com.mcparmory/box
PYPI · MCPARMORY-BOX · 2 COMPONENTS · SCANNED SEP 20
Manage files, folders, and team collaboration with access controls
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Install-script risk not yet assessed.Unverified
- 2 of 46 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (MIT License) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 131 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 34690 tokens (~141/item across 246 items; 246 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety98
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 41 of 44 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "transfer_user_folders" implies "transfer" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
- An AI judge read all 246 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the com.mcparmory/box MCP server?
com.mcparmory/box runs locally as a PyPI package, launched with uvx mcparmory-box. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · mcparmory-box
claude mcp add com-mcparmory-box -- uvx mcparmory-box
{
"mcpServers": {
"com-mcparmory-box": {
"command": "uvx",
"args": [
"mcparmory-box"
]
}
}
} {
"servers": {
"com-mcparmory-box": {
"command": "uvx",
"args": [
"mcparmory-box"
]
}
}
} codex mcp add com-mcparmory-box -- uvx mcparmory-box
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-mcparmory-box": {
"type": "local",
"command": [
"uvx",
"mcparmory-box"
],
"enabled": true
}
}
} openclaw mcp add com-mcparmory-box --command uvx --arg mcparmory-box
mcp_servers:
com-mcparmory-box:
command: "uvx"
args: ["mcparmory-box"] {
"McpServers": {
"com-mcparmory-box": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"mcparmory-box"
]
}
}
} assistant mcp add com-mcparmory-box -t stdio -c uvx -a mcparmory-box
{
"mcpServers": {
"com-mcparmory-box": {
"command": "uvx",
"args": [
"mcparmory-box"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- 15 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 −18
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/mcparmory-box@1.0.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Dependencies 46 packages
| Packages resolved | 46 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
remove_folder_shared_link Remove Folder Shared Link ~146
Removes an existing shared link from a folder, revoking public or shared access. The shared_link field must be set to null to complete the removal.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | string | yes | A comma-separated list of fields to include in the response. Must include 'shared_link' to confirm the shared link has been removed from the folder. |
| folder_id | string | yes | The unique identifier of the folder from which the shared link will be removed. The root folder of a Box account is always represented by the ID '0'. |
| shared_link | object | – | The shared link configuration object. Set this to null to remove the shared link from the folder and revoke any previously granted access. |
No output schema declared.
No examples provided.
remove_folder_watermark Remove Folder Watermark ~71
Removes the watermark from a specified folder in Box. Once removed, the folder's content will no longer display watermark overlays.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | yes | The unique identifier of the folder from which the watermark will be removed. The root folder of a Box account is always represented by the ID '0'. |
No output schema declared.
No examples provided.
remove_group_member Remove Group Member ~66
Removes a user from a group by deleting the specified group membership. Only group admins or users with admin-level permissions can perform this action.
| Name | Type | Req | Description |
|---|---|---|---|
| group_membership_id | string | yes | The unique identifier of the group membership record to delete, representing the association between a specific user and group. |
No output schema declared.
No examples provided.
remove_legal_hold_policy_assignment Remove Legal Hold Policy Assignment ~74
Removes a legal hold policy assignment from an item, unlinking the policy from the associated content. This is an asynchronous operation; the hold may not be fully released by the time the response is returned.
| Name | Type | Req | Description |
|---|---|---|---|
| legal_hold_policy_assignment_id | string | yes | The unique identifier of the legal hold policy assignment to remove. |
No output schema declared.
No examples provided.
remove_user_email_alias Remove User Email Alias ~78
Removes a specific email alias from a user's account. Once removed, the alias can no longer be used to identify or contact the user.
| Name | Type | Req | Description |
|---|---|---|---|
| email_alias_id | string | yes | The unique identifier of the email alias to remove from the user. |
| user_id | string | yes | The unique identifier of the user whose email alias will be removed. |
No output schema declared.
No examples provided.
remove_web_link_shared_link Remove Web Link Shared Link ~137
Removes the shared link from a specified web link, revoking any previously granted public or shared access. The updated web link object is returned with the shared link field reflected.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | string | yes | A comma-separated list of fields to include in the response; must include 'shared_link' to confirm the shared link has been removed. |
| shared_link | object | – | Set this field to null to remove the shared link from the web link; omitting or providing any other value will not revoke the link. |
| web_link_id | string | yes | The unique identifier of the web link from which the shared link will be removed. |
No output schema declared.
No examples provided.
resend_sign_request Resend Sign Request ~60
Resends the signature request email to all outstanding signers who have not yet completed signing. Useful for following up on pending signatures without creating a new request.
| Name | Type | Req | Description |
|---|---|---|---|
| sign_request_id | string | yes | The unique identifier of the signature request to resend notifications for. |
No output schema declared.
No examples provided.
restore_file Restore File ~137
Restores a file from the trash back to its original location or a specified parent folder. An optional new parent folder can be provided if the original folder no longer exists.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the file to restore from the trash. The file ID can be found in the Box web app URL when viewing the file. |
| name | string | – | An optional new name to assign to the file upon restoration, useful if a naming conflict exists in the destination folder. |
| parent | object | – | An optional parent folder object specifying where the file should be restored to, used when the original parent folder has been deleted. |
No output schema declared.
