Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

com.mcparmory/box

OCI · GHCR.IO/MCPARMORY/BOX:1.0.5 · 2 COMPONENTS · SCANNED SEP 20

Manage files, folders, and team collaboration with access controls

+1 this week 50 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0
  • Malware scan not yet available for this package.Unverified
  • Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
  • Install-script risk not yet assessed.Unverified
  • Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
Provenance & Transparency32
Schema Quality & AI Usability74
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 34690 tokens (~141/item across 246 items; 246 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety98
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 41 of 44 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "transfer_user_folders" implies "transfer" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
  • An AI judge read all 246 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the com.mcparmory/box MCP server?

com.mcparmory/box runs locally as a container image, launched with docker run --rm -i ghcr.io/mcparmory/box:1.0.5. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · ghcr.io/mcparmory/box:1.0.5

# add to Claude Code
claude mcp add com-mcparmory-box -- docker run --rm -i ghcr.io/mcparmory/box:1.0.5
// .cursor/mcp.json
{
  "mcpServers": {
    "com-mcparmory-box": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/mcparmory/box:1.0.5"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "com-mcparmory-box": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/mcparmory/box:1.0.5"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add com-mcparmory-box -- docker run --rm -i ghcr.io/mcparmory/box:1.0.5
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-mcparmory-box": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/mcparmory/box:1.0.5"
      ],
      "enabled": true
    }
  }
}
# ~/.hermes/config.yaml
mcp_servers:
  com-mcparmory-box:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/mcparmory/box:1.0.5"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "com-mcparmory-box": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/mcparmory/box:1.0.5"
      ]
    }
  }
}
// mcp.json
{
  "mcpServers": {
    "com-mcparmory-box": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/mcparmory/box:1.0.5"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 −3
    • Stability: pass → 0.83 functional
  • 18 Sept 26 +1
    • Stability: 0.97 → pass security
  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 11 Sept 26 +1
    • Stability: 0.97 → pass security
  • 9 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed oci/ghcr.io/mcparmory/box:1.0.5

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem oci
Reason No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 246 exposed · ~34,690 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
abort_upload_session ~62

Permanently aborts an active upload session and discards all uploaded data. This action is irreversible and cannot be undone.

NameTypeReqDescription
upload_session_idstringyesThe unique identifier of the upload session to abort, as returned by the Create or Get upload session endpoints.

No output schema declared.

No examples provided.

add_barrier_segment_member ~114

Adds a user as a member of a shield information barrier segment, applying the segment's information restrictions to that user.

NameTypeReqDescription
shield_information_barrierIdstringThe unique identifier of the shield information barrier that the target segment belongs to.
shield_information_barrier_segmentIdstringThe unique identifier of the shield information barrier segment to which the user will be added as a member.
userobjectThe user object representing the individual to whom the segment's information barrier restrictions will be applied.

No output schema declared.

No examples provided.

add_file_classification ~126

Adds a security classification label to a file in Box. Use this to apply an enterprise-defined classification (e.g., Confidential, Sensitive) to control how the file is handled and shared.

NameTypeReqDescription
Box__Security__Classification__KeystringThe classification label to apply to the file. Must match one of the available classification keys defined in the enterprise's classification template; retrieve valid keys from the classification tem…
file_idstringyesThe unique identifier of the file to classify. The file ID can be found in the file's URL in the Box web application.

No output schema declared.

No examples provided.

add_file_shared_link ~418

Creates or updates a shared link on a file, controlling access level, permissions, expiration, and optional password protection. Returns the file with the shared link fields populated.

NameTypeReqDescription
accessstringThe visibility level of the shared link. Use 'open' for anyone with the link, 'company' for internal users only (paid accounts only), or 'collaborators' for explicitly invited users only. Defaults to…
can_downloadbooleanWhether the shared link permits downloading the file. Can only be set when access is 'open' or 'company'.
can_editbooleanWhether the shared link permits editing the file. Can only be set when access is 'open' or 'company', and requires can_download to also be true.
can_previewbooleanWhether the shared link permits previewing the file. This value is always true and applies to all items within a folder when set on a folder shared link.
fieldsstringyesA comma-separated list of fields to include in the response. Must include 'shared_link' to return shared link details in the response.
file_idstringyesThe unique identifier of the file to add a shared link to. Visible in the file's URL in the Box web application.
passwordstringAn optional password required to access the shared link. Must be at least eight characters and include a number, uppercase letter, or non-alphanumeric character. Can only be set when access is 'open'…
unshared_atstringThe ISO 8601 datetime at which the shared link expires and becomes inaccessible. Must be a future datetime. Only available to paid account users.
vanity_namestringA custom vanity slug appended to the shared link URL (e.g., https://app.box.com/v/{vanity_name}). Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to…

No output schema declared.

