// SCAN REPORT

Box

93 tools. 50 can modify or destroy data without limits.

9 destructive tools with no built-in limits. Policy required.

Last updated:

50 can modify or destroy data
43 read-only
93 tools total

50 Box tools can modify or destroy data, with no limits today. PolicyLayer puts allow, deny, and rate-limit rules on every call. Live in minutes.

SECURE BOX →

Free to start. No card required.

TOOL MAP

Read (43) Write / Execute (41) Destructive / Financial (9)

WHAT CAN GO WRONG

✕

Destructive tools (box_collaboration_delete_tool, box_docgen_template_delete_tool, box_file_delete_tool) permanently delete resources. There is no undo. An agent calling these in a retry loop causes irreversible damage.

✕

Write operations (box_collaboration_file_group_by_group_id_tool, box_collaboration_file_user_by_user_id_tool, box_collaboration_file_user_by_user_login_tool) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

✕

Execute tools (box_authorize_app_tool) trigger processes with side effects. Builds, notifications, workflows — all fired without throttling.

RECOMMENDED RULES

Deny destructive operations
{
  "box_collaboration_delete_tool": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "box_collaboration_file_group_by_group_id_tool": {
    "limits": [
      {
        "counter": "box_collaboration_file_group_by_group_id_tool_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "box_ai_ask_file_multi_tool": {
    "limits": [
      {
        "counter": "box_ai_ask_file_multi_tool_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Get this policy live on your own Box server in minutes. Tune the limits to your setup; PolicyLayer enforces it on every call.

ENFORCE ON MY BOX →

ALL 93 BOX TOOLS

DESTRUCTIVE 9 tools
Destructive box_collaboration_delete_tool Destructive box_docgen_template_delete_tool Destructive box_file_delete_tool Destructive box_folder_delete_tool Destructive box_metadata_delete_instance_on_file_tool Destructive box_shared_link_file_remove_tool Destructive box_shared_link_folder_remove_tool Destructive box_task_remove_tool Destructive box_web_link_delete_by_id_tool
EXECUTE 1 tools
Execute box_authorize_app_tool
WRITE 40 tools
Write box_collaboration_file_group_by_group_id_tool Write box_collaboration_file_user_by_user_id_tool Write box_collaboration_file_user_by_user_login_tool Write box_collaboration_folder_group_by_group_id_tool Write box_collaboration_folder_user_by_user_id_tool Write box_collaboration_update_tool Write box_docgen_create_batch_tool Write box_docgen_create_single_file_from_user_input_tool Write box_docgen_template_create_tool Write box_file_copy_tool Write box_file_lock_tool Write box_file_move_tool Write box_file_rename_tool Write box_file_retention_date_clear_tool Write box_file_retention_date_set_tool Write box_file_set_description_tool Write box_file_unlock_tool Write box_folder_copy_tool Write box_folder_create_tool Write box_folder_favorites_add_tool Write box_folder_favorites_remove_tool Write box_folder_move_tool Write box_folder_rename_tool Write box_folder_set_collaboration_tool Write box_folder_set_description_tool Write box_folder_tag_add_tool Write box_folder_tag_remove_tool Write box_metadata_set_instance_on_file_tool Write box_metadata_template_create_tool Write box_metadata_update_instance_on_file_tool Write box_shared_link_file_create_or_update_tool Write box_shared_link_folder_create_or_update_tool Write box_shared_link_web_link_create_or_update_tool Write box_task_assign_by_email_tool Write box_task_assign_by_user_id_tool Write box_task_complete_create_tool Write box_task_review_create_tool Write box_task_update_tool Write box_web_link_create_tool Write box_web_link_update_by_id_tool
READ 43 tools
Read box_ai_ask_file_multi_tool Read box_ai_ask_file_single_tool Read box_ai_ask_hub_tool Read box_ai_extract_freeform_tool Read box_ai_extract_structured_enhanced_using_fields_tool Read box_ai_extract_structured_using_fields_tool Read box_ai_extract_structured_using_template_tool Read box_collaboration_list_by_file_tool Read box_collaboration_list_by_folder_tool Read box_docgen_get_job_by_id_tool Read box_docgen_list_jobs_by_batch_tool Read box_docgen_template_get_by_id_tool Read box_docgen_template_get_by_name_tool Read box_docgen_template_list_jobs_tool Read box_docgen_template_list_tags_tool Read box_docgen_template_list_tool Read box_file_info_tool Read box_folder_info_tool Read box_folder_items_list_tool Read box_folder_list_tags_tool Read box_groups_list_by_user_tool Read box_groups_list_members_tool Read box_groups_search_tool Read box_metadata_get_instance_on_file_tool Read box_metadata_template_get_by_key_tool Read box_metadata_template_get_by_name_tool Read box_metadata_template_list_tool Read box_search_folder_by_name_tool Read box_search_tool Read box_shared_link_file_find_by_shared_link_url_tool Read box_shared_link_file_get_tool Read box_shared_link_folder_find_by_shared_link_url_tool Read box_shared_link_folder_get_tool Read box_task_assignment_details_tool Read box_task_assignments_list_tool Read box_task_details_tool Read box_task_file_list_tool Read box_users_list_tool Read box_users_locate_by_email_tool Read box_users_locate_by_name_tool Read box_users_search_by_name_or_email_tool Read box_web_link_get_by_id_tool Read box_who_am_i

FAQ

Can an AI agent delete data through the Box MCP server? +

Yes. The Box server exposes 9 destructive tools including box_collaboration_delete_tool, box_docgen_template_delete_tool, box_file_delete_tool. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Box? +

The Box server has 40 write tools including box_collaboration_file_group_by_group_id_tool, box_collaboration_file_user_by_user_id_tool, box_collaboration_file_user_by_user_login_tool. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Box.

How many tools does the Box MCP server expose? +

93 tools across 4 categories: Destructive, Execute, Read, Write. 43 are read-only. 50 can modify, create, or delete data.

How do I enforce a policy on Box? +

Register the Box MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies for each. Same risk classification, live on your fleet in minutes.

Nodebench 724 tools
adminautomation
UnClick 451 tools
adminautomation
NowAIKit — ServiceNow AI Toolkit 446 tools
adminautomation
0nmcp 407 tools
adminautomation
ServiceNow MCP Server 384 tools
adminautomation
TheProtocol — Sovereign AI Agent Platform 380 tools
adminautomation
Aibtc 327 tools
adminautomation
Fusionauth 314 tools
adminautomation

Enforce policy on every Box tool call.

Deterministic rules across all 93 Box tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

SECURE BOX →

Free to start. No card required.

4,600+ MCP servers and 31,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.