You can connect Box to Claude using the Model Context Protocol (MCP), and once it’s connected, Claude can search your Box account for a file by name or content, read a document to summarize it, or list what’s in a shared folder — without you opening Box to look it up yourself. This guide covers what Box’s MCP server does, both ways to connect it — directly or through a gateway — and one thing worth knowing before you try: Box’s OAuth isn’t currently open to every client that asks.

What the Box MCP server actually does

Box publishes a remote MCP server at mcp.box.com. It exposes the documents and folders in your Box account as tools Claude can call directly, so prompts like these work against your real content instead of a screenshot you’d otherwise have to describe:

  • “Find the contract we stored in Box under the Acme deal.”
  • “Summarize the spec sitting in the Q3 Planning folder.”
  • “What files has legal added to the shared folder this week?”
  • “Search Box for anything mentioning the renewal date.”

Claude reads through the same permissions your Box account already has — a search or a read against a shared folder sees whatever you’re a collaborator on, the same as opening Box in a browser would. Box is built around enterprise content storage, so an account often holds folders several teams depend on at once, not just your own files.

The catch: Box’s OAuth isn’t open to every client yet

Some servers in gate’s directory — Notion, Todoist, Airtable — let any AI client register itself and go straight through a one-click OAuth consent screen. Box’s MCP endpoint is one of a handful where that isn’t the case today: the vendor’s OAuth currently only admits clients Box has allow-listed in advance, rather than opening registration to any client that shows up. In practice, that can mean a connection attempt from a new or less-common client fails at the authorization step, even though the server itself is real and documented.

This is the same gap covered in MCP OAuth scopes explained: a server supporting OAuth in principle isn’t the same claim as every client being able to walk through it today. If you hit an “unauthorized client” error connecting Box, that’s the most likely reason — not a mistake in your setup. See the unauthorized client error explained for the general pattern and workarounds. Whether a given client can connect changes as vendors expand their allow-list over time, so it’s worth checking again later if it doesn’t work on your first attempt.

Option 1: Connect Box to Claude directly

If the client you’re using is one Box currently admits, the setup is:

  • Open Claude’s connector or MCP settings.
  • Add a remote server pointing at Box’s MCP endpoint.
  • Sign in with your Box account when prompted — standard OAuth, so Claude never sees your Box password, and you can revoke access from Box’s own security settings at any time.

That’s enough if Claude is the only AI client you use with Box. The tradeoff shows up once you add a second client — ChatGPT for a quick lookup, Cursor for pulling a spec into a coding task — or a second person on the team: each one needs its own attempt at the same OAuth step, with the same chance of hitting the allow-list wall independently.

Option 2: Connect it once, through a gateway

If you’re already juggling more than one MCP server or more than one AI client, wiring each pair directly gets old fast — that’s the connection sprawl covered in what an MCP gateway is. The idea is to connect Box (and everything else) to one gateway URL, then point every AI client at that single URL instead of reconfiguring each one and re-running the OAuth step per client.

With gate specifically, connecting Box looks like this: add gate’s gateway URL to Claude once, then pick Box from the Box server page in the directory and sign in the same way you would directly. gate’s catalog tracks each server’s currently verified connectivity — including cases like this one, where a vendor’s OAuth is still allow-listed — so you know what to expect before you start, instead of finding out mid-flow. See the full list of servers on the MCP servers page.

What to check before you connect your Box content

A Box account usually holds more than the one folder you had in mind when you connect it — personal files, shared team folders, whatever a coworker filed away months ago. A few things worth checking before or right after you connect:

  • How wide is the search? A tool that can search “everything in my Box” will surface whatever matches, including a file in a shared folder you no longer actively use. Know the scope before you ask Claude to “find anything about the acquisition.”
  • Read, or read and manage? A tool that reads and summarizes a document is low-risk. A tool that can create, move, or delete files is a different category — moving a file out of a shared folder or overwriting one isn’t something a teammate will necessarily notice until they go looking for it. Check the actual tool list rather than assuming it’s read-only — gate’s free MCP security scanner lists every tool a server exposes.
  • Could a file’s own content steer what Claude does next? A document in your Box is exactly the kind of untrusted content covered in the confused deputy problem in MCP: if Claude reads a file containing embedded instructions and acts on them, the tool call is still fully authorized — it’s just doing something you didn’t intend.
  • Who else on the team connects it? If more than one teammate wires up Box to their own client, a shared, revocable setup beats everyone holding their own write-capable grant — the same question covered in MCP access control for teams.

Troubleshooting the connection

  • “Unauthorized client” or the OAuth screen never appears. Most likely the allow-list issue above — the client you’re using may not be one Box currently admits for this endpoint.
  • Sign-in succeeds but Claude can’t see a file you know exists. Box’s tools respect your account’s own permissions; a file in a folder you’re not a collaborator on won’t show up any more than it would in the Box app itself.
  • Tools disappear after a Box update. Remote servers can change their tool list without warning. If you’re connected through a gateway, that kind of change is exactly what drift detection is meant to catch — see how MCP rug pulls work for why a one-time review isn’t enough.
Where gate fits: gate’s directory lists each server’s currently verified connectivity — one-click OAuth, key-based, or allow-listed like Box — so you know what kind of setup to expect before you start. Every server is scanned for prompt injection before it goes live, and every call goes into a plain-language log, which matters more for a tool that can read or move real files than for most. See the full gateway at /mcp-gateway.

The bottom line

Connecting Box to Claude with MCP is a normal OAuth flow when the client you’re using is one Box currently allows — direct if it’s your only client, or once through a gateway if you want the same file access shared and governed across every AI client on the team. If the connection fails at the authorization step, that’s worth reading as “not allow-listed yet” rather than a broken setup. Either way, know which tools can only read a file and which can move or delete one — that distinction matters more here than it does for most content tools in this series.