com.mcparmory/box
PYPI · MCPARMORY-BOX · 2 COMPONENTS · SCANNED SEP 20
Manage files, folders, and team collaboration with access controls
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Install-script risk not yet assessed.Unverified
- 2 of 46 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (MIT License) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 131 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 34690 tokens (~141/item across 246 items; 246 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety98
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 41 of 44 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "transfer_user_folders" implies "transfer" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
- An AI judge read all 246 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the com.mcparmory/box MCP server?
com.mcparmory/box runs locally as a PyPI package, launched with uvx mcparmory-box. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · mcparmory-box
claude mcp add com-mcparmory-box -- uvx mcparmory-box
{
"mcpServers": {
"com-mcparmory-box": {
"command": "uvx",
"args": [
"mcparmory-box"
]
}
}
} {
"servers": {
"com-mcparmory-box": {
"command": "uvx",
"args": [
"mcparmory-box"
]
}
}
} codex mcp add com-mcparmory-box -- uvx mcparmory-box
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-mcparmory-box": {
"type": "local",
"command": [
"uvx",
"mcparmory-box"
],
"enabled": true
}
}
} openclaw mcp add com-mcparmory-box --command uvx --arg mcparmory-box
mcp_servers:
com-mcparmory-box:
command: "uvx"
args: ["mcparmory-box"] {
"McpServers": {
"com-mcparmory-box": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"mcparmory-box"
]
}
}
} assistant mcp add com-mcparmory-box -t stdio -c uvx -a mcparmory-box
{
"mcpServers": {
"com-mcparmory-box": {
"command": "uvx",
"args": [
"mcparmory-box"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- 15 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 −18
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/mcparmory-box@1.0.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Dependencies 46 packages
| Packages resolved | 46 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
abort_upload_session Abort Upload Session ~62
Permanently aborts an active upload session and discards all uploaded data. This action is irreversible and cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| upload_session_id | string | yes | The unique identifier of the upload session to abort, as returned by the Create or Get upload session endpoints. |
No output schema declared.
No examples provided.
add_barrier_segment_member Add Barrier Segment Member ~114
Adds a user as a member of a shield information barrier segment, applying the segment's information restrictions to that user.
| Name | Type | Req | Description |
|---|---|---|---|
| shield_information_barrierId | string | – | The unique identifier of the shield information barrier that the target segment belongs to. |
| shield_information_barrier_segmentId | string | – | The unique identifier of the shield information barrier segment to which the user will be added as a member. |
| user | object | – | The user object representing the individual to whom the segment's information barrier restrictions will be applied. |
No output schema declared.
No examples provided.
add_file_classification Add File Classification ~126
Adds a security classification label to a file in Box. Use this to apply an enterprise-defined classification (e.g., Confidential, Sensitive) to control how the file is handled and shared.
| Name | Type | Req | Description |
|---|---|---|---|
| Box__Security__Classification__Key | string | – | The classification label to apply to the file. Must match one of the available classification keys defined in the enterprise's classification template; retrieve valid keys from the classification tem… |
| file_id | string | yes | The unique identifier of the file to classify. The file ID can be found in the file's URL in the Box web application. |
No output schema declared.
No examples provided.
add_file_shared_link Add File Shared Link ~418
Creates or updates a shared link on a file, controlling access level, permissions, expiration, and optional password protection. Returns the file with the shared link fields populated.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The visibility level of the shared link. Use 'open' for anyone with the link, 'company' for internal users only (paid accounts only), or 'collaborators' for explicitly invited users only. Defaults to… |
| can_download | boolean | – | Whether the shared link permits downloading the file. Can only be set when access is 'open' or 'company'. |
| can_edit | boolean | – | Whether the shared link permits editing the file. Can only be set when access is 'open' or 'company', and requires can_download to also be true. |
| can_preview | boolean | – | Whether the shared link permits previewing the file. This value is always true and applies to all items within a folder when set on a folder shared link. |
| fields | string | yes | A comma-separated list of fields to include in the response. Must include 'shared_link' to return shared link details in the response. |
| file_id | string | yes | The unique identifier of the file to add a shared link to. Visible in the file's URL in the Box web application. |
| password | string | – | An optional password required to access the shared link. Must be at least eight characters and include a number, uppercase letter, or non-alphanumeric character. Can only be set when access is 'open'… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link expires and becomes inaccessible. Must be a future datetime. Only available to paid account users. |
| vanity_name | string | – | A custom vanity slug appended to the shared link URL (e.g., https://app.box.com/v/{vanity_name}). Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to… |
No output schema declared.
No examples provided.
add_folder_classification Add Folder Classification ~107
Applies a security classification label to a specified folder. The classification must exist in the enterprise's classification template.
| Name | Type | Req | Description |
|---|---|---|---|
| Box__Security__Classification__Key | string | – | The classification label to apply to the folder. Must match an existing classification key from the enterprise's security classification template. |
| folder_id | string | yes | The unique identifier of the folder to classify. The ID can be found in the folder's URL in the Box web app; the root folder is always ID '0'. |
No output schema declared.
