get_download_url

SERVERBoxkite — Xero Backup & Export SOURCEhttps://app.getboxkite.com/mcp

Low RISK CLASS

Category Read

Parameters 11 required

Recommended Allowedsee the rule below

Registry record Grade D, identity unverified Pull the record →

This record as markdown: /tools/com-getboxkite-xero-backup-export/get-download-url.md

WHAT IT DOES

What get_download_url does on Boxkite — Xero Backup & Export

AI agents call get_download_url to retrieve information from Boxkite — Xero Backup & Export without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameter	Type	Required	Description
`exportId`	string	Yes

Parameters from the server's own tool schema.

RISK

Why get_download_url is rated Low

This tool retrieves information (a pre-signed download URL and metadata like byteSize and fileCount) without creating, modifying, deleting, or executing anything. It is a read-only accessor for export archives that have already been generated. The 7-day retention window and short-lived URL are security controls, not indicators of destructive or financial risk.

From the tool's definition Tool description explicitly states it 'Returns a short-lived signed URL' for download; server description is 'read-only backup and export'; no modifications, deletions, or executions occur—only retrieval of metadata and a URL for accessing already-exported…

Risk signalsBulk/mass operation — affects multiple targets

Attacks that exploit this kind of access

RECOMMENDED RULE

The rule that runs get_download_url safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Boxkite — Xero Backup & Export, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_download_url, this is the rule to start with:

get_download_url Allowed

get_download_url is read-only, so it stays allowed. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_download_url": {}
  }
}

ALLOW ONLY THIS TOOL → Instant setup, no code required.

The button opens the PolicyLayer dashboard: create your workspace, connect Boxkite — Xero Backup & Export, apply this rule, and every get_download_url call is checked against it from then on.

FAQ

Questions about get_download_url

What does the get_download_url tool do? +

Returns a short-lived signed URL for the export ZIP, valid within the export's 7-day retention window, along with byteSize (the archive's size in bytes, null if unavailable) and fileCount. These archives range from a few MB to several GB. The archive contains the exported files plus manifest.json (every file with its sha256) and Info/ (the file-to-Xero-object mapping). It is categorised as a Read tool in the Boxkite — Xero Backup & Export MCP Server, which means it retrieves data without modifying state.

What parameters does get_download_url accept? +

get_download_url accepts 1 parameter: exportId. Required: exportId. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on get_download_url? +

Register the Boxkite — Xero Backup & Export MCP server in PolicyLayer and add a rule for get_download_url: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Boxkite — Xero Backup & Export. Nothing to install.

What risk level is get_download_url? +

get_download_url is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit get_download_url? +

Yes. Add a rate_limit block to the get_download_url rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block get_download_url completely? +

Set action: deny in the PolicyLayer policy for get_download_url. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides get_download_url? +

get_download_url is provided by the Boxkite — Xero Backup & Export MCP server (https://app.getboxkite.com/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

KEEP EXPLORING

More on Boxkite — Xero Backup & Export, and thousands of servers like it.

This server

All 7 Boxkite — Xero Backup & Export tools →

Across the catalogue

get_cocktail_by_category on Cocktails RAG MCP Server →get_file_snippet on ACE-MCP →get_torrent_detail on M-Team MCP Server →aiva_get_affiliate on AIVA MCP Server → The MCP Attack Database →

Guides

Roll out MCP under one policy →Data exfiltration →MCP token cost →