Box MCP Server
for AI Agents

Add a collaborator (user or group) to a file or folder with a specific role (editor, viewer, previewer, uploader, previewer uploader, viewer uploader, co-owner). You can identify users by email (accessible_by.login) or user ID (accessible_by.id) — no need to look up the user ID first if you have their email. Cannot add the folder/file owner as a collaborator (returns 400). The is_access_only option is only supported for folder collaborations, not files. The expires_at option requires the enterprise admin to enable the "Automatically remove invited collaborators" setting.

Retrieve details of a specific collaboration by its ID, including the collaborator (user or group), their role, the item (file or folder) they have access to, and the collaboration status. Use list_folder_collaborations or list_file_collaborations to find collaboration IDs.

Update a collaboration's role or path visibility. Requires the authenticated user to be the folder owner, co-owner, or enterprise admin. Returns 403 if the user lacks permission to modify the collaboration.

Remove a collaboration, revoking the user's or group's access to the shared file or folder. Requires the collaboration_id, which can be obtained from list_folder_collaborations or list_file_collaborations.

Add a comment to a file

Retrieve information about a comment

Update a comment's message

Remove a comment

Copy a file to another folder

Upload a new file

Download a file from Box. The file is saved as a downloadable artifact. The JSON response body will be empty ({}) — the actual file content is available through the download artifact, not inline in the response. To read text or JSON file contents directly, use get_file to retrieve file metadata and access the content through the shared link or Box web UI.

Update a file's name, description, parent folder (to move it), shared link, tags, or lock status. To lock a file, provide a lock object with access='lock'. Unlocking is not supported through this action — to unlock a file, use the Box web UI or the Box API directly.

Delete a file and move it to trash

Upload a new version of an existing file by providing the file_id, base64-encoded file content (file_content), and a filename (file_name). All three parameters are required. For files up to 50MB only — use chunked upload for larger files.

Retrieve a specific version of a file

List all versions of a file

Delete a specific file version

Create a new folder

Copy a folder to another folder

Update a folder's information

Delete a folder and move it to trash

Create a new enterprise group with optional invitation and member visibility settings. Requires enterprise admin or co-admin role — the manage_groups OAuth scope alone is not sufficient, the authenticated user must have admin-level privileges in the Box Admin Console.

List all enterprise groups, optionally filtered by name prefix. Returns group IDs, names, and basic details. Use filter_term to search for groups whose name starts with a specific string. This is a read-only listing operation that requires manage_groups scope.

Retrieve detailed information about a specific group by its ID, including name, description, invitability_level, and member_viewability_level. Requires admin-level permissions or group membership — note this requires stronger permissions than list_groups, which may succeed even when get_group returns 403.

Update a group's name, description, invitation settings, or member visibility. Requires enterprise admin or co-admin permissions — the authenticated user must have admin-level privileges, not just manage_groups scope.

Permanently delete an enterprise group. This action cannot be undone. Requires enterprise admin or co-admin permissions.

List all members of a specific group, including their user IDs, roles (member or admin), and membership IDs. The membership ID is needed for update_group_membership and remove_user_from_group operations.

Update a user's membership in a group

List unified groups in Box.

Get a unified Box group by ID.

List unified organizations in Box.

Get a unified Box organization by ID.

List unified roles in Box.

Get a unified Box role by ID.

List unified users in Box.

Get a unified Box user by ID.

Apply a metadata template instance to a file. Requires the file_id, scope (e.g. 'enterprise_1452824910' or 'global'), template_key, and a metadata object with field values. Even if all template fields are optional, the metadata object must contain at least one key-value pair — an empty object {} is rejected with 400 Bad Request. Returns 409 Conflict if this template is already applied to the file (use update_file_metadata to modify existing metadata).

List all metadata instances on a file

Retrieve a specific metadata instance on a file

Update a metadata instance on a file

Remove a metadata instance from a file

Apply a metadata template instance to a folder. Requires the folder_id, scope, template_key, and a metadata object with at least one key-value pair. Returns 409 Conflict if this template is already applied to the folder — use update_folder_metadata to modify existing metadata, or delete_folder_metadata first to remove and re-apply.

Retrieve a specific metadata instance on a folder

List all metadata instances on a folder

Update a metadata instance on a folder

Remove a metadata instance from a folder

List all metadata templates

Retrieve a metadata template

Create a review or completion task on a file. The task is created unassigned — use assign_task afterwards to assign it to users. Accepts an optional due date in ISO 8601 format (e.g. "2025-12-31T23:59:00+00:00"). Use +00:00 for UTC timezone offset, not -00:00.

Retrieve information about a task

Update a task's message, due date, action type, or completion rule. Updating completion_rule alone returns 400 — always include at least one other field (e.g. message) alongside it. Assign at least one user before changing the completion rule.

Remove a task

List assignments for a task

Retrieve information about a task assignment

Update a task assignment's resolution state or message. For review-type tasks, resolution_state (approved or rejected) is required — sending only a message without resolution_state returns 403. Only the task creator, the assignee, or enterprise admins can update an assignment.

Remove a task assignment

Create a new managed user account in the enterprise. Requires enterprise admin or co-admin role with manage_managed_users scope. The login email must use a real domain (not @example.com). Returns 403 Forbidden if the authenticated account lacks admin privileges.

Retrieve information about a user

Update a user's information

Delete a user from the enterprise

Retrieve a user's avatar image. Returns 404 if no custom avatar has been uploaded, even when the user profile contains an avatar_url field (which points to a default placeholder until a real image is uploaded). Use this to check whether a user has a custom profile picture.

Delete a user's avatar image

Retrieve all webhooks for the authenticated application

Retrieve a specific webhook by ID