https://mcp.box.com) when the agent supports MCP. Use the Box APIs, SDKs, or when the agent runs code. Either way, the agent only sees files the authenticated user or application can already access.
Connecting any agent platform to Box does not bypass file permissions. Box checks collaborations, waterfall folder permissions, and application scopes on every request.
How access works
Three layers apply on every request:
The MCP server does not impersonate other users or search the enterprise unless the identity already can. See
Choose an identity
End-user OAuth (default for MCP)
End-user OAuth (default for MCP)
The agent acts as the Box user who signs in. Use this for assistants that work on that person’s files: Copilot, Cursor, Claude, Foundry Tools, and similar clients.Enable MCP in the Admin Console, create integration credentials, and request only the scopes the agent needs. See .
Service account or CCG (automation)
Service account or CCG (automation)
Server-side jobs (extract on upload, publish to a hub, scheduled review) typically authenticate as a service account with .Collaborate that service account onto specific folders. Do not use a service account as a hidden superuser for an interactive agent. Downscope tokens when you pass credentials to a browser or untrusted runtime. See .
Production versus local tests
Use a and sample files while you learn the tools. The tutorial covers local setup and warns against pointing a coding agent at production content. For production:- An admin enables MCP (or authorizes the Platform App) in the Admin Console.
- Create dedicated integration credentials and request only the scopes you need.
- Choose the Box user or service account deliberately. Collaborate it onto the folders the agent should access.
- Test with that identity. If a file is missing from search or Ask, check collaborations first, not the model.
Microsoft agent platforms
GitHub Copilot and Microsoft Foundry Tools connect to Box through MCP with the same permission model as any other client:- The Box user who authorizes the connection is the identity.
- Admin-configured scopes cap what the client can request.
- SharePoint or Graph permissions do not replace Box permissions on Box files.
Related patterns
- Query a curated knowledge base with hubs and Ask: .
- Start with Box-managed retrieval before exporting to a vector index: .