// SCAN REPORT

Box

93 tools. 50 can modify or destroy data without limits.

9 destructive tools with no built-in limits. Policy required.

Last updated:

50 can modify or destroy data
43 read-only
93 tools total
// TOOL MAP
Read (43) Write / Execute (41) Destructive / Financial (9)
// WHAT CAN GO WRONG
✕

Destructive tools (box_collaboration_delete_tool, box_docgen_template_delete_tool, box_file_delete_tool) permanently delete resources. There is no undo. An agent calling these in a retry loop causes irreversible damage.

✕

Write operations (box_collaboration_file_group_by_group_id_tool, box_collaboration_file_user_by_user_id_tool, box_collaboration_file_user_by_user_login_tool) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

✕

Execute tools (box_authorize_app_tool) trigger processes with side effects. Builds, notifications, workflows — all fired without throttling.

One command. Full control.

Intercept sits between your agent and Box. Every tool call checked against your policy before it executes — so your agent can do its job without breaking things.

npx -y @policylayer/intercept scan -- npx -y @box-community/mcp-server-box
Scans every tool. Generates a policy. Starts enforcing.
Works with Claude Code · Cursor · Claude Desktop · Windsurf · any MCP client
// RECOMMENDED RULES
Deny destructive operations
box_collaboration_delete_tool:
  rules:
    - action: deny

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
box_collaboration_file_group_by_group_id_tool:
  rules:
    - rate_limit: 30/hour

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
box_ai_ask_file_multi_tool:
  rules:
    - rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// ALL 93 BOX TOOLS
DESTRUCTIVE 9 tools
Destructive box_collaboration_delete_tool Destructive box_docgen_template_delete_tool Destructive box_file_delete_tool Destructive box_folder_delete_tool Destructive box_metadata_delete_instance_on_file_tool Destructive box_shared_link_file_remove_tool Destructive box_shared_link_folder_remove_tool Destructive box_task_remove_tool Destructive box_web_link_delete_by_id_tool
EXECUTE 1 tools
Execute box_authorize_app_tool
WRITE 40 tools
Write box_collaboration_file_group_by_group_id_tool Write box_collaboration_file_user_by_user_id_tool Write box_collaboration_file_user_by_user_login_tool Write box_collaboration_folder_group_by_group_id_tool Write box_collaboration_folder_user_by_user_id_tool Write box_collaboration_update_tool Write box_docgen_create_batch_tool Write box_docgen_create_single_file_from_user_input_tool Write box_docgen_template_create_tool Write box_file_copy_tool Write box_file_lock_tool Write box_file_move_tool Write box_file_rename_tool Write box_file_retention_date_clear_tool Write box_file_retention_date_set_tool Write box_file_set_description_tool Write box_file_unlock_tool Write box_folder_copy_tool Write box_folder_create_tool Write box_folder_favorites_add_tool Write box_folder_favorites_remove_tool Write box_folder_move_tool Write box_folder_rename_tool Write box_folder_set_collaboration_tool Write box_folder_set_description_tool Write box_folder_tag_add_tool Write box_folder_tag_remove_tool Write box_metadata_set_instance_on_file_tool Write box_metadata_template_create_tool Write box_metadata_update_instance_on_file_tool Write box_shared_link_file_create_or_update_tool Write box_shared_link_folder_create_or_update_tool Write box_shared_link_web_link_create_or_update_tool Write box_task_assign_by_email_tool Write box_task_assign_by_user_id_tool Write box_task_complete_create_tool Write box_task_review_create_tool Write box_task_update_tool Write box_web_link_create_tool Write box_web_link_update_by_id_tool
READ 43 tools
Read box_ai_ask_file_multi_tool Read box_ai_ask_file_single_tool Read box_ai_ask_hub_tool Read box_ai_extract_freeform_tool Read box_ai_extract_structured_enhanced_using_fields_tool Read box_ai_extract_structured_using_fields_tool Read box_ai_extract_structured_using_template_tool Read box_collaboration_list_by_file_tool Read box_collaboration_list_by_folder_tool Read box_docgen_get_job_by_id_tool Read box_docgen_list_jobs_by_batch_tool Read box_docgen_template_get_by_id_tool Read box_docgen_template_get_by_name_tool Read box_docgen_template_list_jobs_tool Read box_docgen_template_list_tags_tool Read box_docgen_template_list_tool Read box_file_info_tool Read box_folder_info_tool Read box_folder_items_list_tool Read box_folder_list_tags_tool Read box_groups_list_by_user_tool Read box_groups_list_members_tool Read box_groups_search_tool Read box_metadata_get_instance_on_file_tool Read box_metadata_template_get_by_key_tool Read box_metadata_template_get_by_name_tool Read box_metadata_template_list_tool Read box_search_folder_by_name_tool Read box_search_tool Read box_shared_link_file_find_by_shared_link_url_tool Read box_shared_link_file_get_tool Read box_shared_link_folder_find_by_shared_link_url_tool Read box_shared_link_folder_get_tool Read box_task_assignment_details_tool Read box_task_assignments_list_tool Read box_task_details_tool Read box_task_file_list_tool Read box_users_list_tool Read box_users_locate_by_email_tool Read box_users_locate_by_name_tool Read box_users_search_by_name_or_email_tool Read box_web_link_get_by_id_tool Read box_who_am_i
// FAQ
Can an AI agent delete data through the Box MCP server? +

Yes. The Box server exposes 9 destructive tools including box_collaboration_delete_tool, box_docgen_template_delete_tool, box_file_delete_tool. These permanently remove resources with no undo. Intercept blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Box? +

The Box server has 40 write tools including box_collaboration_file_group_by_group_id_tool, box_collaboration_file_user_by_user_id_tool, box_collaboration_file_user_by_user_login_tool. Set rate limits in your policy file -- for example, rate_limit: 10/hour prevents an agent from making more than 10 modifications per hour. Intercept enforces this at the transport layer.

How many tools does the Box MCP server expose? +

93 tools across 4 categories: Destructive, Execute, Read, Write. 43 are read-only. 50 can modify, create, or delete data.

How do I add Intercept to my Box setup? +

One line change. Instead of running the Box server directly, prefix it with Intercept: intercept -c box.yaml -- npx -y @@box-community/mcp-server-box. Download a pre-built policy from policylayer.com/policies/box and adjust the limits to match your use case.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies available for each. Same risk classification, same one-command setup.

Mcp Api 310 tools
adminautomation
Aibtc 288 tools
adminautomation
Google Super 200 tools
adminautomation
Propresenter 177 tools
adminautomation
Leaper Vision Toolkit 169 tools
adminautomation
Apiosk 160 tools
adminautomation
Mcp Sitecore 153 tools
adminautomation
SmartBear MCP 147 tools
adminautomation
policylayer/intercept

Control every MCP tool call
your agent makes.

Set budgets, approvals, and hard limits across MCP servers.

npx -y @policylayer/intercept init
Protect your agent in 30 seconds. Scans your MCP config and generates enforcement policies for every server.
// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.