No examples provided.

add_folder_classification ~107

Applies a security classification label to a specified folder. The classification must exist in the enterprise's classification template.

NameTypeReqDescription
Box__Security__Classification__KeystringThe classification label to apply to the folder. Must match an existing classification key from the enterprise's security classification template.
folder_idstringyesThe unique identifier of the folder to classify. The ID can be found in the folder's URL in the Box web app; the root folder is always ID '0'.

No output schema declared.

No examples provided.

add_folder_shared_link ~427

Adds or updates a shared link on a folder, controlling access level, password protection, expiration, and permissions for viewing or downloading folder contents.

NameTypeReqDescription
accessstringThe visibility level of the shared link: `open` for anyone with the link, `company` for users within the enterprise (paid accounts only), or `collaborators` for only invited collaborators. Omitting t…
can_downloadbooleanWhether recipients of the shared link are permitted to download files in the folder. Can only be set when access is `open` or `company`.
can_editbooleanWhether recipients of the shared link are permitted to edit items. For folders, this value can only be `false`.
can_previewbooleanWhether recipients of the shared link are permitted to preview files in the folder. This value is always `true` and applies to all items within the folder.
fieldsstringyesA comma-separated list of fields to include in the response. Must include `shared_link` to return the shared link details in the response.
folder_idstringyesThe unique identifier of the folder to add a shared link to. The ID appears in the folder's URL in the Box web app, and the root folder is always ID `0`.
passwordstringAn optional password required to access the shared link. Must be at least 8 characters and include a number, uppercase letter, or non-alphanumeric character. Can only be set when access is `open`; se…
unshared_atstringThe ISO 8601 datetime at which the shared link expires and becomes inaccessible. Must be a future date and time, and can only be set by users on paid accounts.
vanity_namestringA custom vanity name to use in the shared link URL path. Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to guess than standard shared links.

No output schema declared.

No examples provided.

add_user_to_group ~156

Adds a user to a group with a specified role and optional custom admin permissions. Requires admin-level permissions to perform this action.

NameTypeReqDescription
configurable_permissionsobjectCustom permission overrides for group admins only; has no effect on members with the 'member' role. Pass null to disable all configurable permissions, or specify individual permissions — any omitted…
groupIdstringThe unique identifier of the group the user will be added to.
rolestringThe role assigned to the user within the group. Use 'member' for standard access or 'admin' for elevated group management privileges.
userIdstringThe unique identifier of the user to be added to the group.

No output schema declared.

No examples provided.

add_web_link_shared_link ~408

Adds or updates a shared link on a web link item, controlling access level, password protection, expiration, and permissions. Returns the web link with the shared link fields populated.

NameTypeReqDescription
accessstringThe visibility level of the shared link: 'open' allows anyone with the link, 'company' restricts to users within the enterprise (paid accounts only), and 'collaborators' restricts to explicitly invit…
can_downloadbooleanWhether recipients of the shared link are permitted to download the web link. Can only be set when access is 'open' or 'company'.
can_editbooleanWhether recipients of the shared link are permitted to edit the item. Can only be true when the item type is a file.
can_previewbooleanWhether recipients of the shared link are permitted to preview the web link. This value is always true and also applies to items within a shared folder.
fieldsstringyesA comma-separated list of fields to include in the response; must include 'shared_link' to return the shared link details.
passwordstringAn optional password required to access the shared link; set to null to remove an existing password. Must be at least eight characters and include a number, uppercase letter, or non-alphanumeric char…
unshared_atstringThe ISO 8601 datetime at which the shared link will automatically expire and become inaccessible. Must be a future datetime and can only be set by users on paid accounts.
vanity_namestringA custom vanity name used in the shared link URL path, forming a human-readable URL. Must be at least 12 characters; avoid using vanity names for sensitive content as they are easier to guess.
web_link_idstringyesThe unique identifier of the web link to which the shared link will be added.

No output schema declared.

No examples provided.

apply_file_watermark ~95

Applies or updates a watermark on a specified file in Box. Use this to protect file content by overlaying a visible watermark when the file is viewed or downloaded.

NameTypeReqDescription
file_idstringyesThe unique identifier of the file to watermark. Found in the file's URL in the Box web application.
imprintstringThe type of watermark to apply to the file. Currently only the default imprint style is supported.

No output schema declared.

No examples provided.

apply_folder_watermark ~110

Applies or updates a watermark on a specified folder in Box. Use this to protect folder contents by overlaying a visible watermark imprint.

NameTypeReqDescription
folder_idstringyesThe unique identifier of the folder to watermark. The folder ID can be found in the URL when viewing the folder in the Box web app. The root folder of any Box account is always ID `0`.
imprintstringThe type of watermark imprint to apply to the folder. Currently only the default imprint style is supported.