No examples provided.
restore_file_version Restore File Version ~95
Restores a previously deleted version of a file, making it the current version. Supports standard file formats such as PDF, DOC, and PPTX, but not Box Notes.
| Name | Type | Req | Description |
|---|---|---|---|
| file_id | string | yes | The unique identifier of the file whose version you want to restore. Visible in the file's URL in the Box web application. |
| file_version_id | string | yes | The unique identifier of the specific file version to restore. |
No output schema declared.
No examples provided.
restore_folder Restore Folder ~149
Restores a folder from the trash to its original location or an optional new parent folder. During the operation, the source folder, its descendants, and the destination folder are locked to prevent concurrent move, copy, delete, or restore actions.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | yes | The unique identifier of the folder to restore from trash. The folder ID can be found in the Box web app URL when viewing the folder. |
| name | string | – | An optional new name to assign to the folder upon restoration, useful if a naming conflict exists at the destination. |
| parent | object | – | An optional parent folder object specifying where the folder should be restored to, used when the original parent folder no longer exists. |
No output schema declared.
No examples provided.
restore_web_link Restore Web Link ~129
Restores a web link from the trash back to its original location or an alternative parent folder. An optional new name and parent folder can be specified if the original folder no longer exists.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | An optional new name to assign to the web link upon restoration, useful if a naming conflict exists in the destination folder. |
| parent | object | – | An optional parent folder object specifying an alternative destination to restore the web link into, used when the original parent folder has been deleted. |
| web_link_id | string | yes | The unique identifier of the web link to restore from the trash. |
No output schema declared.
No examples provided.
search_content Search Content ~870
Search for files, folders, web links, and shared files across the authenticated user's content or the entire enterprise, with support for rich filtering by metadata, date ranges, file type, ownership, and more.
| Name | Type | Req | Description |
|---|---|---|---|
| ancestor_folder_ids | array | – | Restricts results to items located within the specified folders or their subfolders, provided as an array of folder ID strings. Folders must be accessible to the authenticated user; inaccessible or n… |
| content_types | array | – | Restricts the search to specific parts of an item, such as its name, description, file content, comments, or tags. Provide as an array of recognized content type strings. |
| created_at_range | array | – | Restricts results to items created within a date range, provided as an array of two RFC3339 timestamp strings representing start and end dates. Either bound may be omitted to create an open-ended ran… |
| deleted_at_range | array | – | Restricts results to items deleted within a date range, provided as an array of two RFC3339 timestamp strings representing start and end dates. Requires `trash_content` to be set to `trashed_only`. O… |
| deleted_user_ids | array | – | Restricts results to items deleted by the specified users, provided as an array of user ID strings. Requires `trash_content` to be set to `trashed_only`. Only available for data from 2023-02-01 onwar… |
| direction | string | – | Sets the sort direction for results as ascending (`ASC`) or descending (`DESC`). Ignored when `sort` is set to `relevance`, which always returns results in descending relevance order. |
| file_extensions | array | – | Restricts results to files matching any of the specified file extensions. Provide extensions without leading dots as an array. |
| include_recent_shared_links | boolean | – | When set to true, includes items the user recently accessed via a shared link in the results. Enabling this changes the response format to include shared link metadata. |
| limit | string | – | Maximum number of items to return per page of results. Must be between 1 and 200. |
| mdfilters | array | – | Restricts results to items whose metadata matches a specific metadata template filter. Accepts exactly one metadata filter object; required when `query` is not provided. |
| owner_user_ids | array | – | Restricts results to items owned by the specified users, provided as an array of user ID strings. Items must still be accessible to the authenticated user; inaccessible owners yield empty results. |
| query | string | – | The text to search for, matched against item names, descriptions, file content, and other fields. Supports boolean operators AND, OR, and NOT (uppercase only), and exact phrase matching using double… |
| recent_updater_user_ids | array | – | Restricts results to items most recently updated by the specified users, provided as an array of user ID strings. Only the last 10 versions of each item are considered. |
| scope | string | – | Restricts search results to content accessible by the current user (`user_content`) or all content across the entire enterprise (`enterprise_content`). Enterprise scope requires admin enablement via… |
| size_range | array | – | Restricts results to items whose file size falls within a byte range, provided as an array of two integers representing the lower and upper bounds (inclusive). Either bound may be omitted to create a… |
| sort | string | – | Determines the ordering of search results. Use `relevance` to rank by match quality or `modified_at` to order by most recently modified first. |
| trash_content | string | – | Controls whether results include items in the trash, items not in the trash, or both. Defaults to returning only non-trashed items. |
| type | string | – | Restricts results to a single item type: `file`, `folder`, or `web_link`. When omitted, all item types are returned. |
| updated_at_range | array | – | Restricts results to items last updated within a date range, provided as an array of two RFC3339 timestamp strings representing start and end dates. Either bound may be omitted to create an open-ende… |
No output schema declared.
