Box hosts an MCP server at mcp.box.com. What makes it useful in an enterprise is not the file listing — it is that the agent inherits the permission model already governing the content, rather than you building an access layer.
https://mcp.box.com/mcp
Claude Sonnet 4.5
Chat with 60+ AI models on the same workflow — switch to a different model mid-conversation and re-run the same prompt, or use Compare mode to put several side-by-side and balance quality vs. cost.
OAuth against your Box account. The agent inherits that user’s permissions exactly — it cannot reach content the user could not open themselves.
How models use it and what it is built for.
The server exposes Box content operations as MCP tools. An agent can search across the content it is entitled to see, navigate folder hierarchies, read file metadata and extract text from documents — which is the part that turns a file store into something a model can reason over. Because Box already applies per-user and per-folder permissions, the agent operating under a given user’s token sees exactly what that user sees and nothing more: the access control problem that usually blocks AI over internal documents is already solved upstream. That makes it a realistic route for the common enterprise ask — question answering over contracts, policies or reports that live in Box and cannot be copied elsewhere for compliance reasons. Box AI capabilities are reachable too, so summarisation and extraction can run server-side against large documents.
Typical tools an AI model can call. Exact names vary by version.
Copy any of these into MCP Agent Studio after connecting.
Find the master services agreement with Acme and tell me the termination notice period.
What changed between the last two versions of the security policy document?
Summarise every Q3 board deck in the leadership folder.
Which files in the finance folder were modified in the last week, and by whom?
This is not a single-model product: you get the same MCP connection with 60+ models (Claude, GPT, Gemini, DeepSeek, open-weight, and more), you can switch mid-conversation, and you can open Compare mode to run the same prompt against multiple models at once. The card above is a suggested starting point for this server — not the only choice.
Default pick for Box
Claude Sonnet 4.5
Contract and policy questions turn on precise wording. Sonnet 4.5 quotes the clause it relied on, which lets you verify the answer instead of trusting it.
Listing tools proves the server is reachable, not that a model can work with it. Evals go further: they read every tool on the server, write a test suite from its real schemas, and run it — code decides pass/fail on the responses (schema conformance, error codes, pagination, result caps) while a scoring model grades plain-English tasks driven through the tools.
Get a pass/fail report per tool with the evidence behind each verdict — and replay the same suite after every schema change. Destructive tools are excluded from the run.
Run evalsOpen MCP Agent Studio with the connection pre-filled. Add your token, pick any of 60+ models, and start chatting — no install required.
Open Agent StudioCommon questions about connecting, scoping and using it safely.
Box’s hosted MCP server at mcp.box.com. It gives an AI assistant search, folder navigation, metadata and document text extraction across Box content, authenticated as a specific Box user.
No. It operates under the authenticated user’s token and Box enforces its normal permission model, so the agent’s reach is exactly that user’s reach. This is the main reason Box is a practical starting point for AI over internal documents.
Text extraction covers the common enterprise document formats, which is what lets a model answer questions about a contract rather than just report that a PDF exists. Scanned images without OCR remain a limitation, as everywhere.
It is simpler and it stays current — no pipeline, no re-index, no separate copy of regulated content to secure. A vector store still wins for semantic search across a very large corpus; many teams end up using both, with Box MCP for precise retrieval.
Access through the MCP server is Box API access, so it appears in Box’s own event stream like any other API activity. That is worth confirming before a rollout — being able to show who asked what is usually a condition of approval.