Box

This connector wraps the Box Content API v2 (api.box.com/2.0). You authorize it once, in AnythingMCP; access tokens are then renewed automatically.

Setup:

1. Create an app at https://app.box.com/developers/console → Create New App → Custom App → User Authentication (OAuth 2.0).
2. In the app's Configuration tab, add the redirect URI https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP server URL>/api/mcp-oauth/callback when you host AnythingMCP yourself. Under Application Scopes, tick Write all files and folders stored in Box.
3. Enter the app's Client ID as BOX_CLIENT_ID and its Client Secret as BOX_CLIENT_SECRET, leave BOX_REFRESH_TOKEN empty, and install.
4. Open the connector and click Authorize with Provider. Sign in to Box, grant access, and you land back on the connector page with the tools ready.

Scopes: root_readwrite, which covers every tool here (read, create, move, copy, delete and share).

Already have a refresh token? You can paste it into BOX_REFRESH_TOKEN instead of step 4, if you obtained it yourself for the same app (authorization code from https://account.box.com/api/oauth2/authorize, exchanged at https://api.box.com/oauth2/token). Box refresh tokens work only once: a token you already exchanged, for example while testing it, is spent and the connector fails with invalid_grant. Authorizing from the connector page avoids this.

JWT (server authentication) is out of scope for this OAuth-based adapter.

Authentication: OAuth2 refresh handled by engine. Sends Authorization: Bearer ACCESS_TOKEN.

Folder ID 0 is the root folder of the authenticated user.

File-vs-Folder IDs: Box assigns numeric IDs that are unique within file-space and folder-space but can collide across (file 123 ≠ folder 123). Always know whether you're operating on a file or folder.

Upload: file upload uses a different host (upload.box.com) with multipart. Out of scope here for content upload — use the create_shared_link pattern with externally-hosted files for ingest.

Pagination: limit (max 1000) + offset (0-based). Some endpoints support marker cursor pagination — pass usemarker=true.

Rate limits: ~16 req/sec per token, soft. 429 with Retry-After.

Out of scope here: file upload multipart, Box Sign workflows, retention policies, the new Box AI inference endpoints.