No examples provided.
add_folder_shared_link Add Folder Shared Link ~427
Adds or updates a shared link on a folder, controlling access level, password protection, expiration, and permissions for viewing or downloading folder contents.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The visibility level of the shared link: `open` for anyone with the link, `company` for users within the enterprise (paid accounts only), or `collaborators` for only invited collaborators. Omitting t… |
| can_download | boolean | – | Whether recipients of the shared link are permitted to download files in the folder. Can only be set when access is `open` or `company`. |
| can_edit | boolean | – | Whether recipients of the shared link are permitted to edit items. For folders, this value can only be `false`. |
| can_preview | boolean | – | Whether recipients of the shared link are permitted to preview files in the folder. This value is always `true` and applies to all items within the folder. |
| fields | string | yes | A comma-separated list of fields to include in the response. Must include `shared_link` to return the shared link details in the response. |
| folder_id | string | yes | The unique identifier of the folder to add a shared link to. The ID appears in the folder's URL in the Box web app, and the root folder is always ID `0`. |
| password | string | – | An optional password required to access the shared link. Must be at least 8 characters and include a number, uppercase letter, or non-alphanumeric character. Can only be set when access is `open`; se… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link expires and becomes inaccessible. Must be a future date and time, and can only be set by users on paid accounts. |
| vanity_name | string | – | A custom vanity name to use in the shared link URL path. Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to guess than standard shared links. |
No output schema declared.
No examples provided.
add_user_to_group Add User to Group ~156
Adds a user to a group with a specified role and optional custom admin permissions. Requires admin-level permissions to perform this action.
| Name | Type | Req | Description |
|---|---|---|---|
| configurable_permissions | object | – | Custom permission overrides for group admins only; has no effect on members with the 'member' role. Pass null to disable all configurable permissions, or specify individual permissions — any omitted… |
| groupId | string | – | The unique identifier of the group the user will be added to. |
| role | string | – | The role assigned to the user within the group. Use 'member' for standard access or 'admin' for elevated group management privileges. |
| userId | string | – | The unique identifier of the user to be added to the group. |
No output schema declared.
No examples provided.
add_web_link_shared_link Add Web Link Shared Link ~408
Adds or updates a shared link on a web link item, controlling access level, password protection, expiration, and permissions. Returns the web link with the shared link fields populated.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The visibility level of the shared link: 'open' allows anyone with the link, 'company' restricts to users within the enterprise (paid accounts only), and 'collaborators' restricts to explicitly invit… |
| can_download | boolean | – | Whether recipients of the shared link are permitted to download the web link. Can only be set when access is 'open' or 'company'. |
| can_edit | boolean | – | Whether recipients of the shared link are permitted to edit the item. Can only be true when the item type is a file. |
| can_preview | boolean | – | Whether recipients of the shared link are permitted to preview the web link. This value is always true and also applies to items within a shared folder. |
| fields | string | yes | A comma-separated list of fields to include in the response; must include 'shared_link' to return the shared link details. |
| password | string | – | An optional password required to access the shared link; set to null to remove an existing password. Must be at least eight characters and include a number, uppercase letter, or non-alphanumeric char… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link will automatically expire and become inaccessible. Must be a future datetime and can only be set by users on paid accounts. |
| vanity_name | string | – | A custom vanity name used in the shared link URL path, forming a human-readable URL. Must be at least 12 characters; avoid using vanity names for sensitive content as they are easier to guess. |
| web_link_id | string | yes | The unique identifier of the web link to which the shared link will be added. |
No output schema declared.
No examples provided.
apply_file_watermark Apply File Watermark ~95
Applies or updates a watermark on a specified file in Box. Use this to protect file content by overlaying a visible watermark when the file is viewed or downloaded.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the file to watermark. Found in the file's URL in the Box web application. |
| imprint | string | – | The type of watermark to apply to the file. Currently only the default imprint style is supported. |
No output schema declared.
No examples provided.
apply_folder_watermark Apply Folder Watermark ~110
Applies or updates a watermark on a specified folder in Box. Use this to protect folder contents by overlaying a visible watermark imprint.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | yes | The unique identifier of the folder to watermark. The folder ID can be found in the URL when viewing the folder in the Box web app. The root folder of any Box account is always ID `0`. |
| imprint | string | – | The type of watermark imprint to apply to the folder. Currently only the default imprint style is supported. |
No output schema declared.
No examples provided.
apply_metadata_cascade_policy Apply Metadata Cascade Policy ~136
Force-applies a metadata cascade policy to all existing children within a folder, ensuring inherited metadata values are propagated down. Useful after creating a new cascade policy to retroactively enforce metadata on files already present in the folder.
| Name | Type | Req | Description |
|---|---|---|---|
| conflict_resolution | string | – | Determines how to handle conflicts when a child file already has an instance of the metadata template applied. Use 'none' to preserve existing values on the child, or 'overwrite' to replace them with… |
| metadata_cascade_policy_id | string | yes | The unique identifier of the metadata cascade policy to force-apply to the folder's children. |
No output schema declared.