No output schema declared.

No examples provided.

apply_metadata_cascade_policy ~136

Force-applies a metadata cascade policy to all existing children within a folder, ensuring inherited metadata values are propagated down. Useful after creating a new cascade policy to retroactively enforce metadata on files already present in the folder.

NameTypeReqDescription
conflict_resolutionstringDetermines how to handle conflicts when a child file already has an instance of the metadata template applied. Use 'none' to preserve existing values on the child, or 'overwrite' to replace them with…
metadata_cascade_policy_idstringyesThe unique identifier of the metadata cascade policy to force-apply to the folder's children.

No output schema declared.

No examples provided.

assign_legal_hold_policy ~145

Assigns a legal hold policy to a specific item, such as a file, file version, folder, user, ownership, or interactions. Use this to enforce legal holds across different content types within Box.

NameTypeReqDescription
idstringThe unique identifier of the specific item (file, folder, user, etc.) to which the legal hold policy will be assigned.
policy_idstringThe unique identifier of the legal hold policy to assign to the target item.
typestringThe category of item to which the legal hold policy will be applied. Must be one of: file, file_version, folder, user, ownership, or interactions.

No output schema declared.

No examples provided.

assign_retention_policy ~244

Assigns a retention policy to a specific target, such as a folder, enterprise, or metadata template. Use this to enforce data retention rules on content within Box.

NameTypeReqDescription
filter_fieldsarrayAn array of field-value filter objects used to narrow the assignment when the target type is 'metadata_template'. Each object must contain a 'field' key and a 'value' key; currently only one filter o…
idstringThe unique identifier of the specific folder or metadata template to assign the policy to. Omit or set to null when assigning to the entire enterprise.
policy_idstringThe unique identifier of the retention policy to assign to the target item.
start_date_fieldstringThe date from which the retention policy assignment takes effect. When the target type is 'metadata_template', this can reference a date-type metadata attribute key ID to dynamically determine the st…
typestringThe category of item the retention policy will be assigned to. Use 'enterprise' to apply policy-wide, 'folder' for a specific folder, or 'metadata_template' to target items matching a metadata templa…

No output schema declared.

No examples provided.

assign_storage_policy ~138

Assigns a storage policy to a specific user or enterprise, controlling where their content is stored. Use this to enforce data residency or storage tier requirements.

NameTypeReqDescription
assigned_toIdstringThe unique identifier of the user or enterprise to which the storage policy will be assigned.
assigned_toTypestringThe type of entity receiving the storage policy assignment, either an individual user or an entire enterprise.
storage_policyIdstringThe unique identifier of the storage policy to assign to the target entity.
storage_policyTypestringThe resource type being assigned as the storage policy; must always be 'storage_policy'.

No output schema declared.

No examples provided.

assign_task ~145

Assigns a task to a specific user by user ID or email address. A task can be assigned to multiple users by creating separate assignments.

NameTypeReqDescription
assign_toIdstringThe unique identifier of the user to assign the task to. Use the `login` parameter instead to specify the user by email address.
loginstringThe email address of the user to assign the task to. Use the `id` parameter instead to specify the user by their unique user ID.
taskIdstringThe unique identifier of the task to be assigned.
typestringThe type of the item being assigned. Must always be set to 'task'.

No output schema declared.

No examples provided.

cancel_sign_request ~83

Cancels an active Box Sign request, preventing further signing actions by any recipients. An optional reason can be provided to document why the request was cancelled.

NameTypeReqDescription
reasonstringAn optional explanation for why the sign request is being cancelled, useful for audit trails and notifying stakeholders.
sign_request_idstringyesThe unique identifier of the sign request to cancel.

No output schema declared.

No examples provided.

commit_upload_session ~140

Finalizes an upload session by assembling all uploaded chunks into a complete file. Must be called after all parts have been uploaded to close the session and persist the file.

NameTypeReqDescription
digeststringyesThe RFC 3230 message digest of the entire file used to verify integrity. Must be a Base64-encoded SHA1 hash formatted as `sha=<BASE64_ENCODED_DIGEST>`.
partsarrayAn ordered list of part details representing all uploaded chunks that should be assembled into the final file. Each item should describe a previously uploaded part.
upload_session_idstringyesThe unique identifier of the upload session to commit.

No output schema declared.

No examples provided.

copy_file ~179

Creates a copy of an existing file, optionally placing it in a different folder, renaming it, or copying a specific version. Returns the metadata of the newly created file copy.

