Box MCP Server
for AI Agents

Add a collaborator (user or group) to a file or folder with a specific role (editor, viewer, previewer, uploader, previewer uploader, viewer uploader, co-owner). You can identify users by email (accessible_by.login) or user ID (accessible_by.id) — no need to look up the user ID first if you have their email. Cannot add the folder/file owner as a collaborator (returns 400). The is_access_only option is only supported for folder collaborations, not files. The expires_at option requires the enterprise admin to enable the "Automatically remove invited collaborators" setting.

Retrieve details of a specific collaboration by its ID, including the collaborator (user or group), their role, the item (file or folder) they have access to, and the collaboration status. Use list_folder_collaborations or list_file_collaborations to find collaboration IDs.

Update a collaboration's role, expiry date, or path visibility. Requires the authenticated user to be the folder owner, co-owner, or enterprise admin. The expires_at field only works if the enterprise "Automatically remove invited collaborators" setting is enabled. Returns 403 if the user lacks permission to modify the collaboration.

Remove a collaboration, revoking the user's or group's access to the shared file or folder. Requires the collaboration_id, which can be obtained from list_folder_collaborations or list_file_collaborations.

Add a comment to a file

Retrieve information about a comment

Update a comment's message

Remove a comment

Copy a file to another folder

Upload a new file

Download file content

Update a file's name, description, parent folder (to move it), shared link, tags, or lock status. To lock a file, provide a lock object with type='lock'. To unlock a file, omit the lock field entirely (do NOT set lock to null, which may cause errors).

Delete a file and move it to trash

Upload a new version of an existing file by providing the file_id, base64-encoded file content (file_content), and a filename (file_name). All three parameters are required. For files up to 50MB only — use chunked upload for larger files.

Retrieve a specific version of a file

List all versions of a file

Delete a specific file version

Create a new folder

Copy a folder to another folder

Update a folder's information

Delete a folder and move it to trash

Create a new enterprise group with optional invitation and member visibility settings. Requires enterprise admin or co-admin role — the manage_groups OAuth scope alone is not sufficient, the authenticated user must have admin-level privileges in the Box Admin Console.

List all enterprise groups, optionally filtered by name prefix. Returns group IDs, names, and basic details. Use filter_term to search for groups whose name starts with a specific string. This is a read-only listing operation that requires manage_groups scope.

Retrieve detailed information about a specific group by its ID, including name, description, invitability_level, and member_viewability_level. Requires admin-level permissions or group membership — note this requires stronger permissions than list_groups, which may succeed even when get_group returns 403.

Update a group's name, description, invitation settings, or member visibility. Requires enterprise admin or co-admin permissions — the authenticated user must have admin-level privileges, not just manage_groups scope.

Permanently delete an enterprise group. This action cannot be undone. Requires enterprise admin or co-admin permissions.

List all members of a specific group, including their user IDs, roles (member or admin), and membership IDs. The membership ID is needed for update_group_membership and remove_user_from_group operations.

Update a user's membership in a group

List unified groups in Box.

Get a unified Box group by ID.

List unified organizations in Box.

Get a unified Box organization by ID.

List unified roles in Box.

Get a unified Box role by ID.

List unified users in Box.

Get a unified Box user by ID.

Apply a metadata template instance to a file. Requires the file_id, scope (e.g. 'enterprise_1452824910' or 'global'), template_key, and a metadata object with field values. Even if all template fields are optional, the metadata object must contain at least one key-value pair — an empty object {} is rejected with 400 Bad Request. Returns 409 Conflict if this template is already applied to the file (use update_file_metadata to modify existing metadata).

List all metadata instances on a file

Retrieve a specific metadata instance on a file

Update a metadata instance on a file

Remove a metadata instance from a file

Apply a metadata template instance to a folder. Requires the folder_id, scope, template_key, and a metadata object with at least one key-value pair. Returns 409 Conflict if this template is already applied to the folder — use update_folder_metadata to modify existing metadata, or delete_folder_metadata first to remove and re-apply.

Retrieve a specific metadata instance on a folder

List all metadata instances on a folder

Update a metadata instance on a folder

Remove a metadata instance from a folder

List all metadata templates

Retrieve a metadata template

Create a review or completion task on a file. The task is created unassigned — use assign_task afterwards to assign it to users. Accepts an optional due date in ISO 8601 format (e.g. "2025-12-31T23:59:00+00:00"). Use +00:00 for UTC timezone offset, not -00:00.

Retrieve information about a task

Update a task's message, due date, action type, or completion rule. Note that updating completion_rule may fail with 400 Bad Request if the task has no assignees — assign at least one user before changing the completion rule.

Remove a task

List assignments for a task

Retrieve information about a task assignment

Update a task assignment's resolution state or message. Only the task creator, the assignee themselves, or enterprise admins can update an assignment. Returns 403 if the authenticated user lacks permission OR if the assignment is already in an approved/completed state.

Remove a task assignment

Create a new managed user account in the enterprise. Requires enterprise admin or co-admin role with manage_managed_users scope. The login email must use a real domain (not @example.com). Returns 403 Forbidden if the authenticated account lacks admin privileges.

Retrieve information about a user

Update a user's information

Delete a user from the enterprise

Retrieve a user's avatar image. Returns 404 if no custom avatar has been uploaded, even when the user profile contains an avatar_url field (which points to a default placeholder until a real image is uploaded). Use this to check whether a user has a custom profile picture.

Delete a user's avatar image