No examples provided.
start_workflow Start Workflow ~248
Manually triggers a Box Relay workflow with a WORKFLOW_MANUAL_START trigger type for a specified folder and optional files. Requires the Manage Box Relay application scope to be authorized in the developer console.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | An array of file objects for which the workflow should be started; each file must already exist within the workflow's configured folder. Order is not significant. |
| flowId | string | – | The unique identifier of the specific flow within the workflow to trigger. |
| flowType | string | – | Identifies the type of the flow object being referenced within the parameters. |
| folderId | string | – | The unique identifier of the folder configured for this workflow; all provided files must reside within this folder. |
| folderType | string | – | Identifies the type of the folder object being referenced; must be set to 'folder'. |
| outcomes | array | – | An array of configurable outcome objects that the workflow should complete as part of its execution. Order is not significant. |
| type | string | – | Identifies the type of the top-level parameters object being submitted; must be set to 'workflow_parameters'. |
| workflow_id | string | yes | The unique identifier of the workflow to start. |
No output schema declared.
No examples provided.
terminate_group_sessions Terminate Group Sessions ~72
Terminates all active sessions for one or more user groups by creating asynchronous jobs after validating group roles and permissions. Returns the status of the termination request.
| Name | Type | Req | Description |
|---|---|---|---|
| group_ids | array | – | A list of group IDs whose sessions should be terminated. Order is not significant; each item should be a valid group ID string. |
No output schema declared.
No examples provided.
terminate_user_sessions Terminate User Sessions ~131
Terminates active sessions for one or more users by dispatching asynchronous jobs, after validating the caller's roles and permissions. Accepts user IDs, user logins, or both to identify the target accounts.
| Name | Type | Req | Description |
|---|---|---|---|
| user_ids | array | – | A list of unique user IDs identifying the accounts whose sessions should be terminated. Order is not significant; each entry should be a valid numeric user ID string. |
| user_logins | array | – | A list of user login email addresses identifying the accounts whose sessions should be terminated. Order is not significant; each entry should be a valid email address associated with a user account. |
No output schema declared.
No examples provided.
transfer_user_folders Transfer User Folders ~119
Transfers all files, folders, and workflows owned by a specified user into another user's account by moving the root folder. Requires administrative permissions; large transfers run asynchronously, and admins receive an email upon completion.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | The unique identifier of the destination user who will receive ownership of the transferred folders and files. |
| notify | boolean | – | Whether to send email notifications to relevant users about the transfer action being performed. |
| user_id | string | yes | The unique identifier of the user whose root folder and all owned content will be transferred. |
No output schema declared.
No examples provided.
update_barrier_segment Update Barrier Segment ~116
Updates the name and/or description of a specific shield information barrier segment by its ID. Use this to modify segment metadata without affecting its underlying barrier configuration.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | The new description to assign to the barrier segment, providing context about its purpose or the division it represents. |
| name | string | – | The new name to assign to the barrier segment. Must contain at least one non-whitespace character. |
| shield_information_barrier_segment_id | string | yes | The unique identifier of the shield information barrier segment to update. |
No output schema declared.
No examples provided.
update_collaboration Update Collaboration ~262
Updates an existing collaboration on a Box item, allowing you to change the collaborator's role, accept or reject a pending invitation, set an expiration date, or toggle parent path visibility.
| Name | Type | Req | Description |
|---|---|---|---|
| can_view_path | boolean | – | When true, allows the invited collaborator to see the full parent folder path to the collaborated item without gaining access to parent folder contents. Only applicable to folder collaborations; only… |
| collaboration_id | string | yes | The unique identifier of the collaboration to update. |
| expires_at | string | – | The date and time at which the collaboration will be automatically removed from the item, specified in ISO 8601 format. Requires the 'Automatically remove invited collaborators' setting to be enabled… |
| role | string | – | The permission level to grant the collaborator. Not required when accepting a collaboration invitation. Valid values range from read-only access (viewer, previewer) to full ownership (owner). |
| status | string | – | Sets the status of a pending collaboration invitation to accept or reject it. Only applicable to collaborations currently in a pending state. |
No output schema declared.
No examples provided.
update_comment Update Comment ~65
Updates the message text of an existing comment. Use this to edit or correct the content of a previously posted comment.
| Name | Type | Req | Description |
|---|---|---|---|
| comment_id | string | yes | The unique identifier of the comment to update. |
| message | string | – | The new text content to replace the comment's existing message. |
No output schema declared.
No examples provided.
update_file Update File ~477
Updates a file's metadata or settings, including renaming, moving to a new parent folder, managing shared links, applying locks, updating tags, and modifying collection membership.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The type of lock to apply to the file. Must be set to 'lock' to lock the file and restrict editing by other users. |
| can_download | string | – | Controls who can download the file: 'open' allows anyone with access, while 'company' restricts downloads to members of the owner's enterprise, overriding collaboration role permissions. |
| collections | array | – | An array of collection objects (each with an 'id') to assign the file to. Currently only the favorites collection is supported. Pass an empty array or null to remove the file from all collections. |
| description | string | – | A text description for the file, visible in the Box web app sidebar and included in search indexing. Maximum 256 characters. |
| disposition_at | string | – | The retention expiration timestamp for the file in ISO 8601 format. Once set, this date can only be extended, never shortened. |
| expires_at | string | – | The date and time at which the file lock automatically expires, in ISO 8601 format. |
| file_id | string | yes | The unique identifier of the file to update. Find this ID in the Box web app by opening the file and copying the numeric ID from the URL. |
| is_download_prevented | boolean | – | Whether downloading the file is prevented while the lock is active. Set to true to block downloads during the lock period. |
| name | string | – | A new name for the file. Must be unique within the parent folder; the uniqueness check is case-insensitive. |
| parent | object | – | The parent folder to move the file into. Provide an object with the target folder's ID to relocate the file. |
| shared_link | object | – | Shared link settings for the file. Provide an object with access level and permission options to create or update the file's shared link. |
| tags | array | – | An array of string tags to associate with the file, visible in the Box web and mobile apps. To modify tags, retrieve the current list, apply changes, and submit the full updated array. Maximum 100 ta… |
No output schema declared.
