Skip to main content Announcing Tool Policies: AI agent permissions down to the field Read the announcement
Live 124 Actions

Box MCP Server
for AI Agents

Connect your AI agent to StackOne's Box MCP server and give it 124 MCP tools out of the box. Auth, tool execution, and security all managed.

Box logo
Box MCP Server
Built by StackOne StackOne
DrataGPLocalyzeFlipMindtoolsScreenloop

Coverage

124 Agent Actions

Extend your agent's capabilities with custom actions.

Authentication

Agent Tool Authentication

Per-user OAuth in one call. Your Box MCP server gets session-scoped tokens with zero credentials stored on your infra.

Agent Auth →

Security

Agent Protection

Every Box tool response scanned for prompt injection in milliseconds, with 88.7% accuracy, all running on CPU.

Prompt Injection Defense →

Performance

Max Agent Context. Min Cost.

Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Box call.

Tools Discovery →

What is the Box MCP Server?

A Box MCP server lets AI agents work with Box data through the Model Context Protocol, Anthropic's open standard for connecting LLMs to external tools. StackOne's Box MCP server ships with 124 pre-built actions, fully extensible via the Connector Builder, plus managed authentication, prompt injection defense, observability, and agent execution runtime. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.

All Box MCP Tools

Every StackOne action for Box, ready for your agent. Scoped to exactly what you need.

Collaborations

  • Create Collaboration

    Add a collaborator (user or group) to a file or folder with a specific role (editor, viewer, previewer, uploader, previewer uploader, viewer uploader, co-owner). You can identify users by email (accessible_by.login) or user ID (accessible_by.id) — no need to look up the user ID first if you have their email. Cannot add the folder/file owner as a collaborator (returns 400). The is_access_only option is only supported for folder collaborations, not files. The expires_at option requires the enterprise admin to enable the "Automatically remove invited collaborators" setting.

  • Get Collaboration

    Retrieve details of a specific collaboration by its ID, including the collaborator (user or group), their role, the item (file or folder) they have access to, and the collaboration status. Use list_folder_collaborations or list_file_collaborations to find collaboration IDs.

  • Update Collaboration

    Update a collaboration's role or path visibility. Requires the authenticated user to be the folder owner, co-owner, or enterprise admin. Returns 403 if the user lacks permission to modify the collaboration.

  • Remove Collaboration

    Remove a collaboration, revoking the user's or group's access to the shared file or folder. Requires the collaboration_id, which can be obtained from list_folder_collaborations or list_file_collaborations.

Comments

  • Create Comment

    Add a comment to a file

  • Get Comment

    Retrieve information about a comment

  • Update Comment

    Update a comment's message

  • Delete Comment

    Remove a comment

Files

  • Copy File

    Copy a file to another folder

  • Upload File

    Uploads a new file to Box. This tool creates a new file in Box using the provided text content. The file name including the extension must be provided and the extension must match the file content. Markdown uploads (e.g. .md) are regular text files like any other supported extension. A parent folder ID can optionally be provided to determine where the new file should be created. The metadata details of the newly uploaded file are returned in response. If a file already exists with the same name, the tool will return an error. **Key Features:** - File creation with text content - Supported file extensions: txt, md, boxnote, html, svg, xml, csv, json, js, ts, py, sh - If the file extension is invalid, a .txt file will be created **Important:** This tool can only accept text content, to upload binary files, use the `get_upload_url` tool instead. To create a Box Note (.boxnote), use the `create_box_note` tool instead. <examples> Upload a file to Box: { "file_name": "example.md", "file_content": "#This is my example markdown file", "parent_folder_id": "0", } <output> { "content": [ { "type": "text", "text": "{"file_link": "https://example.app.box.com/file/123456789", "file_id": "123456789", "file_name": "example.md", "size": 100, "created_at": "2025-01-01T00:00:00Z"}" } ] } </output> </examples>

  • Copy File

    Copies an existing file to a destination folder in Box (see Box API Copy file). The source file is not modified. Provide `parent_folder_id` as the folder that will contain the new copy; use `"0"` for the user's root folder. The copy keeps the original file name, so the destination folder must not already contain an item with that name. To rename the copy, use the `update_file_properties` tool with the `file_id` returned by this tool. <examples> Copy a file into a folder: { "file_id": "123456789", "parent_folder_id": "987654321" } Copy a file to the user's root folder: { "file_id": "123456789", "parent_folder_id": "0" } </examples>

  • Upload File

    Upload a new file

  • Update File

    Update a file's name, description, parent folder (to move it), shared link, tags, or lock status. To lock a file, provide a lock object with access='lock'. Unlocking is not supported through this action — to unlock a file, use the Box web UI or the Box API directly.

  • Delete File

    Delete a file and move it to trash

File Versions

  • Upload File Version

    Upload a new version of an existing file by providing the file_id, base64-encoded file content (file_content), and a filename (file_name). All three parameters are required. For files up to 50MB only — use chunked upload for larger files.