No examples provided.
assign_legal_hold_policy Assign Legal Hold Policy ~145
Assigns a legal hold policy to a specific item, such as a file, file version, folder, user, ownership, or interactions. Use this to enforce legal holds across different content types within Box.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | The unique identifier of the specific item (file, folder, user, etc.) to which the legal hold policy will be assigned. |
| policy_id | string | – | The unique identifier of the legal hold policy to assign to the target item. |
| type | string | – | The category of item to which the legal hold policy will be applied. Must be one of: file, file_version, folder, user, ownership, or interactions. |
No output schema declared.
No examples provided.
assign_retention_policy Assign Retention Policy ~244
Assigns a retention policy to a specific target, such as a folder, enterprise, or metadata template. Use this to enforce data retention rules on content within Box.
| Name | Type | Req | Description |
|---|---|---|---|
| filter_fields | array | – | An array of field-value filter objects used to narrow the assignment when the target type is 'metadata_template'. Each object must contain a 'field' key and a 'value' key; currently only one filter o… |
| id | string | – | The unique identifier of the specific folder or metadata template to assign the policy to. Omit or set to null when assigning to the entire enterprise. |
| policy_id | string | – | The unique identifier of the retention policy to assign to the target item. |
| start_date_field | string | – | The date from which the retention policy assignment takes effect. When the target type is 'metadata_template', this can reference a date-type metadata attribute key ID to dynamically determine the st… |
| type | string | – | The category of item the retention policy will be assigned to. Use 'enterprise' to apply policy-wide, 'folder' for a specific folder, or 'metadata_template' to target items matching a metadata templa… |
No output schema declared.
No examples provided.
assign_storage_policy Assign Storage Policy ~138
Assigns a storage policy to a specific user or enterprise, controlling where their content is stored. Use this to enforce data residency or storage tier requirements.
| Name | Type | Req | Description |
|---|---|---|---|
| assigned_toId | string | – | The unique identifier of the user or enterprise to which the storage policy will be assigned. |
| assigned_toType | string | – | The type of entity receiving the storage policy assignment, either an individual user or an entire enterprise. |
| storage_policyId | string | – | The unique identifier of the storage policy to assign to the target entity. |
| storage_policyType | string | – | The resource type being assigned as the storage policy; must always be 'storage_policy'. |
No output schema declared.
No examples provided.
assign_task Assign Task ~145
Assigns a task to a specific user by user ID or email address. A task can be assigned to multiple users by creating separate assignments.
| Name | Type | Req | Description |
|---|---|---|---|
| assign_toId | string | – | The unique identifier of the user to assign the task to. Use the `login` parameter instead to specify the user by email address. |
| login | string | – | The email address of the user to assign the task to. Use the `id` parameter instead to specify the user by their unique user ID. |
| taskId | string | – | The unique identifier of the task to be assigned. |
| type | string | – | The type of the item being assigned. Must always be set to 'task'. |
No output schema declared.
No examples provided.
cancel_sign_request Cancel Sign Request ~83
Cancels an active Box Sign request, preventing further signing actions by any recipients. An optional reason can be provided to document why the request was cancelled.
| Name | Type | Req | Description |
|---|---|---|---|
| reason | string | – | An optional explanation for why the sign request is being cancelled, useful for audit trails and notifying stakeholders. |
| sign_request_id | string | yes | The unique identifier of the sign request to cancel. |
No output schema declared.
No examples provided.
commit_upload_session Commit Upload Session ~140
Finalizes an upload session by assembling all uploaded chunks into a complete file. Must be called after all parts have been uploaded to close the session and persist the file.
| Name | Type | Req | Description |
|---|---|---|---|
| digest | string | yes | The RFC 3230 message digest of the entire file used to verify integrity. Must be a Base64-encoded SHA1 hash formatted as `sha=<BASE64_ENCODED_DIGEST>`. |
| parts | array | – | An ordered list of part details representing all uploaded chunks that should be assembled into the final file. Each item should describe a previously uploaded part. |
| upload_session_id | string | yes | The unique identifier of the upload session to commit. |
No output schema declared.
No examples provided.
copy_file Copy File ~179
Creates a copy of an existing file, optionally placing it in a different folder, renaming it, or copying a specific version. Returns the metadata of the newly created file copy.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the file to copy. Visible in the Box web app URL when viewing the file. |
| id | string | – | The ID of the destination folder where the copied file will be placed. Use '0' to copy the file to the root folder. |
| name | string | – | An optional new name for the copied file. Must not exceed 255 characters; non-printable ASCII characters, forward/backward slashes, and reserved names like '.' and '..' are automatically sanitized. |
| version | string | – | The ID of a specific file version to copy. If omitted, the latest version of the file is copied. |
No output schema declared.
