Box Community MCP Server
box-communityLABSCO SUMMARY
The admin gate is the feature, not the friction.
Box holds the documents companies worry about most, and an endpoint anyone could connect a model to would be a governance problem. Making it an Admin Console switch with explicit scopes means enabling MCP is a deliberate act with a named owner. Plan for that when scoping: the connection cannot be tried from a laptop on a Friday afternoon unless someone with the Admin Console has already agreed.
What it is
Box's own hosted endpoint. It is not available until an administrator turns MCP on in the Admin Console and issues integration credentials, so this is an enterprise decision rather than a personal one.
What you get
Content operations — search, Box AI and folder work — with the full tool list published in Box's own tools guide.
Requirements
An admin enables MCP in the Box Admin Console and creates OAuth Integration Credentials: client ID and secret, redirect URI and scopes. Then the client connects to mcp.box.com and authorises.
Setup effort
Admin enables it, then paste and authorize — add the endpoint to your client, then approve the OAuth consent screen
USE CASES
01
Finding a document by what it says
Search across Box content and let Box AI read the result, rather than opening folders.
02
Working with folders from an agent
Folder operations through the same connection, under the scopes the admin granted.
03
Keeping enterprise content governed
MCP is off until an admin enables it and issues credentials with explicit scopes.
BEFORE YOU INSTALL
What to know first
Requires
- an MCP client that can reach a remote endpoint
- OAuth 2.0 — an admin enables MCP in the Box Admin Console and creates Integration Credentials (client ID and secret, redirect URI, scopes)
INSTALLATION
Connect your client
Add the endpoint to your client, then approve the OAuth consent screen.
Server setup
ENDPOINT URL
https://mcp.box.comRequirements
- OAuth 2.0 — an admin enables MCP in the Box Admin Console and creates Integration Credentials (client ID and secret, redirect URI, scopes)