No examples provided.
update_file_classification Update File Classification ~112
Updates the security classification label on a file that already has a classification applied. Only classification values defined for the enterprise are accepted.
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | – | A list containing exactly one change operation object that specifies the update to apply to the classification label. Order is significant; only a single item describing the classification change sho… |
| file_id | string | yes | The unique identifier of the file whose classification will be updated. The file ID can be found in the file's URL in the Box web application. |
No output schema declared.
No examples provided.
update_file_metadata Update File Metadata ~171
Updates an existing metadata instance on a file using JSON Patch operations. The metadata template must already be applied to the file, and all changes are applied atomically — if any operation fails, no changes are made.
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | – | An ordered array of JSON Patch operation objects describing the changes to apply to the metadata instance. Operations are applied in sequence and must conform to RFC 6902 JSON Patch syntax. |
| file_id | string | yes | The unique identifier of the file whose metadata instance will be updated. Visible in the file's URL in the Box web application. |
| scope | string | yes | The scope of the metadata template to update, either globally defined templates or enterprise-specific ones. |
| template_key | string | yes | The unique key identifying the metadata template whose instance will be updated on the file. |
No output schema declared.
No examples provided.
update_file_request Update File Request ~296
Updates the properties of an existing file request, such as its title, description, status, and submission requirements. Use this to activate or deactivate a file request or modify its configuration.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | The new description for the file request, displayed to submitters on the form. If omitted, the existing description is preserved. |
| expires_at | string | – | The expiration date and time after which the file request will no longer accept submissions and its status will automatically become inactive. Provide as an ISO 8601 date-time string. If omitted, the… |
| file_request_id | string | yes | The unique identifier of the file request to update. Find this ID in the URL of the file request builder in the Box web application. |
| is_description_required | boolean | – | Whether submitters must provide a description of the files they are uploading on the file request form. If omitted, the existing setting is preserved. |
| is_email_required | boolean | – | Whether submitters must provide their email address on the file request form. If omitted, the existing setting is preserved. |
| status | string | – | The new status of the file request. Setting to 'inactive' stops accepting submissions and returns HTTP 404 to visitors; 'active' resumes acceptance. If omitted, the existing status is preserved. |
| title | string | – | The new title for the file request. If omitted, the existing title is preserved. |
No output schema declared.
No examples provided.
update_file_shared_link Update File Shared Link ~431
Updates the shared link settings on a specific file, including access level, password protection, expiration, and permissions. Use this to modify an existing shared link or configure a new one on the file.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The visibility level of the shared link. Use 'open' for anyone with the link, 'company' for internal users only (paid accounts only), or 'collaborators' for explicitly invited users only. Defaults to… |
| can_download | boolean | – | Whether the shared link permits downloading of the file. Can only be set when access is 'open' or 'company'. |
| can_edit | boolean | – | Whether the shared link permits editing of the file. Can only be set when access is 'open' or 'company', and requires can_download to also be true. |
| can_preview | boolean | – | Whether the shared link permits previewing of the file. This value is always true and applies to all items within a folder when set on a folder shared link. |
| fields | string | yes | A comma-separated list of fields to include in the response. Must include 'shared_link' to ensure the updated shared link details are returned. |
| file_id | string | yes | The unique identifier of the file whose shared link will be updated. The file ID can be found in the URL when viewing the file in the Box web application. |
| password | string | – | An optional password required to access the shared link. Set to null to remove an existing password. Passwords must be at least 8 characters and include a number, uppercase letter, or special charact… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link will expire and become inaccessible. Must be a future date and time. Only available to paid account users. |
| vanity_name | string | – | A custom vanity name to use in the shared link URL path. Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to guess than standard shared links. |
No output schema declared.
No examples provided.
update_folder Update Folder ~558
Updates a folder's properties such as name, description, tags, and sharing settings. Can also be used to move the folder to a new parent, manage shared links, and control collaboration permissions.
