Summary

Read the warning at the top before you install it.

Box now runs a hosted server it supports, and this community one is frozen — new Box API surface will not appear here. What it still offers is a per-family documented tool inventory in the open, and self-hosted authentication modes the hosted route does not give you: client credentials grant, JWT, and running it inside your own network. Choose it deliberately for those reasons, not by default.

What it is

A self-hosted MCP server over the Box API, covering file and folder operations, search, collaboration, metadata, document generation, tasks and Box AI. Box has since shipped an officially supported hosted MCP server and asks people to migrate to it; this repository is marked discontinued and no longer maintained.

What you get

Box AI over your own content: `box_ai_ask_file_single_tool` for one document, `box_ai_ask_file_multi_tool` to compare several, `box_ai_ask_hub_tool` across a hub
Structured extraction from documents with `box_ai_extract_structured_using_template_tool` or `box_ai_extract_structured_using_fields_tool`, and open-ended extraction with `box_ai_extract_freeform_tool`
File work: `box_file_info_tool`, `box_file_upload_tool`, `box_file_download_tool`, `box_file_text_extract_tool`, plus copy, move, rename, delete, locking and retention dates
Folders and search: `box_folder_items_list_tool`, `box_folder_create_tool`, `box_search_tool`, `box_search_folder_by_name_tool`
Document generation from templates: `box_docgen_template_list_tool`, `box_docgen_create_batch_tool`, `box_docgen_get_job_by_id_tool`
Collaboration, tasks, metadata, shared links, users, groups and web links, each as its own documented tool family

Requirements

**Box asks you to migrate to its hosted MCP server** — that warning is the first thing in the README, and it is the right starting point for anyone choosing today. For this one: Box OAuth application credentials in `.env` (`BOX_CLIENT_ID`, `BOX_CLIENT_SECRET`, `BOX_REDIRECT_URL`), then `uv sync` and `uv run src/mcp_server_box.py`. The package is `mcp-server-box`. Transport and authentication are command-line choices — `--transport` accepts stdio, sse or http (default stdio, HTTP port 8005), `--box-auth-type` accepts oauth, ccg, jwt or mcp_client, and `--mcp-auth-type` accepts oauth, token or none; token mode reads `BOX_MCP_SERVER_AUTH_TOKEN`.

Setup effort

One command plus a key — uv sync, then supply credentials