# Configure the Box MCP Server

Connect Box's official hosted MCP server to a Dtwo gateway via OAuth.

## Overview

Box operates an official hosted MCP server at `mcp.box.com`, covering file and folder operations, keyword and metadata search, sharing (collaboration invites and shared links), and Box AI tools for Q&A and structured extraction over files. Access is authorized through OAuth 2.0 via a Box User App you create yourself.

## 1. Configure Box

1. Go to the <a href="https://cloud.app.box.com/developers/console" target="_blank" rel="noopener noreferrer">Box Developer Console</a>, click **Add an app**, and select **User App** as the app type. Give it a name.
2. On the app's **Configuration** page, add your gateway's OAuth redirect URI — found in the Overview tab for your gateway in the Dtwo UI — and select the scopes your agents need, for example `root_readwrite` for file and folder operations and `ai.readwrite` for Box AI tools.
3. Copy the generated **Client ID** and **Client Secret** — the secret is only shown once.

## 2. Add the MCP server to your gateway config

Go to your gateway in the Dtwo UI and open **Configuration → Advanced**. In the `mcp_servers` section add the following entry:

```yaml
  - name: box
    description: "Box's official hosted MCP server for files, folders, search, sharing, and Box AI."
    url: https://mcp.box.com
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - root_readonly
        - root_readwrite
      client_id: "<CLIENT_ID>"
      client_secret: "<CLIENT_SECRET>"
      authorization_url: "https://account.box.com/api/oauth2/authorize"
      token_url: "https://api.box.com/oauth2/token"
      redirect_uri: "<CALLBACK_URL>"
```

Replace the placeholder values:

- `<CLIENT_ID>` and `<CLIENT_SECRET>` — come from the app you created in step 1.
- `<CALLBACK_URL>` — the same redirect URI you set in step 1, found in the Overview tab for your gateway in the Dtwo UI.

Make sure the `scopes` you add here match the ones you enabled in step 1.2 exactly — a mismatch will cause the OAuth authorization to fail.

## 3. Deploy and verify

Save the configuration and deploy the gateway.

Then, in your AI client, ask it to authorize Box via the gateway. This opens the Box login screen — sign in as the user whose permissions the agent should inherit, and approve the consent prompt. Once authorized, confirm the server's tools appear and run a quick call to make sure the connection works.

If the tools don't appear after you authorize, refresh the tool list in your AI client — some clients don't pick it up automatically.

---

Having trouble? Email [support@dtwo.ai](mailto:support@dtwo.ai).