No examples provided.
copy_file_request Copy File Request ~115
Copies an existing file request from one folder and applies it to another folder, duplicating its settings and configuration. Useful for reusing file request templates across multiple folders without manual recreation.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | – | The request body specifying the destination folder and any overrides to apply to the copied file request, such as a new title or description. |
| file_request_id | string | yes | The unique identifier of the file request to copy. Find this ID in the URL when viewing a file request in the Box web application's file request builder. |
No output schema declared.
No examples provided.
copy_folder Copy Folder ~158
Creates a copy of an existing folder and places it inside a specified destination folder. The original folder and its contents remain unchanged.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | yes | The unique identifier of the folder to copy. The folder ID can be found in the Box web app URL when viewing the folder. The root folder (ID '0') cannot be copied. |
| id | string | – | The ID of the destination parent folder where the copied folder will be placed. |
| name | string | – | An optional name for the copied folder. If omitted, the original folder name is used. Names must be between 1 and 255 characters, cannot contain non-printable ASCII characters, forward or backward sl… |
No output schema declared.
No examples provided.
create_ai_agent Create AI Agent ~948
Creates a new AI agent with one or more capabilities (ask, text_gen, or extract). At least one capability must be configured when creating the agent.
| Name | Type | Req | Description |
|---|---|---|---|
| access_state | string | – | Controls the overall availability of the AI agent. Use `enabled` to make it available to all, `disabled` to deactivate it, or `enabled_for_selected_users` to restrict access to specific users. |
| allowed_entities | array | – | List of users or groups permitted to use this AI agent when access is restricted to selected entities. Each item should reference a valid user or group. |
| askAccess_state | string | – | Controls whether the ask capability is active. Set to `enabled` to allow users to ask questions, or `disabled` to turn it off. |
| askBasic_image | object | – | Configuration for the processor that handles image content within the ask capability, including model and prompt settings. |
| askBasic_text | object | – | Configuration for the processor that handles standard-length text content within the ask capability, including model and prompt settings. |
| askCustom_instructions | string | – | Custom behavioral instructions that guide how the ask capability responds, allowing tailored tone, scope, or domain-specific rules. |
| askDescription | string | – | Human-readable description of the ask capability, explaining its purpose or behavior to users. |
| askLong_text | object | – | Configuration for the processor that handles long-form text content within the ask capability, such as chunking strategy and model settings. |
| askSuggested_questions | array | – | Up to 4 pre-defined questions surfaced to users when interacting with the ask capability. Pass null to auto-generate suggestions, or an empty array to show none. |
| askType | string | – | Identifies the ask capability block as an AI agent ask handler. |
| basic_gen | object | – | Configuration for the basic text generation tool used by the text_gen capability, controlling model behavior and prompt structure for content generation. |
| basic_image_multi | object | – | Configuration for the processor that handles images across multiple documents or segments, used for multi-document ask scenarios. |
| basic_text_multi | object | – | Configuration for the processor that handles standard-length text across multiple documents or segments, used for multi-document ask scenarios. |
| extractAccess_state | string | – | Controls whether the metadata extraction capability is active. Set to `enabled` to allow extraction, or `disabled` to turn it off. |
| extractBasic_image | object | – | Configuration for the processor that handles image content within the extract capability, including model and prompt settings. |
| extractBasic_text | object | – | Configuration for the processor that handles standard-length text content within the extract capability, including model and prompt settings. |
| extractCustom_instructions | string | – | Custom behavioral instructions that guide how the extract capability identifies and pulls metadata, allowing tailored scope or domain-specific rules. |
| extractDescription | string | – | Human-readable description of the extract capability, explaining its purpose or behavior to users. |
| extractLong_text | object | – | Configuration for the processor that handles long-form text content within the extract capability, such as chunking strategy and model settings. |
| extractType | string | – | Identifies the extract capability block as an AI agent metadata extractor. |
| icon_reference | string | – | URL pointing to the avatar icon displayed for this AI agent in the UI. Must be a valid Box CDN URL using one of the supported avatar filenames. |
| long_text_multi | object | – | Configuration for the processor that handles long-form text across multiple documents or segments, used for multi-document ask scenarios. |
| name | string | – | Human-readable display name for the AI agent, shown in the UI and used to identify the agent. |
| spreadsheet | object | – | Configuration for the tool that processes spreadsheet and tabular data, controlling how structured data is interpreted by the agent. |
| text_genAccess_state | string | – | Controls whether the text generation capability is active. Set to `enabled` to allow text generation, or `disabled` to turn it off. |
| text_genCustom_instructions | string | – | Custom behavioral instructions that guide how the text generation capability produces output, allowing tailored tone, scope, or domain-specific rules. |
| text_genDescription | string | – | Human-readable description of the text generation capability, explaining its purpose or behavior to users. |
| text_genSuggested_questions | array | – | Up to 4 pre-defined questions surfaced to users when interacting with the text generation capability. Pass null to auto-generate suggestions, or an empty array to show none. |
| text_genType | string | – | Identifies the text generation capability block as an AI agent text generator. |
| type | string | – | Identifies this configuration as an AI agent resource. |
No output schema declared.