  • Get File Version

    Retrieve a specific version of a file

  • List File Versions

    List all versions of a file

  • Delete File Version

    Delete a specific file version

File Comments

  • Create File Comment

    Creates a new comment on a specific file. This tool allows you to add comments to files for collaboration, feedback, or documentation purposes. Comments are visible to all users with access to the file and can be used for team communication and file annotation. The message can include special characters, line breaks, and Unicode characters. The tool returns complete comment information including metadata about the comment creation, author, and timestamps. <examples> Basic file comment: <input> { "file_id": "123456789", "message": "This document looks good overall. Please review the financial projections in section 3." } </input> Multi-line structured comment: <input> { "file_id": "777888999", "message": "Review Summary:\n\nContent: Excellent\nStructure: Well organized\nFormatting: Minor issues\nCitations: Missing sources\n\nOverall: Good work, please address the citations before final submission." } </input> </examples>

  • List File Comments

    List all comments on a specific file by its file_id. Use list_folder_items first to find the file_id if you only have the filename. Returns comment text, author, creation date, and reply information.

  • List File Comments

    Lists all comments on a specific file. Returns a paginated list of comments with configurable fields. Default fields (id, type, message, created_by, created_at) are always returned, but you can specify additional fields as needed. Supported fields include: id, type, message, created_at, created_by, modified_at, tagged_message, and any other comment-related fields supported by the Box API. Use pagination parameters (limit/offset) to handle files with many comments efficiently. <examples> Basic file comments listing: <input> { "file_id": "123456789", "limit": 50 } </input> List with specific fields: <input> { "file_id": "987654321", "fields": ["id", "message", "created_at", "created_by", "modified_at"], "limit": 100 } </input> Paginated comments listing: <input> { "file_id": "555666777", "fields": ["id", "type", "message", "tagged_message", "created_by"], "limit": 25, "offset": 50 } </input> </examples>

Folders

  • Create Folder

    Create a new folder

  • Copy Folder

    Copy a folder to another folder

  • Create Folder

    Creates new folders in Box. <examples> Create folder in root: <input> { "name": "Project Documents" } </input> Create folder in specific parent: <input> { "name": "Q4 Reports", "parent_folder_id": "123456789" } </input> </examples>

  • Copy Folder

    Copies an existing folder to a destination parent folder in Box (see Box API Copy folder). The source folder is not modified. Provide `parent_folder_id` as the folder that will contain the new copy; use `"0"` for the user's root folder. The root folder (`folder_id` `"0"`) cannot be copied. The copy keeps the original folder name, so the destination folder must not already contain an item with that name. To rename the copy, use the `update_folder_properties` tool with the `folder_id` returned by this tool. <examples> Copy a folder into another folder: { "folder_id": "123456789", "parent_folder_id": "987654321" } Copy a folder to the user's root: { "folder_id": "123456789", "parent_folder_id": "0" } </examples>

  • Update Folder

    Update a folder's information

  • Delete Folder

    Delete a folder and move it to trash

Groups

  • Create Group

    Create a new enterprise group with optional invitation and member visibility settings. Requires enterprise admin or co-admin role — the manage_groups OAuth scope alone is not sufficient, the authenticated user must have admin-level privileges in the Box Admin Console.

  • List Groups

    List all enterprise groups, optionally filtered by name prefix. Returns group IDs, names, and basic details. Use filter_term to search for groups whose name starts with a specific string. This is a read-only listing operation that requires manage_groups scope.

  • Get Group

    Retrieve detailed information about a specific group by its ID, including name, description, invitability_level, and member_viewability_level. Requires admin-level permissions or group membership — note this requires stronger permissions than list_groups, which may succeed even when get_group returns 403.

  • Update Group

    Update a group's name, description, invitation settings, or member visibility. Requires enterprise admin or co-admin permissions — the authenticated user must have admin-level privileges, not just manage_groups scope.

  • Delete Group

    Permanently delete an enterprise group. This action cannot be undone. Requires enterprise admin or co-admin permissions.

Group Memberships

  • List Group Memberships

    List all members of a specific group, including their user IDs, roles (member or admin), and membership IDs. The membership ID is needed for update_group_membership and remove_user_from_group operations.

  • Update Group Membership

    Update a user's membership in a group

Unified Groups

  • List Unified Groups

    List unified groups in Box.

  • Get Unified Group

    Get a unified Box group by ID.

Unified Organizations

  • List Unified Organizations

    List unified organizations in Box.

  • Get Unified Organization

    Get a unified Box organization by ID.

Unified Roles

  • List Unified Roles

    List unified roles in Box.

  • Get Unified Role

    Get a unified Box role by ID.

Unified Users

  • List Unified Users

    List unified users in Box.

  • Get Unified User

    Get a unified Box user by ID.

Tasks

  • Create Task

    Create a review or completion task on a file. The task is created unassigned — use assign_task afterwards to assign it to users. Accepts an optional due date in ISO 8601 format (e.g. "2025-12-31T23:59:00+00:00"). Use +00:00 for UTC timezone offset, not -00:00.

  • List Tasks

    Lists all tasks associated with a specific file. This tool retrieves task information including task details, message, status, and completion rule, due date from the Box platform. Tasks in Box are used to assign work to users on files, allowing for collaboration and workflow management. This tool provides access to all tasks assigned to a particular file, helping with project management and task tracking. The response includes comprehensive task details such as task type, assignee information, due dates, completion status, and any associated comments or messages. <examples> List tasks for a file: <input> { "file_id": "1234567890" } </input> </examples>

  • Get Task

    Retrieve information about a task

  • Update Task

    Update a task's message, due date, action type, or completion rule. Every update body must include message, so pair it with any other field being changed. Assign at least one user before changing completion_rule.