NameTypeReqDescription
file_idstringyesThe unique identifier of the file to copy. Visible in the Box web app URL when viewing the file.
idstringThe ID of the destination folder where the copied file will be placed. Use '0' to copy the file to the root folder.
namestringAn optional new name for the copied file. Must not exceed 255 characters; non-printable ASCII characters, forward/backward slashes, and reserved names like '.' and '..' are automatically sanitized.
versionstringThe ID of a specific file version to copy. If omitted, the latest version of the file is copied.

No output schema declared.

No examples provided.

copy_file_request ~115

Copies an existing file request from one folder and applies it to another folder, duplicating its settings and configuration. Useful for reusing file request templates across multiple folders without manual recreation.

NameTypeReqDescription
bodyobjectThe request body specifying the destination folder and any overrides to apply to the copied file request, such as a new title or description.
file_request_idstringyesThe unique identifier of the file request to copy. Find this ID in the URL when viewing a file request in the Box web application's file request builder.

No output schema declared.

No examples provided.

copy_folder ~158

Creates a copy of an existing folder and places it inside a specified destination folder. The original folder and its contents remain unchanged.

NameTypeReqDescription
folder_idstringyesThe unique identifier of the folder to copy. The folder ID can be found in the Box web app URL when viewing the folder. The root folder (ID '0') cannot be copied.
idstringThe ID of the destination parent folder where the copied folder will be placed.
namestringAn optional name for the copied folder. If omitted, the original folder name is used. Names must be between 1 and 255 characters, cannot contain non-printable ASCII characters, forward or backward sl…

No output schema declared.

No examples provided.

create_ai_agent ~948

Creates a new AI agent with one or more capabilities (ask, text_gen, or extract). At least one capability must be configured when creating the agent.

NameTypeReqDescription
access_statestringControls the overall availability of the AI agent. Use `enabled` to make it available to all, `disabled` to deactivate it, or `enabled_for_selected_users` to restrict access to specific users.
allowed_entitiesarrayList of users or groups permitted to use this AI agent when access is restricted to selected entities. Each item should reference a valid user or group.
askAccess_statestringControls whether the ask capability is active. Set to `enabled` to allow users to ask questions, or `disabled` to turn it off.
askBasic_imageobjectConfiguration for the processor that handles image content within the ask capability, including model and prompt settings.
askBasic_textobjectConfiguration for the processor that handles standard-length text content within the ask capability, including model and prompt settings.
askCustom_instructionsstringCustom behavioral instructions that guide how the ask capability responds, allowing tailored tone, scope, or domain-specific rules.
askDescriptionstringHuman-readable description of the ask capability, explaining its purpose or behavior to users.
askLong_textobjectConfiguration for the processor that handles long-form text content within the ask capability, such as chunking strategy and model settings.
askSuggested_questionsarrayUp to 4 pre-defined questions surfaced to users when interacting with the ask capability. Pass null to auto-generate suggestions, or an empty array to show none.
askTypestringIdentifies the ask capability block as an AI agent ask handler.
basic_genobjectConfiguration for the basic text generation tool used by the text_gen capability, controlling model behavior and prompt structure for content generation.
basic_image_multiobjectConfiguration for the processor that handles images across multiple documents or segments, used for multi-document ask scenarios.
basic_text_multiobjectConfiguration for the processor that handles standard-length text across multiple documents or segments, used for multi-document ask scenarios.
extractAccess_statestringControls whether the metadata extraction capability is active. Set to `enabled` to allow extraction, or `disabled` to turn it off.
extractBasic_imageobjectConfiguration for the processor that handles image content within the extract capability, including model and prompt settings.
extractBasic_textobjectConfiguration for the processor that handles standard-length text content within the extract capability, including model and prompt settings.
extractCustom_instructionsstringCustom behavioral instructions that guide how the extract capability identifies and pulls metadata, allowing tailored scope or domain-specific rules.
extractDescriptionstringHuman-readable description of the extract capability, explaining its purpose or behavior to users.
extractLong_textobjectConfiguration for the processor that handles long-form text content within the extract capability, such as chunking strategy and model settings.
extractTypestringIdentifies the extract capability block as an AI agent metadata extractor.
icon_referencestringURL pointing to the avatar icon displayed for this AI agent in the UI. Must be a valid Box CDN URL using one of the supported avatar filenames.
long_text_multiobjectConfiguration for the processor that handles long-form text across multiple documents or segments, used for multi-document ask scenarios.
namestringHuman-readable display name for the AI agent, shown in the UI and used to identify the agent.
spreadsheetobjectConfiguration for the tool that processes spreadsheet and tabular data, controlling how structured data is interpreted by the agent.
text_genAccess_statestringControls whether the text generation capability is active. Set to `enabled` to allow text generation, or `disabled` to turn it off.
text_genCustom_instructionsstringCustom behavioral instructions that guide how the text generation capability produces output, allowing tailored tone, scope, or domain-specific rules.
text_genDescriptionstringHuman-readable description of the text generation capability, explaining its purpose or behavior to users.
text_genSuggested_questionsarrayUp to 4 pre-defined questions surfaced to users when interacting with the text generation capability. Pass null to auto-generate suggestions, or an empty array to show none.
text_genTypestringIdentifies the text generation capability block as an AI agent text generator.
typestringIdentifies this configuration as an AI agent resource.

