Provider REST API
ProductivityConnect Claude to Box
Browse folders, search content, read file and folder details, create folders, delete, share links, and see who has access. Toolspoke puts 11 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.
- Connection
- Provider REST API
- Authentication
- Server authentication (Client Credentials Grant)
- Actions exposed
- 11
- Cost per call (typical)
- 1 credit
- Adapter
- Maintained by Toolspoke
Connected in three steps
- 1
Install Box
Open the marketplace in your workspace, add Box to the project your agents work in, and it appears on the gateway immediately.
- 2
Connect the credential
Authenticate with server authentication (client credentials grant). Where to get one, and what it has to be able to reach, is the next section.
- 3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.
.mcp.json{
"mcpServers": {
"toolspoke": {
"type": "http",
"url": "https://toolspoke.com/mcp"
}
}
}One block covers every tool you have installed. Box shows up in the client as soon as your policy allows it, and so does everything else you install later.
Where the address goes, per client
- Claude Code
Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp- Claude and Claude Desktop
Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp- Cursor
~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }- Codex
~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"- VS Code
.vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }
What Box asks for
Server authentication (Client Credentials Grant). You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.
- Client IDRequired
- Box Developer Console → your app → Configuration → OAuth 2.0 Credentials. The app must be of type Server Authentication (with Client Credentials Grant), and must be authorised in the Box Admin Console before any token is issued.
- xyz123abc…
- Client secretRequired
- Shown beside the client ID in the Developer Console. Viewing it requires two-factor authentication on the Box account.
- Enterprise IDRequired
- Box Developer Console → General Settings → App Info → Enterprise ID. If you set the subject type below to "user", put that user's ID here instead.
- 123456789
- Authenticate asOptional
- "enterprise" (the default) signs in as the app's own Service Account, which only sees folders that have been collaborated to it. "user" signs in as the person named above and needs Generate User Access Tokens enabled on the app.
What Claude can do in Box
11 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.
- Reads
- 7Reads
- Writes
- 1Writes
- Destructive
- 3Destructive
Reads
7Fetches data and changes nothing.
get_current_userReturn the Box identity this connection authenticates as - its user ID, name, login, and status. With the default enterprise subject type that is the app's Service Account rather than a person, and its ID is what a folder has to be collaborated to before this connector can see the folder. It reads no file, which makes it the right proof that the credential works.
list_folder_itemsList what is directly inside one folder - its files, subfolders and web links. The root folder of any Box account is always id "0", which is where to start. Box returns a small "mini" representation of each item by default, so this asks for a useful set of fields instead; widen or narrow it with `fields`. For a folder with more entries than one page holds, set use_marker true and pass the `next_marker` from the response back as `marker`.
get_folderRead one folder's own details - its name, where it sits, when it changed, how big it is, and whether it already has a shared link. Use "0" for the account root. This does not list what is inside it; that is list_folder_items.
get_fileRead one file's details - its name, size, type, the folder it sits in, when it last changed, and whether it already has a shared link. This returns information about the file, not its contents: downloading bytes is a different Box host and this connector does not carry it.
search_filesSearch Box for files, folders and web links. The query matches names, descriptions and the text inside documents, and supports "exact phrase" in double quotes together with AND, OR and NOT in capitals. Narrow it with `type` to one kind of item, with `ancestor_folder_ids` to look inside particular folders, or with `content_types` to say where the words should appear. The default scope is what this connection can already reach; enterprise_content searches the whole enterprise and has to be enabled by Box support first.
list_collaborationsList who has been given access to one file and in what role - editor, viewer, previewer, uploader, co-owner and so on. Read it before create_shared_link to see whether the person who needs the file already has it, which is the reversible way to give somebody access.
list_usersList the people in this Box enterprise, optionally narrowed by a name or login prefix. Their IDs are what a collaboration is granted to. Reading this needs an identity with admin rights in the enterprise, which the Service Account has by default. Note that user_type "external" and "all" reach beyond the enterprise's own staff to people outside it.
Writes
1Creates or updates something on the other side.
create_folderCreate one empty folder inside another. `parent_id` defaults to "0", the account root; with the Service Account identity that root is the app's own, not anybody's My Files, so a folder is usually wanted inside a folder that has been collaborated to this connection. Box rejects a name that already exists in the same parent, and rejects slashes, leading or trailing spaces, "." and "..".
Destructive
3Deletes or permanently alters something. Worth granting on purpose.
create_shared_linkPut a shared link on a file. Classified destructive, alongside deleting: with access "open" the link works for anybody who has the URL, signed in to Box or not, and a URL that has been sent somewhere cannot be un-sent. "company" keeps it inside the enterprise and needs a paid plan; "collaborators" only works for people already invited to the file, which is the safe default when a link is wanted for convenience rather than for sharing. Setting `unshared_at` bounds the exposure. Box replaces any link the file already had, so read get_file first to see whether one exists.
delete_fileDelete one file. Box moves it to the enterprise's trash, where it stays recoverable for the retention window an admin has set - 30 days by default - and is then removed for good. Pass `if_match` with the file's `etag` from get_file to have Box refuse the delete if somebody has changed the file since it was read. Box answers with an empty 204 on success.
delete_folderDelete one folder. Box refuses a folder that still has anything in it unless `recursive` is true, and recursive deletion takes every file and subfolder with it. Everything goes to the enterprise's trash and is recoverable for the retention window an admin has set. Box answers with an empty 204 on success.
What it will not do
Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.
- It cannot call anything else
- The 11 actions above are the whole of it. A call to any other name is refused before it reaches Box rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
- It reaches no further than your credential
- Toolspoke holds no access to Box of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
- It never hears from Box
- Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Box. An agent has to ask.
- It does not smooth over provider limits
- Toolspoke does not retry, queue or back off around Box's own rate limits. A call that Box refuses comes back to the agent as a failed call.
Before you connect it
What can Claude do in Box?
11 named actions: 7 that only read, 1 that write and 3 that delete or permanently alter something. They include get_current_user, list_folder_items and get_folder. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.
What credentials does the Box connector need?
Server authentication (Client Credentials Grant). The connector asks for client id, client secret and enterprise id, and optionally authenticate as. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.
Does the Box connector work with Cursor and Codex, or only Claude?
Any client that speaks MCP, and every one of them gets the same 11 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.
What does the Box connector not do?
The 11 actions above are the whole of it. A call to any other name is refused before it reaches Box rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Toolspoke holds no access to Box of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Box. An agent has to ask. Toolspoke does not retry, queue or back off around Box's own rate limits. A call that Box refuses comes back to the agent as a failed call.
Can I limit which actions an agent can call?
Yes, in two places. The project switches Box's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.
What gets recorded when an agent calls Box?
Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.