  • Delete Task

    Remove a task

Metadata Templates

  • Create Metadata Template

    Creates a new enterprise metadata template. scope must be "enterprise"; each field needs type, key, and display_name. Optional template_key, hidden, copy_instance_on_item_copy, enum/multiSelect/taxonomy. Enum color_id optional (0=Yellow, 1=Orange, 2=Red, 3=Purple, 4=LightBlue, 5=DarkBlue, 6=Green, 7=Grey); omit for default Yellow (0). SDK create sends keys only; non-default colors are PATCHed after create when color_id is set. On success returns created template JSON (or JSON after color PATCH). If color PATCH fails, response still succeeds with colorApplyWarning. <examples> Minimal template with one string field: <input> { "scope": "enterprise", "display_name": "Sample contract template", "template_key": "sampleContract", "fields": [ { "type": "string", "key": "Name", "display_name": "Name" } ] } </input> <output> { "id": "f7a9891f", "scope": "enterprise_12345", "templateKey": "sampleContract", "displayName": "Sample contract template", "hidden": false, "fields": [ { "type": "string", "key": "Name", "displayName": "Name" } ] } </output> Enum field with classification colors (color_id optional per option): <input> { "scope": "enterprise", "display_name": "Data classes", "template_key": "dataClasses", "fields": [ { "type": "enum", "key": "tier", "display_name": "Tier", "options": [ { "key": "Public", "color_id": 6 }, { "key": "Internal", "color_id": 4 }, { "key": "Restricted", "color_id": 2 } ] } ] } </input> </examples>

  • Create Metadata Template

    Create an enterprise metadata template that can then be applied to files and folders.

  • List Metadata Templates

    Lists available Box metadata templates so you can discover scope and templateKey for search_files_metadata. Use this first to find templates, then get_metadata_template_schema to get field keys. Call with scope "enterprise" for your org's templates or "global" for Box global templates.

  • List Metadata Templates

    List all metadata templates

  • Get Metadata Template

    Retrieve a metadata template

Hubs

  • Create Hub

    Creates new collaborative hubs for organizing content around specific topics, projects, or teams. Enables the establishment of new collaborative workspaces with customizable titles and descriptions. This tool is essential for setting up new collaborative spaces where teams can organize, share, and work together on related content. Hubs serve as central gathering points for all materials related to a particular initiative or project. **Key Features:** - Creates new hubs with custom titles and optional descriptions - Establishes collaborative workspaces for team projects - Returns complete hub information upon successful creation - Supports both minimal (title-only) and detailed hub creation <examples> Create a simple hub with title only: <input> { "title": "Marketing Team Hub" } </input> </examples>

  • Copy Hub

    Creates a copy of an existing Box Hub via the Hubs v3 API (`POST /v3/hubs/{id}:copy`). The source hub is not modified. Copies the source hub's description (unless overridden) and shareable items into the new hub by setting `includeItems` to `true`. **Important:** Only items the user has permission to share into the new hub are copied. Items the user can view only through the hub itself (without share permission) are not copied. **hub_id** (required): The source hub to copy. Use `list_hubs` to find hubs and match by `title` to obtain the `id`, or take the id from the hub URL (`/hubs/{id}`). **title** (optional): Title for the new hub (max 50 characters). **description** (optional): Description for the new hub. When omitted, the source hub description is copied. <examples> Copy a hub, supplying a new title: { "hub_id": "12345", "title": "Research hub (copy)" } Copy using only the hub id (minimal body): { "hub_id": "12345" } </examples>

  • List Hubs

    Lists all hubs accessible to the current user with pagination support. Provides an overview of available collaborative workspaces and their basic information. Hubs in Box are collaborative workspaces that organize content around specific topics, projects, or teams. This tool helps discover what hubs you have access to, making it easy to find the right collaborative space for your work. **Key Features:** - Lists all accessible hubs for the authenticated user - Supports pagination with configurable limits and markers - Returns essential hub information including ID, type, and title - Efficient retrieval with adjustable result limits (1-1000) <examples> List all accessible hubs with default settings: <input> { "limit": 50 } </input> List hubs with custom pagination: <input> { "limit": 30, "marker": "next_marker_from_previous_response" } </input> </examples>

File Metadata Instances

  • Create File Metadata Instance

    Apply a metadata template instance to a file. Requires the file_id, scope (e.g. 'enterprise_1452824910' or 'global'), template_key, and a metadata object with field values. Even if all template fields are optional, the metadata object must contain at least one key-value pair — an empty object {} is rejected with 400 Bad Request. Returns 409 Conflict if this template is already applied to the file (use update_file_metadata to modify existing metadata).

