1. Conduid
  2. Developer Tools
  3. hmk/box-mcp-server
MCP server · Developer Tools

hmk/box-mcp-server

A Box model context protocol server to search, read and access files

Unclaimed BSD-3-Clause last commit a year ago devtools
54Fair

Scored 2 months ago · breakdown

About hmk/box-mcp-server

hmk/box-mcp-server is an MCP server published by hmk in the Developer Tools category: a Box model context protocol server to search, read and access files.

The repository has 11 stars and 11 forks, with the last commit a year ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

Install
npx box-mcp-server
Claude Code
claude mcp add box-mcp-server -- npx -y box-mcp-server
npx
npx -y box-mcp-server

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about hmk/box-mcp-server

Powered by Claude · Grounded in docs

I know everything about hmk/box-mcp-server. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 14 hours ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • ✓Tests presentA test suite exists in the repository.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

Releases

v0.2.2v0.2.2 · 4 Jan 2025What's Changed feat: add BOX_JWT env config by @hmk in https://github.com/hmk/box-mcp-server/pull/6 Full Changelog: https://github.com/hmk/box-mcp-server/compare/v0.1.9...v0.2.2
v0.2.1v0.2.1 · 4 Jan 2025

README

box-mcp-server

CI

Usage

You will need:

  • BOX_USER_ID

and one of the following:

  • BOX_JWT_BASE64 (recommended)
  • BOX_JWT_CONFIG_PATH
  • BOX_JWT

Auth

JSON Web Token (JWT) Authorization (recommended)

How to get a JWT

Using a JWT Config allows persistent connection to Box.

You will need a paid Box enterprise account, or you can sign up for a free developer account (make sure you are signed out of Box before clicking that link).

Visit the Box Developer Console and create a new application. Make sure the authorization type is JSON Web Token.

Go to Configuration > Add and Manage Public Keys and Generate a Public/Private Keypair. If you have not already, Box prompt you to set up 2 factor authentication and Authorize the application as an administrator in your box account. You will need to:

  1. give the application App + Enterprise Access, and
  2. enable the make API calls using the as-user header option

via the Box Application's Configuration page. Make sure to reauthorize the application if you are modifying these settings.

Base64 encoding JWT

To encode your JWT in Base64, you can use the following command in your terminal:

cat /path/to/your/box-jwt-config.json | base64

Replace /path/to/your/box-jwt-config.json with the actual path to your JWT configuration file. This will output the Base64 encoded JWT which you can then use in your environment variables.

Claude Desktop Configuration

{
  "mcpServers": {
    "box": {
      "command": "npx",
      "args": ["box-mcp-server"],
      "env": {
        "BOX_JWT_BASE64": "YOUR_BASE64_ENCODED_JWT",
        "BOX_USER_ID": "123456"
      }
    }
  }
}

Developer Token Authorization (easiest)

Using a developer token is the easiest way to integrate with Box, but will only last 60 minutes.

To get started, set the BOX_DEV_TOKEN to a Box Developer Token.

Begin by visiting the Box Developer Console and create a new application. The authorization type does not currently matter, as all support Box Developer Token.

Once your application is created, navigate to its configuration setings and click Generate Developer Token.

Claude Desktop Configuration

{
  "mcpServers": {
    "box": {
      "command": "npx",
      "args": ["box-mcp-server"],
      "env": {
        "BOX_DEV_TOKEN": "YOUR_DEV_TOKEN_GOES_HERE"
      }
    }
  }
}

Capabilities

  1. Searching files
  2. Reading files
  • PDF
  • Word
  • Others

Development

Prerequisites

Before you begin, ensure you have the following installed:

  • Node.js (recommended v22 or higher)
  • npm
  • git
  • dotenv

Setting up Development Environment

To set up the development environment, follow these steps:

  1. Fork the repository

    • Click the "Fork" button in the top-right corner of this repository
    • This creates your own copy of the repository under your Github acocunt
  2. Clone Your Fork:

    git clone https://github.com/YOUR_USERNAME/box-mcp-server.git
    cd box-mcp-server
    
  3. Add Upstream Remote

    git remote add upstream https://github.com/hmk/box-mcp-server.git
    
  4. Copy the dotenv file

    cp .env.template .env
    
  5. Install dependencies:

    npm install
    
  6. Run watch to keep index.js updated:

    npm run watch
    
  7. Start the model context protocol development server:

    dotenv npx @modelcontextprotocol/inspector node PATH_TO_YOUR_CLONED_REPO/dist/index.js
    
  8. If the development server did not load the environment variable correctly, set the BOX_DEV_TOKEN on the left-hand side of the mcp inspector.

README fetched from the repository 14 hours ago. The original is authoritative.

Questions

About hmk/box-mcp-server

How do I install hmk/box-mcp-server?

Run npx box-mcp-server, then add the server to your MCP client's configuration.

Is hmk/box-mcp-server safe to use with an AI agent?

Its trust score is 54 out of 100 (fair). It passes 5 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is hmk/box-mcp-server still maintained?

The last commit was a year ago and 2 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.