No output schema declared.

No examples provided.

create_barrier_report ~92

Generates a compliance report for a specified shield information barrier, providing a snapshot of the barrier's configuration and activity. Useful for auditing and regulatory review of information separation policies.

NameTypeReqDescription
idstringThe unique identifier of the shield information barrier for which the report will be generated.
typestringThe resource type of the shield information barrier being referenced. Must be set to the designated barrier type value.

No output schema declared.

No examples provided.

create_barrier_segment ~133

Creates a named segment within an existing shield information barrier, allowing organizations to define distinct groups or divisions for information separation and compliance purposes.

NameTypeReqDescription
descriptionstringAn optional narrative description providing additional context about the barrier segment's purpose or the division it represents.
idstringThe unique identifier of the parent shield information barrier under which this segment will be created.
namestringA human-readable name for the barrier segment that identifies the division or group being isolated.
typestringThe resource type of the associated shield information barrier; must be set to the designated barrier type value.

No output schema declared.

No examples provided.

create_collaboration ~392

Grants a single user or group access to a file or folder by creating a collaboration with a specified role. Collaborators can be identified by user ID, group ID, or email address.

NameTypeReqDescription
accessible_byIdstringThe unique Box ID of the user or group being invited. Use this or the email-based login field to identify a user, but not both.
accessible_byTypestringSpecifies whether the collaborator being invited is an individual user or a group. Group invitations depend on the group's invite permissions.
can_view_pathbooleanWhen true, allows the collaborator to see the full parent folder path to the shared folder without gaining access to parent folder contents. Only applicable to folder collaborations, and only owners…
expires_atstringThe date and time at which the collaboration will be automatically removed from the item, provided in ISO 8601 format. Requires the expiry extension setting to be enabled in the Admin Console Enterpr…
is_access_onlybooleanWhen true, the collaborator can access the shared item but it will not appear in their All Files list and the root folder path will be hidden.
itemIdstringThe unique Box ID of the file or folder to which access is being granted.
itemTypestringThe type of Box item the collaboration will be granted access to, either a file or a folder.
loginstringThe email address of the user to invite as a collaborator. Use this or the user ID field to identify a user, but not both.
notifybooleanWhether to send an email notification to the invited collaborator when the collaboration is created.
rolestringThe permission level granted to the collaborator, controlling what actions they can perform on the item.

No output schema declared.

No examples provided.

create_comment ~135

Creates a new comment on a file or as a reply to an existing comment. Supports mentioning other users via a tagged message syntax to trigger email notifications.

NameTypeReqDescription
idstringThe unique identifier of the file or comment this comment will be attached to.
tagged_messagestringThe text of the comment using mention syntax to tag another user, formatted as `@[user_id:display_name]` anywhere in the message. Use the plain `message` parameter instead if no user mentions are nee…
typestringSpecifies whether the comment is being placed on a file or as a reply to an existing comment.

No output schema declared.

No examples provided.

create_email_alias ~101

Adds a new email alias to an existing user account, allowing the user to send and receive email under an additional address. The alias domain must be registered and verified under your enterprise.

NameTypeReqDescription
emailstringThe email address to register as an alias on the user account. The domain portion must be verified and registered to your enterprise before use.
user_idstringyesThe unique identifier of the user account to which the email alias will be added.

No output schema declared.

No examples provided.

create_file_metadata ~185

Applies an instance of a metadata template to a file, associating structured key-value data with it. Only keys defined in the specified template are accepted, except for the global.properties template which allows arbitrary key-value pairs.

NameTypeReqDescription
bodyobjectA JSON object containing the metadata field key-value pairs to populate on the template instance. Keys must match those defined in the template, unless using the global.properties template.
file_idstringyesThe unique identifier of the file to which the metadata instance will be applied. Visible in the file's URL in the Box web application.
scopestringyesThe scope of the metadata template to apply, either global (Box-provided templates) or enterprise (custom templates defined by your organization).
template_keystringyesThe unique key identifying the metadata template within the given scope, corresponding to the template's defined name.

No output schema declared.

No examples provided.

create_file_upload_session ~113

Creates a chunked upload session for an existing file, enabling large file uploads to be split into multiple parts. Use the returned session to upload individual chunks and complete the upload.

