit requirements that make "just give the model an API key" a non-starter. Box's remote MCP server is the sanctioned route: a Box-hosted endpoint at https://mcp.box.com that exposes Box's content and AI features as MCP tools, with every call running inside the authenticated user's existing Box permissions rather than alongside them.

Nothing to deploy

This is a remote server, not a package you run. Clients connect over HTTP to mcp.box.com and authenticate with OAuth 2.0; Box operates the endpoint. Discovery metadata is published at /.well-known/oauth-protected-resource, with the authorization server described at api.box.com/.well-known/oauth-authorization-server. An administrator enables the integration in the Box Admin Console — or you register a custom OAuth app in the Developer Console — and grants the scopes the tools need (root_readwrite, ai.readwrite, and docgen.readwrite for document generation, which requires an Enterprise Advanced licence).

A genuinely large tool surface

Where most content-management servers stop at read-file and search, Box ships roughly sixty tools across eight groups. Files and folders cover the full lifecycle — read content and details, fetch preview and download URLs, upload new files and new versions, copy, move, rename and set metadata. Search spans keyword queries with metadata filters and SQL-like metadata search, plus folder lookup by name and inspection of enterprise metadata templates. Collaboration tools list and create comments, tasks, shared links and collaborations.

Box AI as tools, not just retrieval

The AI group is the part that changes what an agent can do. ai_qa_single_file, ai_qa_multi_file and ai_qa_hub answer questions across one document, many documents, or a whole Box Hub, with the retrieval happening inside Box. A family of extraction tools pulls structured metadata either freeform, from field definitions you supply, or from an existing metadata template, with enhanced agent-backed variants of each. Custom, default and Pro Box AI agents can be invoked directly, and Doc Gen tools generate documents in batches from templates.

Clients

Any standards-compliant MCP client works. Box documents Claude alongside GitHub Copilot, Microsoft Copilot Studio, Mistral's Le Chat, Glean and Azure API Center, and the server is listed in the GitHub MCP registry for discovery from VS Code. The reference implementation is MIT-licensed; use is governed by the Box Terms of Service.