  • List File Metadata Instances

    List all metadata instances on a file

  • Get File Metadata Instance

    Retrieve a specific metadata instance on a file

  • Update File Metadata Instance

    Update a metadata instance on a file

  • Delete File Metadata Instance

    Remove a metadata instance from a file

Folder Metadata Instances

  • Create Folder Metadata Instance

    Apply a metadata template instance to a folder. Requires the folder_id, scope, template_key, and a metadata object with at least one key-value pair. Returns 409 Conflict if this template is already applied to the folder — use update_folder_metadata to modify existing metadata, or delete_folder_metadata first to remove and re-apply.

  • Get Folder Metadata Instance

    Retrieve a specific metadata instance on a folder

  • List Folder Metadata Instances

    List all metadata instances on a folder

  • Update Folder Metadata Instance

    Update a metadata instance on a folder

  • Delete Folder Metadata Instance

    Remove a metadata instance from a folder

Task Assignments

  • List Task Assignments

    List assignments for a task

  • Get Task Assignment

    Retrieve information about a task assignment

  • Update Task Assignment

    Update a task assignment's resolution state or message. For review-type tasks, resolution_state (approved or rejected) is required — sending only a message without resolution_state returns 403. Only the task creator, the assignee, or enterprise admins can update an assignment.

  • Delete Task Assignment

    Remove a task assignment

Users

  • Create User

    Create a new managed user account in the enterprise. Requires enterprise admin or co-admin role with manage_managed_users scope. The login email must use a real domain (not @example.com). Returns 403 Forbidden if the authenticated account lacks admin privileges.

  • Get User

    Retrieve information about a user

  • Update User

    Update a user's information

  • Delete User

    Delete a user from the enterprise

User Avatars

  • Get User Avatar

    Retrieve a user's avatar image. Returns 404 if no custom avatar has been uploaded, even when the user profile contains an avatar_url field (which points to a default placeholder until a real image is uploaded). Use this to check whether a user has a custom profile picture.

  • Delete User Avatar

    Delete a user's avatar image

Webhooks

  • List Webhooks

    Retrieve all webhooks for the authenticated application

  • Get Webhook

    Retrieve a specific webhook by ID

Other (47)

  • Add User To Group

    Add a user to an enterprise group as a member or admin. Requires enterprise admin or co-admin permissions. Provide the user ID and group ID as nested objects. Returns 403 if the authenticated account lacks admin-level privileges for group membership management.

  • Add Items To Hub

    Adds files, folders, or web links to a specific hub, enabling content organization within collaborative workspaces. Essential for building and curating hub content by adding relevant materials to the collaborative space. This tool enables the population of hubs with relevant content, making it easy to organize materials within collaborative workspaces. You can add multiple items at once, supporting efficient hub content management and organization. **Key Features:** - Adds multiple items (files, folders, web links) to hubs in a single operation - Supports batch operations for efficient content organization - Works with all Box content types: files, folders, and web links - Provides confirmation of successful additions with detailed results **Supported Item Types:** - `file`: Box files of any type - `folder`: Box folders and their contents - `web_link`: External web links and bookmarks <examples> Add a single file to a hub: <input> { "hub_id": "12345", "items": [ {"id": "98765", "type": "file"} ] } </input> Add multiple items to a hub: <input> { "hub_id": "12345", "items": [ {"id": "98765", "type": "file"}, {"id": "54321", "type": "folder"}, {"id": "11111", "type": "web_link"} ] } </input> Add resources to a team hub: <input> { "hub_id": "55555", "items": [ {"id": "111111", "type": "folder"}, {"id": "222222", "type": "web_link"}, {"id": "333333", "type": "file"} ] } </input> </examples>

  • Create Box Note

    Creates a new Box Note in Box from markdown content. A Box Note is Box's native collaborative document format (.boxnote). The note name must be provided; the .boxnote extension is optional and will be appended if missing. **Key Features:** - Creates a native Box Note from markdown content - Use this tool instead of `upload_file` whenever the desired output is a Box Note **Important:** This tool only creates Box Notes. To create other text files (e.g. .txt, .md), use the `upload_file` tool instead.

  • Create Upload Session

    Create a chunked upload session for large files

  • List Pending Collaborations

    List all pending collaborations for a user

  • List Group Collaborations

    List all file and folder collaborations for a specific group, showing what content the group has access to and with what role. Requires enterprise admin or co-admin permissions — having manage_groups scope alone is not sufficient, the authenticated user must also have admin-level privileges in the Box Admin Console.

  • List Folder Collaborations

    List all collaborations on a folder, showing which users and groups have access and their roles (editor, viewer, co-owner, etc.). Returns both pending and active collaborations. Use the collaboration_id from the response for update_collaboration or delete_collaboration operations.

  • List File Collaborations

    List all collaborations on a file, showing which users and groups have access and their roles. Returns both pending and active collaborations. Use the collaboration_id from the response for update_collaboration or delete_collaboration operations.

  • Get User And Enterprise Events

    List user and enterprise events

  • Get File Information

    Retrieve information about a file

  • Get File Thumbnail

    Retrieve a thumbnail of a file

  • Search

    Search Box for files, folders and web links by name or content.

  • List File Tasks

    List tasks on a file

  • Get Trashed File

    Retrieve information about a file in trash

  • List Folder Items

    List items in a folder. Use folder_id "0" to list items in the root folder.