NameTypeReqDescription
file_idstringyesThe unique identifier of the existing file for which the upload session will be created. The file ID can be found in the file's URL in the Box web application.
file_namestringAn optional new name to assign to the file upon completing the upload session, replacing the current file name.

No output schema declared.

No examples provided.

create_folder ~237

Creates a new empty folder inside a specified parent folder. The folder name must be unique within the parent (case-insensitive) and must not contain invalid characters or trailing spaces.

NameTypeReqDescription
folder_upload_emailobjectOptional email upload configuration for the folder, allowing files to be uploaded by sending an email to a folder-specific address.
idstringThe unique ID of the parent folder in which the new folder will be created. Use '0' to create the folder at the root level of the user's account.
namestringThe display name for the new folder. Must be between 1 and 255 characters, must not contain non-printable ASCII characters, forward or backward slashes, or trailing spaces, and cannot be '.' or '..'.…
sync_statestringSpecifies the sync state of the folder for Box Sync (discontinued). Accepted values are 'synced' (fully synced), 'not_synced' (not synced), or 'partially_synced' (some contents synced). Not applicabl…

No output schema declared.

No examples provided.

create_folder_metadata ~228

Applies an instance of a metadata template to a folder, attaching structured key-value data based on the specified template. Note that the enterprise must have Cascading Folder Level Metadata enabled in the admin console for the metadata to appear in the Box web app.

NameTypeReqDescription
bodyobjectThe metadata key-value pairs to store on the folder, conforming to the fields defined in the specified template. The `global.properties` template accepts any arbitrary key-value pairs.
folder_idstringyesThe unique identifier of the folder to which the metadata instance will be applied. The root folder of a Box account always uses ID `0`; other folder IDs can be found in the URL when viewing the fold…
scopestringyesThe scope of the metadata template to apply, either `global` for Box-wide templates or `enterprise` for templates defined within your enterprise.
template_keystringyesThe unique key name of the metadata template to apply to the folder. Use `properties` for the global free-form key-value template, which accepts any key-value pair.

No output schema declared.

No examples provided.

create_group ~328

Creates a new user group within an enterprise account. Requires admin permissions; supports linking to external directory systems like Active Directory or Okta for one-way sync.

NameTypeReqDescription
descriptionstringA human-readable description providing additional context about the group's purpose or origin. Maximum 255 characters.
external_sync_identifierstringAn arbitrary identifier used to link this Box group to a corresponding group in an external system, such as an Active Directory Object ID or Google Group ID. Using this field is recommended to preven…
invitability_levelstringControls who can invite this group to collaborate on folders. Use `admins_only` to restrict invitations to enterprise admins, co-admins, and the group's admin; `admins_and_members` to also allow grou…
member_viewability_levelstringControls who can view the membership list of this group. Use `admins_only` to restrict visibility to enterprise admins, co-admins, and the group's admin; `admins_and_members` to also allow group memb…
namestringThe display name for the new group, which must be unique across the entire enterprise.
provenancestringIdentifies the external source system this group originates from (e.g., Active Directory or Okta). Setting this prevents Box admins from editing the group name or members via the Box web app, enablin…

No output schema declared.

No examples provided.

create_metadata_cascade_policy ~122

Creates a metadata cascade policy that automatically applies a metadata template from a specified folder down to all files within it. The folder must already have an instance of the target metadata template applied before the policy can take effect.

NameTypeReqDescription
folder_idstringThe unique identifier of the folder to which the cascade policy will be applied. The folder must already have an instance of the target metadata template applied to it.
metadata_templatestringThe metadata template identifier in 'scope/templateKey' format (e.g., 'enterprise_12345/contractTemplate')

No output schema declared.

No examples provided.

create_metadata_template ~285

Creates a new metadata template that can be applied to files and folders within an enterprise, defining custom fields for organizing and categorizing content.

NameTypeReqDescription
copyInstanceOnItemCopybooleanDetermines whether metadata instances attached to a file or folder are automatically copied when that item is copied. Defaults to false, meaning metadata is not copied.
displayNamestringThe human-readable name of the template shown in the Box UI and API responses, up to 4096 characters.
fieldsarrayAn ordered list of field definitions that make up the template. Each field can be of type text, date, number, single-select, or multi-select list, and the order provided determines display order.
hiddenbooleanControls whether the template is visible in the Box web app UI. Set to true to hide it and restrict usage to API access only.
scopestringThe scope under which the metadata template will be created. Must be set to 'enterprise', as global-scoped templates cannot be created via the API.
templateKeystringA unique identifier for the template across the enterprise, used to reference it programmatically. Must start with a letter or underscore, followed by letters, digits, hyphens, or underscores, up to…

No output schema declared.

