The read side is unremarkable and useful; the interesting choices are on the write side — a recoverable delete rather than a permanent one, and tokens encrypted at rest with a key you supply. That is the difference between a file tool you would let an agent use and one you would not.
An MCP server for Dropbox built on its public API. It is an independent project, not affiliated with or endorsed by Dropbox.
- Folders listed and files searched, so a path does not have to be known in advance
- File contents and file metadata read separately — the second is enough when you only need size, type or modification time
- Files uploaded and downloaded, folders created
- Items copied and moved within the account
- A safe delete that keeps the operation recoverable rather than removing outright
- Sharing links generated for a file
- Account information, for confirming which Dropbox the server is actually attached to
Register a Dropbox app with scoped access, grant it the permissions you intend to use (files.metadata.read, files.content.read, files.content.write, sharing.write, account_info.read) and add http://localhost as a redirect URI. Then clone, npm install, npm run build and npm run setup. Four environment variables are required: the app's key and its secret, the redirect URI, and a long key of your own for encrypting stored tokens. Authentication is OAuth with PKCE.