  • Get Folder Information

    Retrieve information about a folder

  • Get Trashed Folder

    Retrieve information about a folder in trash

  • List Trashed Items

    List all items in trash

  • Get Unified Credentials

    Get the current Box connection's unified credentials and identity.

  • List Unified Resource Types

    List unified resource types in Box.

  • List Unified Resource Users

    List unified resource users in Box.

  • Search Folders By Name

    Searches for folders by name within Box using keyword matching. This tool helps locate specific folders by their names and can be scoped to search within a particular parent folder. Returns basic folder information including ID, type, and name for each matching folder. The search performs a keyword-based match against folder names and can be limited to search within a specific ancestor folder. This is particularly useful for navigating complex folder structures, finding project folders, or locating organizational folders by name patterns. The tool uses Box's search API with folder type filtering, ensuring only folders (not files) are returned in results. Search results are limited to preserve performance and can be paginated using the limit parameter. **Date Range Filters:** Date range filters properties of the input schema: created_at_range, updated_at_range, deleted_at_range. Use comma-separated RFC3339 timestamps. **Format:** "start_date,end_date" where: - Omit start date to search all folders before end date: ",2023-12-31T23:59:59Z" - Omit end date to search from start date to the present: "2023-01-01T00:00:00Z," - Both dates for specific range: "2023-01-01T00:00:00Z,2023-12-31T23:59:59Z" <examples> Basic folder search: <input> { "folder_name": "Project Documents", "limit": 30 } </input> Search within specific parent folder: <input> { "folder_name": "2024 Reports", "ancestor_folder_id": "123456789", "limit": 50 } </input> Search for folders with partial name match: <input> { "folder_name": "Finance", "limit": 20 } </input> Limited results search: <input> { "folder_name": "Marketing Campaign", "ancestor_folder_id": "987654321", "limit": 10 } </input> Search in root directory and limit results by date: <input> { "folder_name": "Shared Resources", "created_at_range": "2023-01-01T00:00:00Z,2023-12-31T23:59:59Z" } </input> </examples>

  • List Folder Content

    Lists files, folders, and web links contained in a folder. Returns a paginated list of items with at least fields. Fields (id, type, name, etag) are always returned. Use folder_id "0" for the root folder. Supported fields include: id, type, name, etag, sequence_id, sha1, content_created_at, content_modified_at, created_at, created_by, modified_at, modified_by, owned_by, parent, path_collection, size, trashed_at, item_status, description, shared_link, classification, comment_count, disposition_at, expires_at, extension, has_collaborations, is_accessible_via_shared_link, is_associated_with_app_item, is_externally_owned, is_package, lock, metadata, permissions, representations, shared_link_permission_options, tags, uploader_display_name, version_number, watermark_info, file_version. <examples> Basic folder listing: <input> { "folder_id": "0", "limit": 50 } </input> List with specific fields: <input> { "folder_id": "123456789", "fields": ["id", "name", "type", "size", "modified_at", "created_by"], "limit": 100 } </input> Paginated listing: <input> { "folder_id": "987654321", "fields": ["id", "name", "type", "path_collection"], "limit": 30, "offset": 60 } </input> </examples>

  • Search Files By Keyword

    Searches for files using keywords and supports metadata filters, file extension filtering (without dots), and field selection. Maps to Box's searchForContent API with comprehensive filtering capabilities. The response always includes core fields: id, name, description, type, and size. Each entry also includes `url` (Box web link for files and folders; web links use the API `url` when returned). The 'fields' parameter allows you to request additional fields beyond these core ones. All requested fields (core + additional) will be included in the API request and returned in the response. **Available Additional Fields:** fileVersion, sha1, contentCreatedAt, contentModifiedAt, createdAt, createdBy, modifiedAt, modifiedBy, ownedBy, parent, pathCollection, purgedAt, sharedLink, size, trashedAt, classification, commentCount, dispositionAt, expiresAt, extension, hasCollaborations, isAccessibleViaSharedLink, isAssociatedWithAppItem, isExternallyOwned, isPackage, lock, metadata, permissions, representations, sharedLinkPermissionOptions, tags, uploaderDisplayName, watermarkInfo **Date Range Filters:** Date range filters properties of the input schema: created_at_range, updated_at_range, deleted_at_range. Use comma-separated RFC3339 timestamps. **Format:** "start_date,end_date" where: - Omit start date to search all items before end date: ",2023-12-31T23:59:59Z" - Omit end date to search from start date to the present: "2023-01-01T00:00:00Z," - Both dates for specific range: "2023-01-01T00:00:00Z,2023-12-31T23:59:59Z" <examples> Basic keyword search (returns core fields only): <input> { "query": "contract agreement", "limit": 50 } </input> Advanced search with additional fields: <input> { "query": "quarterly report", "file_extensions": ["pdf", "docx"], "ancestor_folder_id": "123456789", "fields": ["createdAt", "modifiedAt", "size", "createdBy"] } </input> Searching by date: <input> { "query": "quarterly report", "file_extensions": ["pdf", "docx"], "ancestor_folder_id": "123456789", "created_at_range”: "2023-01-01T00:00:00Z,2023-12-31T23:59:59Z", "fields": ["createdAt"] } </input> Search with metadata filters and additional fields: <input> { "query": "invoice", "file_extensions": ["pdf"], "limit": 30, "fields": ["contentCreatedAt", "pathCollection", "metadata"], "mdfilters": [ { "scope": "enterprise", "templateKey": "invoiceTemplate", "filters": { "amount": { "gt": 1000, "lt": 5000 }, "status": "approved", "department": "finance" } } ] } </input> Multi-template metadata search with custom fields: <input> { "query": "project document", "fields": ["modifiedBy", "sharedLink", "tags", "permissions"], "mdfilters": [ { "scope": "enterprise", "templateKey": "projectTemplate", "filters": { "priority": "high", "deadline": { "gt": "2024-01-01" } } }, { "scope": "global", "templateKey": "reviewTemplate", "filters": { "reviewer": "[email protected]" } } ] } </input> </examples>