No examples provided.

create_shield_information_barrier ~71

Creates a shield information barrier within an enterprise to separate individuals or groups and prevent confidential information from passing between them. Use this to enforce ethical walls or compliance boundaries within the same firm.

NameTypeReqDescription
enterpriseobjectThe type and ID of the enterprise under which this shield information barrier will be created.

No output schema declared.

No examples provided.

create_sign_request ~84

Creates a Box Sign signature request by preparing a document for signing and dispatching it to one or more signers. Use this to initiate a new e-signature workflow on a document stored in Box.

NameTypeReqDescription
bodyobjectThe request body containing all details needed to create the signature request, including the document to be signed, signer information, and any signing configuration options.

No output schema declared.

No examples provided.

create_skill_cards ~129

Applies one or more Box Skills metadata cards to a specified file, enabling AI-generated insights such as transcripts, topics, or keywords to be attached as structured metadata.

NameTypeReqDescription
cardsarrayAn array of Box Skill card objects to attach to the file. Each item should represent a valid skill card type (e.g., keyword, transcript, timeline, or status card); order is not significant.
file_idstringyesThe unique identifier of the file to which Box Skill cards will be applied. The file ID can be found in the URL when viewing the file in the Box web application.

No output schema declared.

No examples provided.

create_task ~239

Creates a new task on a specified file, optionally configuring the action type, due date, message, and completion rules. The task must be assigned to users separately after creation.

NameTypeReqDescription
actionstringThe action assignees will be prompted to perform: 'review' creates an approval task that can be approved or rejected, while 'complete' creates a general task that can simply be marked as done.
completion_rulestringDetermines how many assignees must act on the task before it is considered complete: 'all_assignees' requires every assignee to respond, while 'any_assignee' requires only one.
due_atstringThe deadline by which the task should be completed, specified as an ISO 8601 date-time string. Defaults to null if omitted.
idstringThe unique identifier of the file on which the task will be created.
messagestringAn optional message displayed to task assignees providing context or instructions for the task.
typestringThe type of item the task is being created on; must always be set to 'file'.

No output schema declared.

No examples provided.

create_teams_integration_mapping ~91

Creates a Teams integration mapping by linking a Microsoft Teams channel to a Box item. Requires Admin or Co-Admin role.

NameTypeReqDescription
box_itemobjectThe Box item (such as a folder) to map to the Teams channel, identifying the Box-side resource in the integration.
partner_itemobjectThe Microsoft Teams channel to map, identifying the partner-side resource in the integration.

No output schema declared.

No examples provided.

create_terms_of_service_user_status ~122

Creates or sets the acceptance status of a terms of service agreement for a specific user. Use this to record whether a new user has accepted or declined a given terms of service.

NameTypeReqDescription
is_acceptedbooleanIndicates whether the user has accepted the terms of service; set to true if accepted, false if declined.
tosIdstringThe unique identifier of the terms of service document to associate with the user status.
userIdstringThe unique identifier of the user whose terms of service acceptance status is being recorded.

No output schema declared.

No examples provided.

create_upload_session ~82

Initiates a chunked upload session for uploading a new file, returning a session ID and upload URLs to use for subsequent chunk uploads.

NameTypeReqDescription
file_namestringThe name to assign to the new file once the upload session is complete.
folder_idstringThe ID of the destination folder where the new file will be stored upon upload completion.

No output schema declared.

No examples provided.

create_user ~556

Creates a new managed or app user within a Box enterprise account. Requires admin-level permissions on the calling user or application.

NameTypeReqDescription
addressstringThe user's physical address as displayed in their profile, limited to 255 characters.
can_see_managed_usersbooleanWhether the user can view and search other managed users within the enterprise in their contact list.
external_app_user_idstringA custom identifier from an external identity provider that can be used to look up and map this Box user to an external system's user record.
is_exempt_from_device_limitsbooleanWhen set to true, exempts the user from the enterprise-wide limit on the number of devices they can log in from.
is_exempt_from_login_verificationbooleanWhen set to true, exempts the user from the enterprise's two-factor authentication requirement at login.
is_external_collab_restrictedbooleanWhen set to true, restricts the user from collaborating on content with users outside the enterprise.
is_platform_access_onlybooleanWhen set to true, designates this user as a platform (app) user rather than a standard managed enterprise user.
is_sync_enabledbooleanWhether the user is permitted to use Box Sync to synchronize files to their local device.
job_titlestringThe user's job title as displayed in their profile, limited to 100 characters.
languagestringThe display language for the user's Box interface, formatted as a modified ISO 639-1 language code.
name_and_loginstringThe user's display name and login email in RFC 5322 format: "Display Name <user@example.com>". The login email is required unless is_platform_access_only is true, in which case you may omit the angle…
phonestringThe user's phone number as displayed in their profile, limited to 100 characters.
rolestringThe user's role within the enterprise, either a co-administrator with elevated privileges or a standard user.
space_amountstringThe total storage quota allocated to the user in bytes. Use -1 to grant unlimited storage.
statusstringThe initial account status for the user, controlling their ability to log in and interact with content.
timezonestringThe user's local timezone, used for scheduling and display purposes, specified as a timezone identifier string.
tracking_codesarrayA list of tracking code objects (each with a name and value) used to categorize users for admin reporting. This feature must be enabled for the enterprise before use; order is not significant.

