Docs

Configure the Box MCP Server

Updated 2 min read

Overview

Box operates an official hosted MCP server at mcp.box.com, covering file and folder operations, keyword and metadata search, sharing (collaboration invites and shared links), and Box AI tools for Q&A and structured extraction over files. Access is authorized through OAuth 2.0 via a Box User App you create yourself.

1. Configure Box

  1. Go to the Box Developer Console, click Add an app, and select User App as the app type. Give it a name.
  2. On the app’s Configuration page, add your gateway’s OAuth redirect URI — found in the Configuration section for your gateway in the Dtwo UI — and select the scopes your agents need, for example root_readwrite for file and folder operations and ai.readwrite for Box AI tools.
  3. Copy the generated Client ID and Client Secret — the secret is only shown once.

2. Add the MCP server to your gateway config

In the mcp_servers section of your gateway configuration add the following entry:

  - name: box
    description: "Box's official hosted MCP server for files, folders, search, sharing, and Box AI."
    url: https://mcp.box.com
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - root_readonly
        - root_readwrite
      client_id: "<CLIENT_ID>"
      client_secret: "<CLIENT_SECRET>"
      authorization_url: "https://account.box.com/api/oauth2/authorize"
      token_url: "https://api.box.com/oauth2/token"
      redirect_uri: "<CALLBACK_URL>"

Replace the placeholder values:

  • <CLIENT_ID> and <CLIENT_SECRET> — come from the app you created in step 1.
  • <CALLBACK_URL> — the same redirect URI you set in step 1, found in the Configuration section for your gateway in the Dtwo UI.

Make sure the scopes you add here match the ones you enabled in step 1.2 exactly — a mismatch will cause the OAuth authorization to fail.

3. Deploy and verify

Save the configuration and deploy the gateway.

Then, in your AI client, ask it to authorize Box via the gateway. This opens the Box login screen — sign in as the user whose permissions the agent should inherit, and approve the consent prompt. Once authorized, confirm the server’s tools appear and run a quick call to make sure the connection works.

Having trouble? Email support@dtwo.ai.