| Name | Type | Req | Description |
|---|---|---|---|
| can_non_owners_invite | boolean | – | When set to `true`, users who are not the folder owner are allowed to invite new collaborators. When `false`, only the owner can invite collaborators. |
| can_non_owners_view_collaborators | boolean | – | When set to `false`, non-owner collaborators are prevented from viewing other collaborators on the folder and from inviting new ones. If setting this to `false`, `can_non_owners_invite` must also be… |
| collections | array | – | A list of collection objects to add this folder to. Currently only the `favorites` collection is supported. Pass an empty array or `null` to remove the folder from all collections. Retrieve collectio… |
| description | string | – | An optional human-readable description for the folder, up to 256 characters. |
| folder_id | string | yes | The unique identifier of the folder to update. Find this ID in the Box web app URL when viewing the folder. The root folder of any Box account always has the ID `0`. |
| folder_upload_email | object | – | The email address configuration that allows files to be uploaded to this folder by sending an email. Provide an object with the desired access level, or set to `null` to disable. |
| is_collaboration_restricted_to_enterprise | boolean | – | When set to `true`, new collaboration invitations for this folder are restricted to users within the same enterprise. Existing collaborations are not affected. |
| name | string | – | The new name for the folder. Names must be unique within the parent folder (case-insensitive) and cannot contain non-printable ASCII characters, forward or backward slashes, trailing spaces, or be `.… |
| parent | object | – | The parent folder to move this folder into. Provide an object with the `id` of the destination parent folder to relocate the folder. |
| shared_link | object | – | Shared link settings for the folder. Provide a shared link object to create or update the shared link, or set to `null` to remove it. |
| sync_state | string | – | Controls whether the folder is synced to a user's device. Applicable only to Box Sync (discontinued); not used by Box Drive. |
| tags | array | – | A list of tags to associate with the folder, visible in the Box web and mobile apps. To modify tags, retrieve the current list, apply changes, and submit the full updated list. Maximum of 100 tags pe… |
No output schema declared.
No examples provided.
update_folder_classification Update Folder Classification ~117
Updates the security classification label on a folder that already has a classification applied. Only classification values defined for the enterprise are accepted.
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | – | A list containing exactly one JSON Patch operation object describing the change to apply to the classification label. Only a single update operation is supported per request. |
| folder_id | string | yes | The unique identifier of the folder whose classification will be updated. The folder ID can be found in the URL when viewing the folder in the Box web app. The root folder is always ID '0'. |
No output schema declared.
No examples provided.
update_folder_metadata Update Folder Metadata ~171
Updates a metadata instance on a folder using JSON Patch operations, applied atomically. The metadata template must already be applied to the folder, and all changes must conform to the template schema.
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | – | A JSON Patch array of operation objects describing the changes to apply to the metadata instance. Operations are applied atomically — if any operation fails, no changes are made. |
| folder_id | string | yes | The unique identifier of the folder to update metadata on. The ID appears in the folder's URL in the Box web app, and the root folder is always ID `0`. |
| scope | string | yes | The scope of the metadata template, either globally defined or specific to the enterprise account. |
| template_key | string | yes | The unique key name of the metadata template to update on the folder. |
No output schema declared.
No examples provided.
update_folder_shared_link Update Folder Shared Link ~410
Updates the shared link settings on a specific folder, allowing you to configure access level, password protection, expiration, and permissions for the link.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The access level for the shared link. Use `open` for anyone with the link, `company` for users within the enterprise (paid accounts only), or `collaborators` for only invited users. Defaults to the e… |
| can_download | boolean | – | Whether the shared link permits downloading of files. Can only be enabled when access is set to `open` or `company`. |
| can_edit | boolean | – | Whether the shared link permits editing of items. For folders, this value can only be set to `false`. |
| can_preview | boolean | – | Whether the shared link permits previewing of files. This value is always `true` for folders and applies to all items within the folder. |
| fields | string | yes | A comma-separated list of fields to include in the response. Must include `shared_link` to return the updated shared link details. |
| folder_id | string | yes | The unique identifier of the folder whose shared link will be updated. The ID can be found in the folder's URL in the Box web app. The root folder is always ID `0`. |
| password | string | – | An optional password required to access the shared link. Must be at least 8 characters and include a number, uppercase letter, or special character. Can only be set when access is `open`. Set to `nul… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link will expire and become inaccessible. Must be a future date and time. Only available to paid account users. |
| vanity_name | string | – | A custom vanity name to use in the shared link URL path. Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to guess than standard shared links. |
No output schema declared.
No examples provided.
update_group Update Group ~339
Updates the properties of an existing group, such as its name, description, sync identifiers, and visibility settings. Only group admins or enterprise admins have permission to perform this operation.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | A human-readable description providing additional context about the group's purpose or origin. Maximum 255 characters. |
| external_sync_identifier | string | – | An arbitrary identifier used to link this Box group to a corresponding group in an external system, such as an Active Directory Object ID or Google Group ID. Using this field is recommended to preven… |
| group_id | string | yes | The unique identifier of the group to update. |
| invitability_level | string | – | Controls who can invite this group to collaborate on folders. Use `admins_only` to restrict invitations to enterprise and group admins, `admins_and_members` to also allow group members, or `all_manag… |
| member_viewability_level | string | – | Controls who can view the membership list of this group. Use `admins_only` to restrict visibility to enterprise and group admins, `admins_and_members` to also allow group members, or `all_managed_use… |
| name | string | – | The updated display name for the group, which must remain unique across the enterprise. |
| provenance | string | – | Identifies the external source system this group originates from (e.g., Active Directory or Okta). Setting this value prevents Box admins from editing the group name or members directly in the Box we… |
No output schema declared.