  • Get File Content

    Get the text content of a file from Box. Prefers the markdown representation (preserves document structure for better LLM use) and falls back to extracted text when markdown is not available. If neither representation is available or both are still pending, an error is returned. Using this tool is preferred over the ai_qa_single_file tool since it is faster and more efficient. Works for files with text representations such as PDFs, documents, spreadsheets, presentations, code, etc. Optional version_id reads a past version (GET /files/{file_id}/versions/{version_id}); omit it for the current version. Use list_file_versions to get version_id values. **Key Features:** - Markdown representation preferred (structure preserved for LLMs); fallback to extracted text - Optional version_id for a past file version - 50MB file size limit enforcement - Clear error messages for unsupported operations <examples> Extract text content from a file: { "file_id": "123456789", } Extract text content from a past file version: { "file_id": "123456789", "version_id": "987654321", } <output> { "content": [ { "type": "text", "text": "This is the extracted text content from the file..." } ] } </output> </examples>

  • Get File Details

    Gets comprehensive file information from Box. Returns essential fields by default (id, name, extension, createdBy, modifiedBy, createdAt, modifiedAt). Use 'fields' parameter to request additional properties. **Common useful fields:** size, description, tags, metadata, permissions, shared_link, parent, path_collection, file_version, sha1, lock, classification, comment_count, has_collaborations, representations, watermark_info, uploader_display_name, content_created_at, content_modified_at, item_status, expires_at, trashed_at. <examples> Basic file info: <input>{"file_id": "123456789"}</input> File with metadata and permissions: <input> { "file_id": "987654321", "fields": ["id", "name", "size", "permissions", "tags", "metadata", "shared_link"] } </input> Detailed file analysis: <input> { "file_id": "555666777", "fields": ["id", "name", "description", "file_version", "sha1", "path_collection", "classification", "comment_count", "has_collaborations"] } </input> </examples>

  • Get Folder Details

    Retrieves comprehensive information about a folder in Box. Returns essential fields by default (id, name, createdBy, modifiedBy, createdAt, modifiedAt). Use 'fields' parameter to request additional properties. **Common useful fields:** size, description, tags, metadata, permissions, shared_link, parent, path_collection, folder_upload_email, has_collaborations, allowed_invitee_roles, can_non_owners_invite, can_non_owners_view_collaborators, is_collaboration_restricted_to_enterprise, classification, allowed_shared_link_access_levels, content_created_at, content_modified_at, item_status, sync_state, watermark_info, trashed_at. **Note:** Only request 'item_collection' when the user explicitly asks for folder contents. Use 'list_folder_content_by_folder_id' for browsing folder items instead. <examples> Basic folder info: <input>{"folder_id": "123456789"}</input> Folder with permissions and collaboration settings: <input> { "folder_id": "987654321", "fields": ["id", "name", "size", "permissions", "can_non_owners_invite", "has_collaborations"] } </input> Detailed folder analysis with settings: <input> { "folder_id": "555666777", "fields": ["id", "name", "description", "path_collection", "folder_upload_email", "allowed_invitee_roles", "classification", "shared_link", "tags"] } </input> </examples>

  • List Item Collaborations

    Lists all collaborations for multiple files and folders in a single request. This tool efficiently aggregates collaboration information across different item types, making multiple API calls as needed and providing comprehensive results with error handling for items that cannot be accessed. The tool processes up to 10 items simultaneously, handling both files and folders. It returns detailed collaboration information including user details, roles, status, and timestamps. Partial failures are handled gracefully - if some items fail to load, the tool still returns collaborations for successful items along with error details for failed requests. <examples> Basic file collaboration listing: <input> { "items": [ { "id": "123456789", "type": "file" } ] } </input> Single folder collaboration listing: <input> { "items": [ { "id": "987654321", "type": "folder" } ] } </input> Multiple items for bulk analysis: <input> { "items": [ { "id": "111222333", "type": "file" }, { "id": "444555666", "type": "file" }, { "id": "777888999", "type": "folder" }, { "id": "101112131", "type": "folder" } ] } </input> </examples>

  • Get Metadata Template Schema

    Returns the schema for a metadata template. Shield template "securityClassification-6VMVochwUWo": option colorID is normalized from staticConfig (default Yellow=0). Palette: 0=Yellow, 1=Orange, 2=Red, 3=Purple, 4=LightBlue, 5=DarkBlue, 6=Green, 7=Grey.