No output schema declared.

No examples provided.

create_web_link ~151

Creates a web link object inside a specified folder, storing a URL as a navigable item within Box. Useful for bookmarking external resources directly within a folder hierarchy.

NameTypeReqDescription
descriptionstringAn optional human-readable description providing additional context about the web link's destination or purpose.
idstringThe ID of the parent folder where the web link will be created. Use '0' to target the root folder.
namestringA display name for the web link as it appears in the folder. If omitted, the URL is used as the name.
urlstringThe full URL the web link points to. Must begin with 'http://' or 'https://'.

No output schema declared.

No examples provided.

create_zip_download ~128

Initiates a zip archive download request for multiple files and folders, validating access permissions and returning a download URL and status URL. The archive is limited to 10,000 files or the account's upload limit, with a recommended maximum total size of 25GB.

NameTypeReqDescription
download_file_namestringThe base name for the generated zip archive file, without the file extension. The `.zip` extension will be appended automatically.
itemsarrayA list of files and folders to include in the zip archive. Order is not significant; each item should specify its type and identifier.

No output schema declared.

No examples provided.

delete_barrier_segment ~60

Permanently deletes a shield information barrier segment by its unique ID. This action removes the segment and its associated configurations from the information barrier.

NameTypeReqDescription
shield_information_barrier_segment_idstringyesThe unique identifier of the shield information barrier segment to delete.

No output schema declared.

No examples provided.

delete_barrier_segment_member ~67

Permanently removes a specific member from a shield information barrier segment. Use this to revoke a user's association with a segment when access restrictions need to be updated.

NameTypeReqDescription
shield_information_barrier_segment_member_idstringyesThe unique identifier of the shield information barrier segment member to delete.

No output schema declared.

No examples provided.

delete_collaboration ~50

Permanently removes a collaboration by its unique identifier. This action cannot be undone and will revoke the associated access or shared relationship.

NameTypeReqDescription
collaboration_idstringyesThe unique identifier of the collaboration to delete.

No output schema declared.

No examples provided.

delete_comment ~44

Permanently deletes a comment by its unique identifier. This action is irreversible and cannot be undone.

NameTypeReqDescription
comment_idstringyesThe unique identifier of the comment to permanently delete.

No output schema declared.

No examples provided.

delete_device_pin ~53

Permanently removes a specific device pin, revoking the trusted device association for the corresponding user. This action cannot be undone.

NameTypeReqDescription
device_pinner_idstringyesThe unique identifier of the device pin to delete.

No output schema declared.

No examples provided.

delete_file ~57

Deletes a specified file from Box, either permanently or by moving it to the trash depending on enterprise settings.

NameTypeReqDescription
file_idstringyesThe unique identifier of the file to delete. Visible in the file's URL on the Box web application.

No output schema declared.

No examples provided.

delete_file_metadata ~148

Removes a specific metadata instance from a file by deleting the metadata template applied under the given scope. This permanently detaches the metadata from the file without affecting the file itself.

NameTypeReqDescription
file_idstringyesThe unique identifier of the file from which metadata will be removed. The file ID can be found in the URL when viewing the file in the Box web application.
scopestringyesThe scope of the metadata template to delete, either 'global' for Box-wide templates or 'enterprise' for templates specific to your organization.
template_keystringyesThe unique key identifying the metadata template to remove from the file, corresponding to the template's defined key within the specified scope.

No output schema declared.

No examples provided.

Common questions

What is the com.mcparmory/box MCP server?

com.mcparmory/box is an MCP server listed in the public MCP registry as com.mcparmory/box. Manage files, folders, and team collaboration with access controls. This page covers its container image (ghcr.io/mcparmory/box:1.0.5).

Is the com.mcparmory/box MCP server safe to use?

com.mcparmory/box scores 50 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the com.mcparmory/box MCP server expose?

com.mcparmory/box exposes 246 tools: get_file, restore_file, update_file, delete_file, list_file_app_item_associations, and 241 more. Their descriptions and schemas cost roughly 34,690 tokens of context every time the server is loaded.

Is the com.mcparmory/box MCP server still maintained?

com.mcparmory/box is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.