No examples provided.
update_group_membership Update Group Membership ~147
Updates a user's role or permissions within a specific group membership. Only group admins or users with admin-level permissions can perform this action.
| Name | Type | Req | Description |
|---|---|---|---|
| configurable_permissions | object | – | A map of specific permission overrides for a group admin, replacing their default access levels. Only applies to users with the 'admin' role; has no effect on members. Pass null to disable all config… |
| group_membership_id | string | yes | The unique identifier of the group membership record to update. |
| role | string | – | The role to assign to the user within the group. Accepted values are 'member' for standard access or 'admin' for elevated group management privileges. |
No output schema declared.
No examples provided.
update_legal_hold_policy Update Legal Hold Policy ~139
Updates the name, description, or release notes of an existing legal hold policy. Use this to modify policy details after creation without affecting associated holds.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | An updated human-readable description of the legal hold policy's purpose or scope. Must not exceed 500 characters. |
| legal_hold_policy_id | string | yes | The unique identifier of the legal hold policy to update. |
| policy_name | string | – | The updated display name for the legal hold policy. Must not exceed 254 characters. |
| release_notes | string | – | Notes explaining the reason or context for releasing this legal hold policy. Must not exceed 500 characters. |
No output schema declared.
No examples provided.
update_metadata_template Update Metadata Template ~138
Updates an existing metadata template by applying a series of JSON-Patch operations atomically. All changes succeed or fail together — no partial updates are applied if any operation encounters an error.
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | – | An ordered array of JSON-Patch (RFC 6902) operation objects describing the changes to apply to the metadata template. Each item specifies an operation type, target path, and value as needed. |
| scope | string | yes | The scope of the metadata template, determining its visibility and ownership — either globally available or restricted to the enterprise. |
| template_key | string | yes | The unique key identifying the metadata template within the given scope. |
No output schema declared.
No examples provided.
update_retention_policy Update Retention Policy ~386
Updates an existing retention policy's settings, including its name, duration, disposition action, and notification preferences. You can also use this operation to retire a policy or convert it from modifiable to non-modifiable.
| Name | Type | Req | Description |
|---|---|---|---|
| are_owners_notified | boolean | – | Whether owners and co-owners of items under this policy receive notifications as the retention period approaches its end. |
| can_owner_extend_retention | boolean | – | Whether the owner of items under this policy is permitted to extend the retention period as it approaches expiration. |
| custom_notification_recipients | array | – | An explicit list of additional users to notify when the retention duration is nearing expiration. Each item should represent a user recipient; order is not significant. |
| description | string | – | An optional extended text description providing additional context or purpose for the retention policy. |
| disposition_action | – | – | The action taken when the retention period expires. Use 'permanently_delete' to destroy retained content or 'remove_retention' to lift the policy and allow user-initiated deletion. Pass null to leave… |
| policy_name | string | – | The updated display name for the retention policy. |
| retention_length | – | – | The number of days the retention policy remains active after being assigned to content. For indefinite policies, this value should also be 'indefinite'. |
| retention_policy_id | string | yes | The unique identifier of the retention policy to update. |
| retention_type | string | – | The modifiability type of the retention policy. Only 'non-modifiable' can be set when updating; you may convert a modifiable policy to non-modifiable, but not the reverse. Non-modifiable policies sup… |
| status | string | – | Set to 'retired' to retire the retention policy. Omit this parameter or pass null if you are not retiring the policy. |
No output schema declared.
No examples provided.
update_shield_barrier_status Update Shield Barrier Status ~106
Changes the status of a shield information barrier to control its enforcement state. Use this to activate, suspend, or disable an existing barrier by its unique ID.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | The unique identifier of the shield information barrier whose status you want to change. |
| status | string | – | The target status to apply to the shield information barrier. Accepted values are 'pending' (barrier is queued for activation) or 'disabled' (barrier is turned off). |
No output schema declared.
No examples provided.
update_skill_cards Update Skill Cards ~116
Updates one or more Box Skills metadata cards on a specified file using JSON-Patch operations, allowing targeted modifications to existing skill card data.
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | – | An array of JSON-Patch operation objects describing the changes to apply to the Box Skills metadata cards. Each object follows the RFC 6902 JSON-Patch specification, with order of operations being si… |
| file_id | string | yes | The unique identifier of the file whose Box Skills metadata cards will be updated. Visible in the file's URL on the Box web application. |
No output schema declared.
No examples provided.
update_skill_cards_on_file Update Skill Cards on File ~306
Overwrites and updates all Box Skill metadata cards on a file for a given skill. Use this method to replace existing Skill cards with new ones in a single operation.
| Name | Type | Req | Description |
|---|---|---|---|
| cards | array | – | An ordered list of Box Skill cards to apply to the file. Each item should be a valid Skill card object (e.g., keyword, timeline, transcript, or status card); order determines how cards are stored and… |
| fileId | string | – | The unique identifier of the file on which the Skill cards will be applied. |
| file_versionId | string | – | The unique identifier of the specific file version to associate the Skill cards with. Use this to target a particular version rather than the current version of the file. |
| skill_id | string | yes | The unique identifier of the Box Skill to apply metadata for. This determines which skill's cards are overwritten on the file. |
| status | string | – | The current processing status of this skill invocation. Set to 'success' when providing completed Skill cards; use failure or processing states to reflect intermediate or error conditions. Accepted v… |
| unit | string | – | The type of resource unit being referenced. This value is always 'file' for file-level Skill card operations. |
| value | number | – | The number of resources affected by this skill invocation. Typically reflects how many files or items the skill operation applies to. |
No output schema declared.
