Install
$ agentstack add mcp-box-community-mcp-server-box Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Pipes remote content directly into a shell (remote code execution).
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Box MCP Server
> [!WARNING] > This repository is discontinued and no longer maintained. > Box now provides an officially supported hosted MCP server with the best experience and full functionality. > Please migrate to the hosted MCP server: Set up the Box MCP Server →
Quick Start
Clone the repository:
git clone https://github.com/box-community/mcp-server-box.git
cd mcp-server-box
Optional but recommended uv installation for virtual environment and dependency management:
Homebrew (macOS)
brew install uv
WinGet (Windows)
winget install --id=astral-sh.uv -e
On macOS and Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
On Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
Set up the virtual environment and install dependencies:
uv sync
Set environment variables:
Set the following environment variables for Box authentication in a .env file or your system environment.
For comprehensive authentication configuration options, see the [Authentication Guide](docs/authentication.md).
Using OAuth2.0 with a Box App
BOX_CLIENT_ID = YOUR_CLIENT_ID
BOX_CLIENT_SECRET = YOUR_CLIENT_SECRET
BOX_REDIRECT_URL = http://localhost:8000/callback
# MCP Server Authentication (for HTTP transports)
BOX_MCP_SERVER_AUTH_TOKEN = YOUR_BOX_MCP_SERVER_AUTH_TOKEN
OAUTH_PROTECTED_RESOURCES_CONFIG_FILE = .oauth-protected-resource.json
> Note: > - The BOX_MCP_SERVER_AUTH_TOKEN is used to authenticate the MCP client to the MCP server when using --mcp-auth-type=token (independent of Box authentication)
Run the MCP server in STDIO mode:
uv run src/mcp_server_box.py
Box Community MCP Server Tools
Below is a summary of the available tools:
| Tools available | Description | |--------------------------|--------------------------------------------------| | [boxtoolsai](docs/boxtoolsai.md) | AI-powered file and hub queries | | [boxtoolscollaboration](docs/boxtoolscollaboration.md) | Manage file/folder collaborations | | [boxtoolsdocgen](docs/boxtoolsdocgen.md) | Document generation and template management | | [boxtoolsfiles](docs/boxtoolsfiles.md) | File operations (read, upload, download) | | [boxtoolsfolders](docs/boxtoolsfolders.md) | Folder operations (list, create, delete, update) | | [boxtoolsgeneric](docs/boxtoolsgeneric.md) | Generic Box API utilities | | [boxtoolsgroups](docs/boxtoolsgroups.md) | Group management and queries | | [boxtoolsmetadata](docs/boxtoolsmetadata.md) | Metadata template and instance management | | [boxtoolssearch](docs/boxtoolssearch.md) | Search files and folders | | [boxtoolssharedlinks](docs/boxtoolssharedlinks.md) | Shared link management for files/folders/web-links| | [boxtoolstasks](docs/boxtoolstasks.md) | Task and task assignment management | | [boxtoolsusers](docs/boxtoolsusers.md) | User management and queries | | [boxtoolsweblink](docs/boxtoolsweblink.md) | Web link creation and management |
Box Community MCP Server Operations Details
Command line interface parameters
To run the MCP server with specific configurations, you can use the following command line parameters:
uv run src/mcp_server_box.py --help
usage: mcp_server_box.py [-h] [--transport {stdio,sse,http}] [--host HOST] [--port PORT] [--mcp-auth-type {oauth,token,none}] [--box-auth-type {oauth,ccg,jwt,mcp_client}]
Box Community MCP Server
options:
-h, --help show this help message and exit
--transport {stdio,sse,http}
Transport type (default: stdio)
--host HOST Host for SSE/HTTP transport (default: localhost)
--port PORT Port for SSE/HTTP transport (default: 8005)
--mcp-auth-type {oauth,token,none}
Authentication type for MCP server (default: token)
--box-auth-type {oauth,ccg,jwt,mcp_client}
Authentication type for Box API (default: oauth)
```
For detailed information about authentication types, configurations, and use cases, see the [Authentication Guide](docs/authentication.md).
### Claude Desktop Configuration
#### STDIO mode
Edit your `claude_desktop_config.json`:
```code ~/Library/Application\ Support/Claude/claude_desktop_config.json```
Add the configuration:
```json
{
"mcpServers": {
"mcp-server-box": {
"command": "uv",
"args": [
"--directory",
"/path/to/mcp-server-box",
"run",
"src/mcp_server_box.py"
]
}
}
}
Restart Claude if it is running.
HTTP Mode
Assuming your MCP server is running on https://mcp.myserver.com/mcp
- Go to Claude -> Settings -> Connectors
- Select
Add custom connector - Configurations:
- Give it a name
- Enter the URL e.g.
https://mcp.myserver.com/mcp - Optionally enter the
client idandclient secret - Click add
- Click connect. The OAuth flow should start. Complete the flow
- Back in Claude, click Configure. You should see all the tools available.
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: box-community
- Source: box-community/mcp-server-box
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.