No examples provided.
create_barrier_report Create Barrier Report ~92
Generates a compliance report for a specified shield information barrier, providing a snapshot of the barrier's configuration and activity. Useful for auditing and regulatory review of information separation policies.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | The unique identifier of the shield information barrier for which the report will be generated. |
| type | string | – | The resource type of the shield information barrier being referenced. Must be set to the designated barrier type value. |
No output schema declared.
No examples provided.
create_barrier_segment Create Barrier Segment ~133
Creates a named segment within an existing shield information barrier, allowing organizations to define distinct groups or divisions for information separation and compliance purposes.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | An optional narrative description providing additional context about the barrier segment's purpose or the division it represents. |
| id | string | – | The unique identifier of the parent shield information barrier under which this segment will be created. |
| name | string | – | A human-readable name for the barrier segment that identifies the division or group being isolated. |
| type | string | – | The resource type of the associated shield information barrier; must be set to the designated barrier type value. |
No output schema declared.
No examples provided.
create_collaboration Create Collaboration ~392
Grants a single user or group access to a file or folder by creating a collaboration with a specified role. Collaborators can be identified by user ID, group ID, or email address.
| Name | Type | Req | Description |
|---|---|---|---|
| accessible_byId | string | – | The unique Box ID of the user or group being invited. Use this or the email-based login field to identify a user, but not both. |
| accessible_byType | string | – | Specifies whether the collaborator being invited is an individual user or a group. Group invitations depend on the group's invite permissions. |
| can_view_path | boolean | – | When true, allows the collaborator to see the full parent folder path to the shared folder without gaining access to parent folder contents. Only applicable to folder collaborations, and only owners… |
| expires_at | string | – | The date and time at which the collaboration will be automatically removed from the item, provided in ISO 8601 format. Requires the expiry extension setting to be enabled in the Admin Console Enterpr… |
| is_access_only | boolean | – | When true, the collaborator can access the shared item but it will not appear in their All Files list and the root folder path will be hidden. |
| itemId | string | – | The unique Box ID of the file or folder to which access is being granted. |
| itemType | string | – | The type of Box item the collaboration will be granted access to, either a file or a folder. |
| login | string | – | The email address of the user to invite as a collaborator. Use this or the user ID field to identify a user, but not both. |
| notify | boolean | – | Whether to send an email notification to the invited collaborator when the collaboration is created. |
| role | string | – | The permission level granted to the collaborator, controlling what actions they can perform on the item. |
No output schema declared.
No examples provided.
create_comment Create Comment ~135
Creates a new comment on a file or as a reply to an existing comment. Supports mentioning other users via a tagged message syntax to trigger email notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | The unique identifier of the file or comment this comment will be attached to. |
| tagged_message | string | – | The text of the comment using mention syntax to tag another user, formatted as `@[user_id:display_name]` anywhere in the message. Use the plain `message` parameter instead if no user mentions are nee… |
| type | string | – | Specifies whether the comment is being placed on a file or as a reply to an existing comment. |
No output schema declared.
No examples provided.
create_email_alias Create Email Alias ~101
Adds a new email alias to an existing user account, allowing the user to send and receive email under an additional address. The alias domain must be registered and verified under your enterprise.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | The email address to register as an alias on the user account. The domain portion must be verified and registered to your enterprise before use. | |
| user_id | string | yes | The unique identifier of the user account to which the email alias will be added. |
No output schema declared.
No examples provided.
create_file_metadata Create File Metadata ~185
Applies an instance of a metadata template to a file, associating structured key-value data with it. Only keys defined in the specified template are accepted, except for the global.properties template which allows arbitrary key-value pairs.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | – | A JSON object containing the metadata field key-value pairs to populate on the template instance. Keys must match those defined in the template, unless using the global.properties template. |
| file_id | string | yes | The unique identifier of the file to which the metadata instance will be applied. Visible in the file's URL in the Box web application. |
| scope | string | yes | The scope of the metadata template to apply, either global (Box-provided templates) or enterprise (custom templates defined by your organization). |
| template_key | string | yes | The unique key identifying the metadata template within the given scope, corresponding to the template's defined name. |
No output schema declared.
No examples provided.
create_file_upload_session Create File Upload Session ~113
Creates a chunked upload session for an existing file, enabling large file uploads to be split into multiple parts. Use the returned session to upload individual chunks and complete the upload.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the existing file for which the upload session will be created. The file ID can be found in the file's URL in the Box web application. |
| file_name | string | – | An optional new name to assign to the file upon completing the upload session, replacing the current file name. |
No output schema declared.