No examples provided.
update_task Update Task ~193
Updates an existing task's configuration or completion state, including its action type, message, due date, and assignee completion rules.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | The type of action assignees are prompted to perform: 'review' creates an approval task that can be approved or rejected, while 'complete' creates a general task that can be marked done. |
| completion_rule | string | – | Determines how many assignees must complete the task before it is marked as completed: 'all_assignees' requires every assignee to act, while 'any_assignee' requires only one. |
| due_at | string | – | The deadline by which the task should be completed, specified as an ISO 8601 date-time string. |
| message | string | – | The instructional message displayed to task assignees describing what they need to do. |
| task_id | string | yes | The unique identifier of the task to update. |
No output schema declared.
No examples provided.
update_task_assignment Update Task Assignment ~143
Updates a task assignment for a specific user, allowing changes to the resolution state or an optional assignee message. Supported resolution states depend on the task's action type (complete or review).
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | – | An optional message from the assignee to accompany the task assignment update. |
| resolution_state | string | – | The resolution state to set for the task assignment. For tasks with action type 'complete', valid values are 'incomplete' or 'completed'. For tasks with action type 'review', valid values are 'incomp… |
| task_assignment_id | string | yes | The unique identifier of the task assignment to update. |
No output schema declared.
No examples provided.
update_terms_of_service_user_status Update Terms of Service User Status ~99
Updates the acceptance status of a terms of service agreement for a specific user. Use this to record whether a user has accepted or declined a terms of service.
| Name | Type | Req | Description |
|---|---|---|---|
| is_accepted | boolean | – | Indicates whether the user has accepted the terms of service; set to true to mark acceptance or false to mark rejection. |
| terms_of_service_user_status_id | string | yes | The unique identifier of the terms of service user status record to update. |
No output schema declared.
No examples provided.
update_user Update User ~607
Updates profile, permissions, and account settings for a managed or app user within an enterprise. Requires admin-level permissions to execute.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | The user's physical address. Maximum 255 characters. |
| can_see_managed_users | boolean | – | Whether the user can see other enterprise users in their contact list. |
| string | – | The email address to which enterprise notifications for this user will be sent. | |
| enterprise | string | – | Set to null to remove the user from the enterprise and convert them to a free user. |
| external_app_user_id | string | – | An external identifier linking this Box app user to a user in an external identity provider. Can only be updated using a token from the application that originally created the app user. |
| is_exempt_from_device_limits | boolean | – | Whether the user is exempt from the enterprise-wide limit on the number of devices they can log in from. |
| is_exempt_from_login_verification | boolean | – | Whether the user is exempt from two-factor authentication requirements. Set to true to bypass login verification. |
| is_external_collab_restricted | boolean | – | Whether the user is restricted from collaborating with users outside the enterprise. Set to true to block external collaboration. |
| is_password_reset_required | boolean | – | Whether the user will be required to reset their password on their next login. |
| is_sync_enabled | boolean | – | Whether the user is permitted to use Box Sync to synchronize files to their local device. |
| job_title | string | – | The user's job title as displayed on their profile. Maximum 100 characters. |
| language | string | – | The user's preferred language, specified as a modified ISO 639-1 language code. |
| login | string | – | The primary email address the user uses to log in. Cannot be changed if the target user's email address has not been confirmed. |
| name | string | – | The display name of the user. Maximum 50 characters. |
| notify | boolean | – | Whether the user should receive an email notification when they are rolled out of the enterprise. |
| phone | string | – | The user's phone number. Maximum 100 characters. |
| role | string | – | The user's role within the enterprise. Use 'coadmin' to grant co-administrator privileges or 'user' for a standard role. |
| space_amount | string | – | The user's total available storage quota in bytes. Set to -1 to grant unlimited storage. |
| status | string | – | The user's account status. Use 'inactive' to deactivate the account, or 'cannot_delete_edit'/'cannot_delete_edit_upload' to apply restrictions. |
| timezone | string | – | The user's timezone, specified as a valid IANA timezone identifier. |
| tracking_codes | array | – | A list of tracking code objects assigned to the user, used by admins to generate reports and group users by attributes. This feature must be enabled for the enterprise before use. |
| user_id | string | yes | The unique identifier of the user to update. |
No output schema declared.
No examples provided.
update_web_link Update Web Link ~360
Updates an existing web link object, allowing changes to its URL, name, description, parent location, and shared link settings such as access level, password, vanity name, and expiration.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The visibility level for the shared link. Use 'open' for anyone with the link, 'company' for internal users only (paid accounts), or 'collaborators' for invited users only. Omitting this field applie… |
| description | string | – | A new human-readable description for the web link to provide additional context about its destination. |
| name | string | – | A new display name for the web link. If omitted, the name defaults to the URL. |
| parent | object | – | The parent folder to move the web link into. Provide the target folder's identifier to relocate the web link. |
| password | string | – | A password required to access the shared link. Must be at least eight characters and include a number, uppercase letter, or non-alphanumeric character. Can only be set when access is 'open'; set to n… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link expires and becomes inaccessible. Must be a future datetime and can only be set by users on paid accounts. |
| url | string | – | The new destination URL for the web link. Must begin with 'http://' or 'https://'. |
| vanity_name | string | – | A custom vanity slug appended to the shared link URL path. Must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to guess than standard shared links. |
| web_link_id | string | yes | The unique identifier of the web link to update. |
No output schema declared.
