Skip to content
Status

Box

Connect the Speakeasy AI Control Plane to Box's hosted MCP server with credentials created by a Box Admin or Co-Admin.

You need a Box Admin or Co-Admin account for the enterprise you are connecting.

The Box MCP Server is available on all Box plans, but its tools depend on your plan. Box AI tools require an eligible Box AI plan or purchased Box AI Units. The Doc Gen scope requires an Enterprise Advanced license. Box meters and bills API calls made with the Integration Credentials created below.

Sign in to the Box Admin Console

Sign in to the Box Admin Console at app.box.com/master with your Box Admin or Co-Admin account.

Before creating credentials, complete one or both conditional sections as required: enable the Box AI API if users need Box AI tools, enable Box Doc Gen if users need Doc Gen tools, or both if they need both. If both are required, complete both before returning to Integrations. Then create credentials for the Custom Box MCP Server integration.

Find Custom Box MCP Server under Integrations

  1. Select Integrations.
  2. Apply the MCP Category filter, or type Custom Box MCP Server in the search bar at the top of the page.
  3. Find the Custom Box MCP Server tile. Some Box pages call this tile Box MCP server; if Custom Box MCP Server finds nothing, search for Box MCP server instead.

Do not use the Box MCP Server tab, which controls tool access, or a named partner tile.

Add Integration Credentials

When adding credentials for the first time, use the branch the tile presents.

If the Custom Box MCP Server tile shows Configuration:

  1. Open Configuration.
  2. Click Add Integration Credentials.

Otherwise:

  1. Hover over the Custom Box MCP Server (or Box MCP server) tile.
  2. Click Configure.
  3. Open Additional Configuration.
  4. Click + Add Integration Credentials.
  5. Retain the pre-filled credential name or enter a new one.
  6. Click Save.
  7. Open the created credential entry.

Set the Redirect URI

Replace the existing value or values in Redirect URIs with this value:

https://ai.speakeasy.com/mcp/remote_login_callback

Copy the Client ID and Client Secret

Copy both values while Box shows them.

  1. Copy the Client ID.
  2. Store the Client ID for Speakeasy setup.
  3. Copy the Client Secret.
  4. Store the Client Secret like a password for Speakeasy setup.

Check the Access scopes

  1. Review Access scopes.
  2. Select Box content access and any optional tool areas users need.

The documented scope strings are root_readwrite for Box content, ai.readwrite for Box AI, and docgen.readwrite for Box Doc Gen. The console may present descriptive checkbox labels instead of these strings. Select Box AI or Box Doc Gen access only when the enterprise has enabled and licensed those features. The Doc Gen scope requires an Enterprise Advanced license. Scopes cap what the connection can do; each user’s existing Box permissions still limit the content they can access.

Save the credential entry

Click Save, or use the equivalent Update or Apply action shown by your tenant, to finish the integration credentials.

After saving, if you have completed every required Box AI or Doc Gen section, continue to Connect your credentials unless you need optional tool-policy setup. If you do, complete Manage tool access before rollout first, then continue to Connect your credentials.

Enable the Box AI API (AI tools only)

Complete this step only if users need Box AI tools. Box AI APIs require an eligible Box AI plan or purchased Box AI Units. If the setting is unavailable, resolve the enterprise’s Box AI entitlement before continuing.

  1. Open Box AI in the Admin Console.
  2. Select Settings.
  3. Enable Enable AI API.

If users also need Doc Gen tools and you have not completed that conditional section, complete Enable Box Doc Gen. Return to Find Custom Box MCP Server under Integrations only after all required conditional sections are complete.

Enable Box Doc Gen (Doc Gen tools only)

Complete this step only if users need Doc Gen tools. The Doc Gen scope requires an Enterprise Advanced license.

  1. Open Enterprise Settings.
  2. Select Content and Sharing.
  3. Scroll to Box Doc Gen.
  4. Under Box Doc Gen Permissions, choose to enable Doc Gen for all managed users, selected users and groups, or everyone except selected users and groups.

By default, Doc Gen is disabled for all managed users.

If users also need Box AI tools and you have not completed that conditional section, complete Enable the Box AI API. Return to Find Custom Box MCP Server under Integrations only after all required conditional sections are complete.

Manage tool access before rollout (optional)

Complete this step only when enterprise policy requires restrictions or when you must enable an external-sharing tool that Box disables by default. Changes apply across the enterprise.

  1. Open the Admin Console.
  2. Select Integrations.
  3. Select the Box MCP Server tab.
  4. For a tool category, choose Disable all tools, Enable read only tools, Enable read & write tools, or Custom configuration from Enablement.

To control individual tools:

  1. Click Configure for the category.
  2. Set the toggles under Read only MCP tools and Write MCP tools.
  3. Click Save.

File preview requires a compatible application. Upload and download URL tools require an application that can make network requests; a cloud security owner may also need to allowlist domains.

If a client still shows the old tool list, refresh its tool list, start a new chat, or disconnect and reconnect it.

Add the server in Speakeasy

  1. In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.
  2. Click Add new to open Add MCP server.
  3. Choose From the catalog.
  4. On the MCP Catalog page, use Search MCP servers… to find Box.
  5. Open the Box entry and click Add.
  6. In the Add to Project dialog, under Identity, select User Identity. The dialog may preselect No Identity.
  7. Click Add to Project. If the dialog offers a Guardrails step, finish it or click Skip for now.

Box needs a client registered by hand, so the result says to finish setup in Settings > Identity, and the server stays Disabled for now. This is expected. Click Finish setup on the server’s result to open its Settings.

Connect your credentials

Box’s server names its sign-in provider as https://api.box.com/, with a trailing slash, while Box’s provider metadata says https://api.box.com. The provider picker cannot create a provider from that mismatch, so create the Box provider by hand first.

In the server’s Settings, find the Identity section and select User Identity. Then create the provider:

  1. Open Choose an identity provider and click Create a custom identity provider. This opens Remote Identity Providers.

  2. Click New Remote Identity Provider.

  3. In Issuer URL, enter https://api.box.com, with no trailing slash.

  4. Click Discover.

  5. Under Endpoints, confirm Authorization Endpoint and Token Endpoint show these values. If they are empty, enter them:

    https://account.box.com/api/oauth2/authorize
    https://api.box.com/oauth2/token

  6. Keep the derived Slug and click Create.

Add the Box client to that provider:

  1. On the new provider, click Add Client.
  2. Set Client Type to Manual.
  3. Paste the Box Client ID into Client ID.
  4. Paste the Box Client Secret into Client Secret (optional). Box requires it.
  5. Leave Scope (override) empty. Box then grants the Access scopes selected in Check the Access scopes.
  6. Confirm the displayed Redirect URI matches the value you entered in Set the Redirect URI.
  7. Click Create.

Connect the server to that client:

  1. Return to the server’s Settings > Identity and select User Identity.
  2. In Choose an identity provider, open the picker and choose the api.box.com provider you created.
  3. Choose Existing client.
  4. Under Client, pick the client you created.
  5. Click Save.

Then turn the server on:

  1. In Settings, open Danger Zone.
  2. Under Server Availability, turn on Enable MCP server so it shows Enabled.

Each user sees Box’s authorization prompt the first time they use the server.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Box’s MCP documentation.