No examples provided.
create_folder Create Folder ~237
Creates a new empty folder inside a specified parent folder. The folder name must be unique within the parent (case-insensitive) and must not contain invalid characters or trailing spaces.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_upload_email | object | – | Optional email upload configuration for the folder, allowing files to be uploaded by sending an email to a folder-specific address. |
| id | string | – | The unique ID of the parent folder in which the new folder will be created. Use '0' to create the folder at the root level of the user's account. |
| name | string | – | The display name for the new folder. Must be between 1 and 255 characters, must not contain non-printable ASCII characters, forward or backward slashes, or trailing spaces, and cannot be '.' or '..'.… |
| sync_state | string | – | Specifies the sync state of the folder for Box Sync (discontinued). Accepted values are 'synced' (fully synced), 'not_synced' (not synced), or 'partially_synced' (some contents synced). Not applicabl… |
No output schema declared.
No examples provided.
create_folder_metadata Create Folder Metadata ~228
Applies an instance of a metadata template to a folder, attaching structured key-value data based on the specified template. Note that the enterprise must have Cascading Folder Level Metadata enabled in the admin console for the metadata to appear in the Box web app.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | – | The metadata key-value pairs to store on the folder, conforming to the fields defined in the specified template. The `global.properties` template accepts any arbitrary key-value pairs. |
| folder_id | string | yes | The unique identifier of the folder to which the metadata instance will be applied. The root folder of a Box account always uses ID `0`; other folder IDs can be found in the URL when viewing the fold… |
| scope | string | yes | The scope of the metadata template to apply, either `global` for Box-wide templates or `enterprise` for templates defined within your enterprise. |
| template_key | string | yes | The unique key name of the metadata template to apply to the folder. Use `properties` for the global free-form key-value template, which accepts any key-value pair. |
No output schema declared.
No examples provided.
create_group Create Group ~328
Creates a new user group within an enterprise account. Requires admin permissions; supports linking to external directory systems like Active Directory or Okta for one-way sync.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | A human-readable description providing additional context about the group's purpose or origin. Maximum 255 characters. |
| external_sync_identifier | string | – | An arbitrary identifier used to link this Box group to a corresponding group in an external system, such as an Active Directory Object ID or Google Group ID. Using this field is recommended to preven… |
| invitability_level | string | – | Controls who can invite this group to collaborate on folders. Use `admins_only` to restrict invitations to enterprise admins, co-admins, and the group's admin; `admins_and_members` to also allow grou… |
| member_viewability_level | string | – | Controls who can view the membership list of this group. Use `admins_only` to restrict visibility to enterprise admins, co-admins, and the group's admin; `admins_and_members` to also allow group memb… |
| name | string | – | The display name for the new group, which must be unique across the entire enterprise. |
| provenance | string | – | Identifies the external source system this group originates from (e.g., Active Directory or Okta). Setting this prevents Box admins from editing the group name or members via the Box web app, enablin… |
No output schema declared.
No examples provided.
create_metadata_cascade_policy Create Metadata Cascade Policy ~122
Creates a metadata cascade policy that automatically applies a metadata template from a specified folder down to all files within it. The folder must already have an instance of the target metadata template applied before the policy can take effect.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | – | The unique identifier of the folder to which the cascade policy will be applied. The folder must already have an instance of the target metadata template applied to it. |
| metadata_template | string | – | The metadata template identifier in 'scope/templateKey' format (e.g., 'enterprise_12345/contractTemplate') |
No output schema declared.
No examples provided.
create_metadata_template Create Metadata Template ~285
Creates a new metadata template that can be applied to files and folders within an enterprise, defining custom fields for organizing and categorizing content.
| Name | Type | Req | Description |
|---|---|---|---|
| copyInstanceOnItemCopy | boolean | – | Determines whether metadata instances attached to a file or folder are automatically copied when that item is copied. Defaults to false, meaning metadata is not copied. |
| displayName | string | – | The human-readable name of the template shown in the Box UI and API responses, up to 4096 characters. |
| fields | array | – | An ordered list of field definitions that make up the template. Each field can be of type text, date, number, single-select, or multi-select list, and the order provided determines display order. |
| hidden | boolean | – | Controls whether the template is visible in the Box web app UI. Set to true to hide it and restrict usage to API access only. |
| scope | string | – | The scope under which the metadata template will be created. Must be set to 'enterprise', as global-scoped templates cannot be created via the API. |
| templateKey | string | – | A unique identifier for the template across the enterprise, used to reference it programmatically. Must start with a letter or underscore, followed by letters, digits, hyphens, or underscores, up to… |
No output schema declared.