No examples provided.
update_web_link_shared_link Update Web Link Shared Link ~383
Updates the shared link settings on an existing web link, allowing you to control access level, password protection, expiration, and permissions.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | The visibility level of the shared link: 'open' allows anyone with the link, 'company' restricts to users within the enterprise (paid accounts only), and 'collaborators' restricts to invited collabor… |
| can_download | boolean | – | Whether the shared link permits downloading of the web link. Can only be set when access is 'open' or 'company'. |
| can_edit | boolean | – | Whether the shared link permits editing; can only be true when the item type is a file. |
| can_preview | boolean | – | Whether the shared link permits previewing of the web link; this value is always true and also applies to items within a shared folder. |
| fields | string | yes | A comma-separated list of fields to include in the response; must include 'shared_link' to return shared link details. |
| password | string | – | An optional password required to access the shared link; set to null to remove an existing password. Must be at least eight characters and include a number, uppercase letter, or non-alphanumeric char… |
| unshared_at | string | – | The ISO 8601 datetime at which the shared link will expire and become inaccessible; must be a future date and time. Only available to paid account users. |
| vanity_name | string | – | A custom vanity name to use in the shared link URL path; must be at least 12 characters. Avoid using vanity names for sensitive content as they are easier to guess than standard shared links. |
| web_link_id | string | yes | The unique identifier of the web link whose shared link settings will be updated. |
No output schema declared.
No examples provided.
upload_file Upload File ~205
Uploads a small file (under 50MB) to a specified Box folder. The attributes must be sent before the file content in the request body, or a 400 error will be returned.
| Name | Type | Req | Description |
|---|---|---|---|
| content_created_at | string | – | The original creation timestamp of the file in ISO 8601 format. Defaults to the upload time if not provided. |
| content_modified_at | string | – | The last modified timestamp of the file in ISO 8601 format. Defaults to the upload time if not provided. |
| file | string | – | Base64-encoded file content for upload. The binary content of the file to upload. Must appear after the attributes part in the multipart request body. |
| id | string | – | The ID of the parent folder where the file will be uploaded. Use `0` to upload to the user's root folder. |
| name | string | – | The name to assign to the uploaded file. Must be unique (case-insensitive) within the destination folder. |
No output schema declared.
No examples provided.
upload_file_part Upload File Part ~212
Uploads a single binary chunk of a file as part of an active chunked upload session. Each part must conform to the byte range and part size defined when the upload session was created.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | Base64-encoded binary request body. The raw binary content of the file chunk being uploaded for this part. |
| content-range | string | yes | The inclusive byte range of this chunk within the full file, formatted as `bytes <start>-<end>/<total>`. The start must be a multiple of the session's part size, the end must be a multiple of the par… |
| digest | string | yes | The RFC 3230 message digest of the uploaded chunk used to verify integrity. Must be a base64-encoded SHA1 hash formatted as `sha=<BASE64_ENCODED_DIGEST>`. |
| upload_session_id | string | yes | The unique identifier of the upload session to which this file part belongs. |
No output schema declared.
No examples provided.
upload_file_version Upload File Version ~196
Uploads a new version of an existing file's content, optionally renaming it or setting a custom last-modified timestamp. For files over 50MB, use the Chunk Upload APIs instead.
| Name | Type | Req | Description |
|---|---|---|---|
| content_modified_at | string | – | The date and time the file content was last modified, in ISO 8601 format. If omitted, the time of upload is used as the modification time. |
| file | string | – | Base64-encoded file content for upload. The binary content of the file to upload. This part must appear after the attributes part in the multipart request body; reversing the order will result in a 4… |
| file_id | string | yes | The unique identifier of the file to update. Visible in the Box web app URL when viewing the file. |
| name | string | – | An optional new name to rename the file when this new version is uploaded. If omitted, the existing file name is retained. |
No output schema declared.
No examples provided.
upload_user_avatar Upload User Avatar ~96
Adds or replaces the avatar image for a specified user. Accepts JPG or PNG files up to 1MB in size.
| Name | Type | Req | Description |
|---|---|---|---|
| pic | string | – | Base64-encoded file content for upload. The image file to upload as the user's avatar. Must be a JPG or PNG file and cannot exceed 1MB in size. |
| user_id | string | yes | The unique identifier of the user whose avatar is being added or updated. |
No output schema declared.
No examples provided.
What is the com.mcparmory/box MCP server?
com.mcparmory/box is an MCP server listed in the public MCP registry as com.mcparmory/box. Manage files, folders, and team collaboration with access controls. This page covers its PyPI package (mcparmory-box).
Is the com.mcparmory/box MCP server safe to use?
com.mcparmory/box scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mcparmory/box MCP server expose?
com.mcparmory/box exposes 246 tools: get_file, restore_file, update_file, delete_file, list_file_app_item_associations, and 241 more. Their descriptions and schemas cost roughly 34,690 tokens of context every time the server is loaded.
Is the com.mcparmory/box MCP server still maintained?
com.mcparmory/box is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.