  • Search Files By Metadata

    Searches for files using SQL-like metadata queries. Requires: from (e.g. enterprise_123456.templateKey from list_metadata_templates), fields (field keys from get_metadata_template_schema). ancestor_folder_id defaults to "0" (root) if omitted. Use list_metadata_templates and get_metadata_template_schema first to discover templates and field keys.

  • Get Hub Details

    Retrieves comprehensive information about a specific hub including metadata, creation details, and administrative information. Provides complete hub context for understanding ownership, timing, and purpose. This tool is essential for understanding hub context, ownership, and management information. It provides the complete picture of a hub's properties, helping users understand when it was created, by whom, and its current status. **Key Features:** - Retrieves detailed hub information including title, description, and metadata - Provides creation and modification timestamps - Shows hub ownership and creator information - Returns complete hub context for administrative and management purposes <examples> Get detailed information about a specific hub: <input> { "hub_id": "12345" } </input> </examples>

  • Get Hub Items

    Retrieves all items within a specific hub including files, folders, and web links. Essential for exploring the contents of collaborative workspaces and understanding what resources are available in a hub. This tool provides comprehensive access to hub contents with pagination support, allowing you to browse through all materials that have been added to a collaborative workspace. Perfect for content discovery and hub content management. **Key Features:** - Retrieves all items (files, folders, web links) within a specific hub - Supports pagination for hubs with large amounts of content - Returns detailed item information including names, types, and IDs - Configurable result limits for efficient data retrieval <examples> Get items in a specific hub: <input> { "hub_id": "12345" } </input> Get hub items with pagination: <input> { "hub_id": "67890", "limit": 50, "marker": "next_marker_value" } </input> Get first 25 items from a hub: <input> { "hub_id": "11111", "limit": 25 } </input> </examples>

  • Get File Preview

    Displays an interactive preview widget for a Box file directly in chat. Supports: ai, bmp, cr2, crw, csv, dng, doc, docx, dwg, eml, eps, gdoc, gif, gsheet, gslide, gslides, heic, htm, html, idml, indd, indt, inx, jpeg, jpg, key, nef, numbers, odp, ods, odt, pages, pdf, png, ppt, pptx, ps, psd, raf, raw, rtf, svg, svs, tga, tif, tiff, tsv, webp, wpd, xhtml, xls, xlsm, xlsx. PDF uses direct download; other types use the appropriate representation (e.g. PDF for documents, JPG/PNG for images). Use when user wants to view file contents without downloading. For file metadata, use get_file_info instead. If the preview payload would exceed 3MB (full file for PDFs; generated representation for other types), do not use this. Do not attempt to generate an interactive artifact. When a preview is open, the widget sends file preview context (fileId, fileName, currentPage) into the conversation. If the user asks about "this graph", "explain this", "what's on this page", or similar, look for that context and call get_preview_page(fileId, currentPage) to fetch the page image—do not ask the user which page they are on.

  • Get Preview Page

    Use when user asks follow-up question to a file previewed with get_file_preview ("Explain this...", "What does ____ mean?")Returns the current preview page as an image so you can analyze it (figures, text, charts, etc.). You cannot see the page content until you call this tool. Required workflow: 1. Find the file preview context in the conversation. The preview widget sends it as content like: "Current file preview: fileId=123, fileName=doc.pdf, currentPage=3. Use get_preview_page with this fileId and currentPage...". Look for this before calling. 2. Extract fileId and currentPage from that context. If the user asks about "this page", "these figures", "what's on the page", use currentPage from the context. If they name a page (e.g. "page 7"), use that number instead. 3. Call get_preview_page(fileId, currentPage) to fetch the page image. You must call this tool to see the page—there is no other way to view its content. 4. Use the returned image to answer the user's question. Do not call with a fileId or page from elsewhere. If no file preview context is present (no "Current file preview: fileId=..." in the conversation), do not call. Supported extensions: ai, bmp, cr2, crw, csv, dng, doc, docx, dwg, eml, eps, gdoc, gif, gsheet, gslide, gslides, heic, htm, html, idml, indd, indt, inx, jpeg, jpg, key, nef, numbers, odp, ods, odt, pages, pdf, png, ppt, pptx, ps, psd, raf, raw, rtf, svg, svs, tga, tif, tiff, tsv, webp, wpd, xhtml, xls, xlsm, xlsx.

  • Query By Metadata

    Search for files and folders that have specific metadata values applied. This is a read-only search/query tool — it does NOT create, update, or delete metadata. Use create_file_metadata, update_file_metadata, or delete_file_metadata for write operations. Uses SQL-like syntax to filter by metadata field values.

  • Get Current User

    Retrieve the profile of the currently authenticated user, including their user ID, name, email, avatar URL, and enterprise info. Does not require admin permissions — any authenticated user can call this. Use this to get the current user's ID when you need it for other operations.

  • List Enterprise Users

    List all enterprise users with their IDs, names, and email addresses. Requires enterprise admin or co-admin permissions with manage_managed_users scope. Use filter_term to search by name or email prefix. Use user_type to filter by managed, external, or all users. If you already have a user's email address (e.g. for task assignment), you can pass it directly to assign_task via assign_to.login instead of looking up their user ID here.

  • Remove User From Group

    Remove a user from a group

  • Unlock File

    Remove the lock from a file so other users can move, rename or change it again.

