Skip to main content
Box gives developers a governed content layer for applications, workflows, and AI agents. Files in Box already have permissions, versions, metadata, collaboration, and audit history. Your application can use those controls instead of rebuilding them around a file store or AI pipeline. Use Box when your product needs to work with documents, images, contracts, scans, presentations, or other unstructured content that people create and update as part of their work.

​
When should developers use Box?

Box is a good fit when your application needs one or more of these capabilities:
  • Content APIs: Upload, download, preview, search, share, and organize files and folders.
  • Access controls: Use Box users, groups, collaborations, scopes, and waterfall permissions.
  • Business context: Add metadata to files, query that metadata, and respond to content events.
  • AI on enterprise content: Ask questions, summarize files, and extract structured data without removing content from Box.
  • Agent access: Connect external AI agents through the Box MCP server or Box CLI.
  • Document workflows: Combine content intake, AI, review, document generation, and signature.
  • Embedded experiences: Add file browsing, preview, upload, and metadata views to your application with UI Elements.
If your application only needs private object storage behind an access model you already own, a cloud object store may be simpler. Box is most useful when files are shared work objects that need permissions, collaboration, business context, or governance.

​
How does Box prepare unstructured content for AI?

AI systems produce better answers when they use content that is current, relevant, and safe to access. A useful content preparation process has four parts:
1

Centralize access

Put the content your application needs in Box folders, or curate selected files and folders into Box Hubs. You do not need to expose the whole enterprise to an AI system. Start with the smallest collection that supports the use case.
2

Add business context

File names and timestamps rarely explain what a document means. Metadata adds fields such as document type, owner, account, approval status, or review date. Use Box AI Extract when those values are trapped inside the document.
3

Curate what AI can use

Separate approved content from drafts, stale files, and records that should not enter the workflow. Hubs give people and Box AI a curated knowledge set while preserving permissions on the source files. See the answer bank tutorial for a working example.
4

Keep permissions in the request path

Box AI, Box Hubs, and the Box MCP server use the access available to the requesting user or application. Connecting an agent does not grant that agent access to every file in the enterprise. The identity, scopes, and file collaborations still determine what it can read or change.

​
Choose an implementation path

​
Box-managed retrieval or your own RAG pipeline?

Start with Box-managed retrieval when the source content already lives in Box and permission-aware answers are the main requirement.

Box-managed retrieval

Use Box Hubs with Box AI Ask when you need:
  • A curated set of source documents
  • Answers grounded in files the requesting user can access
  • Citations back to source content
  • Less retrieval infrastructure to operate

Your own RAG pipeline

Build your own retrieval-augmented generation (RAG) pipeline when you need:
  • A retrieval engine or embedding model that Box AI does not provide
  • One index that combines Box content with data from other systems
  • Custom chunking, ranking, or evaluation logic
  • A model hosting or inference setup that you control
If you export Box content, your pipeline must enforce permissions and keep its index current as files, versions, and collaborations change. See the Pinecone integration for one implementation.

​
Does the Box MCP server bypass Box permissions?

No. The Box MCP server acts through an authenticated Box user. Integration scopes set the maximum actions the client can request. Box permissions then decide which files and folders that user can access. Use a dedicated test account and sample content while you develop. Before production, choose the user or application identity deliberately and request only the scopes the agent needs. See set up the MCP server.

​
What should you build first?

Start with the smallest path that proves Box fits the job:
  1. Complete the Quick Start to create an account, generate a developer token, and upload your first file.
  2. Plan your integration and choose an application type.
  3. Pick one working use case from the tutorials.
  4. Replace the developer token with a production authentication method before deployment.
Product availability depends on your Box plan and enterprise settings. See free developer plan information for included features and upgrade paths.

​
Learn more about AI-ready content

For the enterprise strategy behind content centralization, metadata-first curation, governance, and AI data quality, read How companies centralize unstructured data for AI.
Last modified on August 31, 2026