No examples provided.
create_shield_information_barrier Create Shield Information Barrier ~71
Creates a shield information barrier within an enterprise to separate individuals or groups and prevent confidential information from passing between them. Use this to enforce ethical walls or compliance boundaries within the same firm.
| Name | Type | Req | Description |
|---|---|---|---|
| enterprise | object | – | The type and ID of the enterprise under which this shield information barrier will be created. |
No output schema declared.
No examples provided.
create_sign_request Create Sign Request ~84
Creates a Box Sign signature request by preparing a document for signing and dispatching it to one or more signers. Use this to initiate a new e-signature workflow on a document stored in Box.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | – | The request body containing all details needed to create the signature request, including the document to be signed, signer information, and any signing configuration options. |
No output schema declared.
No examples provided.
create_skill_cards Create Skill Cards ~129
Applies one or more Box Skills metadata cards to a specified file, enabling AI-generated insights such as transcripts, topics, or keywords to be attached as structured metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| cards | array | – | An array of Box Skill card objects to attach to the file. Each item should represent a valid skill card type (e.g., keyword, transcript, timeline, or status card); order is not significant. |
| file_id | string | yes | The unique identifier of the file to which Box Skill cards will be applied. The file ID can be found in the URL when viewing the file in the Box web application. |
No output schema declared.
No examples provided.
create_task Create Task ~239
Creates a new task on a specified file, optionally configuring the action type, due date, message, and completion rules. The task must be assigned to users separately after creation.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | The action assignees will be prompted to perform: 'review' creates an approval task that can be approved or rejected, while 'complete' creates a general task that can simply be marked as done. |
| completion_rule | string | – | Determines how many assignees must act on the task before it is considered complete: 'all_assignees' requires every assignee to respond, while 'any_assignee' requires only one. |
| due_at | string | – | The deadline by which the task should be completed, specified as an ISO 8601 date-time string. Defaults to null if omitted. |
| id | string | – | The unique identifier of the file on which the task will be created. |
| message | string | – | An optional message displayed to task assignees providing context or instructions for the task. |
| type | string | – | The type of item the task is being created on; must always be set to 'file'. |
No output schema declared.
No examples provided.
create_teams_integration_mapping Create Teams Integration Mapping ~91
Creates a Teams integration mapping by linking a Microsoft Teams channel to a Box item. Requires Admin or Co-Admin role.
| Name | Type | Req | Description |
|---|---|---|---|
| box_item | object | – | The Box item (such as a folder) to map to the Teams channel, identifying the Box-side resource in the integration. |
| partner_item | object | – | The Microsoft Teams channel to map, identifying the partner-side resource in the integration. |
No output schema declared.
No examples provided.
create_terms_of_service_user_status Create Terms of Service User Status ~122
Creates or sets the acceptance status of a terms of service agreement for a specific user. Use this to record whether a new user has accepted or declined a given terms of service.
| Name | Type | Req | Description |
|---|---|---|---|
| is_accepted | boolean | – | Indicates whether the user has accepted the terms of service; set to true if accepted, false if declined. |
| tosId | string | – | The unique identifier of the terms of service document to associate with the user status. |
| userId | string | – | The unique identifier of the user whose terms of service acceptance status is being recorded. |
No output schema declared.
No examples provided.
create_upload_session Create Upload Session ~82
Initiates a chunked upload session for uploading a new file, returning a session ID and upload URLs to use for subsequent chunk uploads.
| Name | Type | Req | Description |
|---|---|---|---|
| file_name | string | – | The name to assign to the new file once the upload session is complete. |
| folder_id | string | – | The ID of the destination folder where the new file will be stored upon upload completion. |
No output schema declared.
No examples provided.
create_user Create User ~556
Creates a new managed or app user within a Box enterprise account. Requires admin-level permissions on the calling user or application.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | The user's physical address as displayed in their profile, limited to 255 characters. |
| can_see_managed_users | boolean | – | Whether the user can view and search other managed users within the enterprise in their contact list. |
| external_app_user_id | string | – | A custom identifier from an external identity provider that can be used to look up and map this Box user to an external system's user record. |
| is_exempt_from_device_limits | boolean | – | When set to true, exempts the user from the enterprise-wide limit on the number of devices they can log in from. |
| is_exempt_from_login_verification | boolean | – | When set to true, exempts the user from the enterprise's two-factor authentication requirement at login. |
| is_external_collab_restricted | boolean | – | When set to true, restricts the user from collaborating on content with users outside the enterprise. |
| is_platform_access_only | boolean | – | When set to true, designates this user as a platform (app) user rather than a standard managed enterprise user. |
| is_sync_enabled | boolean | – | Whether the user is permitted to use Box Sync to synchronize files to their local device. |
| job_title | string | – | The user's job title as displayed in their profile, limited to 100 characters. |
| language | string | – | The display language for the user's Box interface, formatted as a modified ISO 639-1 language code. |
| name_and_login | string | – | The user's display name and login email in RFC 5322 format: "Display Name <user@example.com>". The login email is required unless is_platform_access_only is true, in which case you may omit the angle… |
| phone | string | – | The user's phone number as displayed in their profile, limited to 100 characters. |
| role | string | – | The user's role within the enterprise, either a co-administrator with elevated privileges or a standard user. |
| space_amount | string | – | The total storage quota allocated to the user in bytes. Use -1 to grant unlimited storage. |
| status | string | – | The initial account status for the user, controlling their ability to log in and interact with content. |
| timezone | string | – | The user's local timezone, used for scheduling and display purposes, specified as a timezone identifier string. |
| tracking_codes | array | – | A list of tracking code objects (each with a name and value) used to categorize users for admin reporting. This feature must be enabled for the enterprise before use; order is not significant. |
No output schema declared.