  • Promote File Version

    Promote a previous file version to be the current version

  • Restore File Version

    Restore a previously deleted file version from the file's version history. This does NOT restore files from the trash — use restore_file for that. Requires the file_id and the file_version_id of the deleted version (obtainable from list_file_versions). Only works on premium Box accounts that support version tracking.

  • Restore File From Trash

    Restore a file from trash

  • Permanently Delete File

    Permanently delete a trashed file

  • Restore Folder From Trash

    Restore a folder from trash

  • Permanently Delete Folder

    Permanently delete a trashed folder

  • Who Am I

    Returns detailed information about the currently authenticated Box user. This tool provides comprehensive user profile data including basic identification, contact information, role details, and account settings. No input parameters are required as it retrieves information for the authenticated user making the request. This tool is essential for understanding the current user context, verifying authentication status, and obtaining user-specific information for personalization or access control purposes. It's particularly useful when building user-aware applications or when you need to identify the current user's permissions and organizational role. The response includes core user attributes such as ID, name, email, login, role, job title, and additional account details like space usage, language preferences, and timezone settings. <examples> Get current user information: <input> {} </input> </examples>

  • Assign Task

    Assign a task to a user by user ID or email address. The user receives a notification. You can use either assign_to.id (user ID) or assign_to.login (email address) — you do not need to look up the user ID first if you already have their email.

Set Up Your Box MCP Server in Minutes

One endpoint. Any framework. Your agent is talking to Box in under 10 lines of code.

Agent Frameworks

Claude Desktop
{
  "mcpServers": {
    "stackone": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote@latest",
        "https://api.stackone.com/mcp?x-account-id=<account_id>",
        "--header",
        "Authorization: Basic <YOUR_BASE64_TOKEN>"
      ]
    }
  }
}

Check More Cloud Storage MCP Servers

Box MCP Server FAQ

Does StackOne have a Box MCP server?
Yes. StackOne offers a managed Box MCP server with 124 pre-built actions, and every action is tested and QA'd by StackOne. Connect it to Claude, Cursor, and any other MCP client, or to any agent framework through the AI Action SDK. It ships with managed agent authentication, prompt injection defense, and tool discovery with server-side execution that preserve your agent's context window and keep reasoning performance.
Box MCP server vs direct API integration: what's the difference?
A Box MCP server and direct API integration serve different use cases. Direct API integration is for software-to-software work, where backend code calls Box. A Box MCP server is for AI agents that discover and call Box at runtime, such as MCP clients like Claude and Cursor, plus framework agents built with OpenAI, LangChain, or Vercel AI. StackOne provides both.
How does Box authentication work for AI agents?
Box authentication for AI agents works through a StackOne Connect Session. Create one via the dashboard or the SDK to get an auth link and ready-to-paste config for Claude Desktop, Cursor, and other MCP clients. Your user authenticates their own Box account; StackOne handles token exchange, storage, and refresh. Credentials never reach the LLM, and each user is isolated via origin_owner_id.
Are Box MCP tools vulnerable to prompt injection?
Yes. Box MCP tools can be vulnerable to indirect prompt injection. Any tool that reads user-written content, such as documents, messages, tickets, records, or free-text fields, is a potential vector. StackOne Defender scans every tool response before it enters the agent's context. It runs regex patterns in ~1ms, then a MiniLM classifier in ~4ms. Accuracy is 88.7%, and it runs entirely on CPU.
What is the context bloat of a Box agent and how do I avoid it?
Context bloat happens when Box tool schemas and API responses eat your Box agent's memory, preventing it from reasoning effectively. A single Box query can return a massive JSON response, and connecting multiple tools compounds the problem. Tools Discovery reduces it by loading only the tools relevant to each query.
Can I limit which actions my Box agent can access?
Yes. You can limit which actions your Box agent can access directly from the StackOne dashboard. Toggle actions on or off, or restrict them to specific accounts, with no code changes to your agent. Session tokens can be scoped to exact actions so if one leaks, exposure stays contained.
Can I create custom agent actions for my Box MCP server?
Yes. You can create custom agent actions for your Box MCP server using Connector Builder. It's an integration agent your coding assistant (Claude Code, Cursor, or Copilot) can invoke to research Box's API, generate production-ready connector YAML, test against the live API, and validate before you ship.
When should I NOT use a Box MCP server?
Skip a Box MCP server if your integration is purely software-to-software, because direct Box API integration is simpler when no AI agent is involved. For deterministic, compliance-critical operations (financial transactions, regulatory reporting), direct API gives you predictable behavior without agent-driven decision-making. MCP shines when AI agents need to dynamically discover and call Box actions at runtime.
What AI frameworks and AI clients does the StackOne Box MCP server support?
The StackOne Box MCP server supports both. MCP clients (paste-and-go apps): Claude Desktop, Claude Code, Cursor, VS Code, Goose. Agent frameworks (code SDKs you build with): OpenAI Agents SDK, Anthropic, Vercel AI, Google ADK, CrewAI, Pydantic AI, LangChain, LangGraph, Azure AI Foundry.

Put your AI agents to work

Connect AI to every company system and control what it can do in each one, down to the field.