├── LICENSE └── README.md /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2025 Box Developer Community 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Box MCP Server (Remote) 2 | 3 | Securely connect MCP-compatible agents to your Box content and Box AI—without moving data out of Box. 4 | 5 | > **Endpoint**: `https://mcp.box.com` 6 | 7 | --- 8 | 9 | ## Overview 10 | 11 | The remote Box MCP server lets AI agent platforms (e.g., **Copilot Studio**, **Claude**, **Mistral Le Chat**) connect to Box to securely query and use Box data and AI-powered tools, while keeping content protected. Authorization is handled via OAuth so users can grant controlled access from within the client they’re using. 12 | 13 | [Learn more in the remote Box MCP server guide](https://developer.box.com/guides/box-mcp/remote/) 14 | 15 | > Looking for the self-hosted/local version? See [box-community/mcp-server-box](https://github.com/box-community/mcp-server-box). 16 | 17 | --- 18 | 19 | ## Capabilities 20 | 21 | The remote Box MCP server provides tools across several areas, such as: 22 | - **User info** (e.g., identify the authenticated user) 23 | - **File and folder operations** (read content, list folders, search files/folders, etc.) 24 | - **Box AI tools** (Q&A across files, metadata extraction, etc.) 25 | 26 | For the complete and most up-to-date set of supported tools, see the [remote Box MCP server documentation](https://developer.box.com/guides/box-mcp/remote/). 27 | 28 | --- 29 | 30 | ## Setup 31 | 32 | To connect an MCP client to the remote Box MCP server, you’ll first configure an OAuth app in Box, then use its credentials in your client. The preferred path is to use the predefined **Box MCP Server** integration in the [Admin Console](https://support.box.com/hc/en-us/articles/360043695714-Admin-Console-Guide), but in certain flows (e.g., the [GitHub MCP registry](https://github.com/mcp)), you may need to create your own OAuth app in the [Developer Console](https://app.box.com/developers/console) instead. 33 | 34 | ### 1. Configure an OAuth app in Box 35 | 36 | Choose one of the following options: 37 | 38 | - **Admin Console flow (preferred):** Enable or configure the Box MCP server from **Admin Console → Integrations**. 39 | - **Developer Console flow:** [Create an OAuth app](https://developer.box.com/guides/authentication/oauth2/oauth2-setup/) with the proper redirect URI and scopes. 40 | 41 | For detailed instructions, see the [remote Box MCP server guide](https://developer.box.com/guides/box-mcp/remote/). 42 | 43 | 44 | ### 2. Connect from your MCP client 45 | 46 | Most clients or platforms let you add a remote MCP server by URL and will guide you through the OAuth flow. Here are some of the details you’ll typically need to provide: 47 | 48 | - **Endpoint URL:** `https://mcp.box.com` 49 | - **Name:** a name of your choice (e.g., `box-remote-mcp`) 50 | - **Authorization:** Bearer token (via OAuth 2.0) 51 | - **Client ID** and **Client Secret**: obtained from your app’s credentials (Admin Console for the predefined **Box MCP Server** integration, or Developer Console if you created your own OAuth app) 52 | - **Redirect URI**: provided by your client and must be added to your app configuration (via the Admin Console or Developer Console, depending on your flow) 53 | 54 | See the [remote Box MCP server guide](https://developer.box.com/guides/box-mcp/remote/) for client-specific connection examples (Claude, Copilot Studio, Le Chat). 55 | 56 | --- 57 | 58 | ## OAuth & Discovery 59 | 60 | The remote Box MCP server is an **OAuth‑protected resource** backed by Box’s authorization server: 61 | 62 | - [Resource metadata](https://mcp.box.com/.well-known/oauth-protected-resource) 63 | - [Authorization server metadata](https://api.box.com/.well-known/oauth-authorization-server) 64 | 65 | For implementation details, see the [Box authentication guide](https://developer.box.com/guides/authentication/). 66 | 67 | **Using tokens with the Box API** 68 | 69 | All Box API calls require a valid [Access Token](https://developer.box.com/guides/authentication/tokens/access-tokens/). Example: 70 | 71 | ```bash 72 | curl https://api.box.com/2.0/users/me \ 73 | -H "authorization: Bearer " 74 | ``` 75 | 76 | --- 77 | 78 | ## Terms 79 | 80 | Use of the Box MCP server and Box APIs is subject to the **Box Terms of Service**: 81 | https://www.box.com/legal/termsofservice 82 | 83 | --- 84 | 85 | ## Support & Docs 86 | 87 | - Remote Box MCP server: https://developer.box.com/guides/box-mcp/remote/ 88 | - Authentication guide: https://developer.box.com/guides/authentication/ 89 | - API status: https://status.box.com/ 90 | - Community: https://community.box.com/ 91 | --------------------------------------------------------------------------------