No examples provided.
create_web_link Create Web Link ~151
Creates a web link object inside a specified folder, storing a URL as a navigable item within Box. Useful for bookmarking external resources directly within a folder hierarchy.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | An optional human-readable description providing additional context about the web link's destination or purpose. |
| id | string | – | The ID of the parent folder where the web link will be created. Use '0' to target the root folder. |
| name | string | – | A display name for the web link as it appears in the folder. If omitted, the URL is used as the name. |
| url | string | – | The full URL the web link points to. Must begin with 'http://' or 'https://'. |
No output schema declared.
No examples provided.
create_zip_download Create Zip Download ~128
Initiates a zip archive download request for multiple files and folders, validating access permissions and returning a download URL and status URL. The archive is limited to 10,000 files or the account's upload limit, with a recommended maximum total size of 25GB.
| Name | Type | Req | Description |
|---|---|---|---|
| download_file_name | string | – | The base name for the generated zip archive file, without the file extension. The `.zip` extension will be appended automatically. |
| items | array | – | A list of files and folders to include in the zip archive. Order is not significant; each item should specify its type and identifier. |
No output schema declared.
No examples provided.
delete_barrier_segment Delete Barrier Segment ~60
Permanently deletes a shield information barrier segment by its unique ID. This action removes the segment and its associated configurations from the information barrier.
| Name | Type | Req | Description |
|---|---|---|---|
| shield_information_barrier_segment_id | string | yes | The unique identifier of the shield information barrier segment to delete. |
No output schema declared.
No examples provided.
delete_barrier_segment_member Delete Barrier Segment Member ~67
Permanently removes a specific member from a shield information barrier segment. Use this to revoke a user's association with a segment when access restrictions need to be updated.
| Name | Type | Req | Description |
|---|---|---|---|
| shield_information_barrier_segment_member_id | string | yes | The unique identifier of the shield information barrier segment member to delete. |
No output schema declared.
No examples provided.
delete_collaboration Delete Collaboration ~50
Permanently removes a collaboration by its unique identifier. This action cannot be undone and will revoke the associated access or shared relationship.
| Name | Type | Req | Description |
|---|---|---|---|
| collaboration_id | string | yes | The unique identifier of the collaboration to delete. |
No output schema declared.
No examples provided.
delete_comment Delete Comment ~44
Permanently deletes a comment by its unique identifier. This action is irreversible and cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| comment_id | string | yes | The unique identifier of the comment to permanently delete. |
No output schema declared.
No examples provided.
delete_device_pin Delete Device Pin ~53
Permanently removes a specific device pin, revoking the trusted device association for the corresponding user. This action cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| device_pinner_id | string | yes | The unique identifier of the device pin to delete. |
No output schema declared.
No examples provided.
delete_file Delete File ~57
Deletes a specified file from Box, either permanently or by moving it to the trash depending on enterprise settings.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the file to delete. Visible in the file's URL on the Box web application. |
No output schema declared.
No examples provided.
delete_file_metadata Delete File Metadata ~148
Removes a specific metadata instance from a file by deleting the metadata template applied under the given scope. This permanently detaches the metadata from the file without affecting the file itself.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the file from which metadata will be removed. The file ID can be found in the URL when viewing the file in the Box web application. |
| scope | string | yes | The scope of the metadata template to delete, either 'global' for Box-wide templates or 'enterprise' for templates specific to your organization. |
| template_key | string | yes | The unique key identifying the metadata template to remove from the file, corresponding to the template's defined key within the specified scope. |
No output schema declared.
No examples provided.
What is the com.mcparmory/box MCP server?
com.mcparmory/box is an MCP server listed in the public MCP registry as com.mcparmory/box. Manage files, folders, and team collaboration with access controls. This page covers its PyPI package (mcparmory-box).
Is the com.mcparmory/box MCP server safe to use?
com.mcparmory/box scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mcparmory/box MCP server expose?
com.mcparmory/box exposes 246 tools: get_file, restore_file, update_file, delete_file, list_file_app_item_associations, and 241 more. Their descriptions and schemas cost roughly 34,690 tokens of context every time the server is loaded.
Is the com.mcparmory/box MCP server still maintained?
com.mcparmory/box is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.