The Box MCP server is a Model Context Protocol implementation that exposes Box's API as a standardized set of tools to AI agents. Once connected, an agent like Claude can perform search_files, get_file, list_folders, list_collaborations, and metadata operations on the authenticated user's behalf — turning Box's API surface into AI-actionable capabilities.
The setup pattern is consistent with other MCP integrations: a Box OAuth app registered in the Developer Console, the appropriate scopes (root_readwrite, manage_managed_users, depending on use case), and the server starts serving tool calls.
From the user's perspective, the AI agent suddenly knows their Box. From the security perspective, the AI agent now has read access — and often write access — to every file the user can touch in Box, including content shared from external organizations into the user's collaboration scope.
That's the value. It's also where security teams need a control layer.
The reason teams flip this on is the work it takes off their plate. Once the Box MCP server is wired into Claude (Desktop, Code, or Cowork) and similar agents, the model stops being a generic chatbot and starts operating against the user's actual Box content. The concrete jobs it handles:
.webp)
search_files across the user's folder tree, then get_file on the match — no manual click-through Box's UI.Every one of those workflows means the agent is reaching deep into real Box content and acting through the tool-call path — which is exactly why each agent's access and actions must be controlled, the file data it pulls back protected, and every call audited.
The risks fall into four categories that every healthcare, fintech, and legal security team should price into the deployment.
1. File search matches across the user's entire access scope. search_files for "contract", "diligence", or "patient" matches against every file the user can read — including files inherited from prior teams, files in shared workspaces the user has forgotten about, and files shared in error from external collaborators. The agent retrieves the matches and writes them into the model context.
2. File content includes PDFs, DOCX, XLSX, PPTX, and images. get_file returns raw content. Box files routinely contain PII, PHI, PCI, source code, contracts, M&A material, and credentials. Image files (screenshots, scanned documents) carry data invisible to text-only DLP — OCR-inside-images is mandatory.
3. External collaborators expand the agent's effective scope. Box's collaboration model means the authorizing user often has access to content shared into the company by external counterparties — diligence materials from a target, legal documents from outside counsel, vendor SOC 2 reports. All of it reachable via MCP.
4. Write tools create exfiltration paths. upload_file, update_file, create_shared_link let the agent emit data into Box or generate external share links — a confused or compromised agent that read a customer record can post a summary to a publicly-shareable folder in one call.
The traditional DLP a company already runs — at the network edge, on the file share, inside Box Shield's standard policy engine — does not sit in the MCP path. The tool response goes straight from Box into the AI agent's context window. That gap is where Strac Box MCP DLP lives.
The most common Box MCP deployment in 2026 is Claude as the AI client. The setup pattern:
root_readwrite, manage_managed_users, depending on use case).search_files, get_file, list_folders, and related tools on the user's behalf.The Claude Cowork BAA gap matters here. Anthropic does not currently offer a Business Associate Agreement (BAA) for Claude consumer or Claude Cowork plans. For healthcare orgs running Cowork against Box folders containing PHI (clinical research data, EHR exports, patient correspondence), that means HIPAA exposure the moment a tool call crosses into the model context. Strac Box MCP DLP redacts PHI at the tool-call boundary so the model never sees the regulated data in the first place — closing the gap without depending on Anthropic to ship a BAA. See Is Claude HIPAA compliant? for the full vendor breakdown, and MCP security for the broader architecture.
For Claude Code / Cursor / ChatGPT deployments, the same Strac control plane applies — the redaction happens at the MCP layer, not at the model layer, so it's vendor-independent.
Strac is the governance layer for AI-agent access to Box. It wraps the official Box MCP server and intercepts every tool call, so you See what each agent does, Control what it can reach and act on across folders and Box Notes (allow/block, with approval gates on high-risk actions like creating external share links), Protect the file content it pulls back, and Prove it with an audit trail. Every tool call from an AI agent passes through Strac before reaching Box — and every Box response passes through Strac before reaching the model.
Access-only tools answer "who called what." They do not see the regulated files in a shared folder. Strac sits inline on every Box tool call: it detects and remediates the sensitive data inside — redact, mask, block, or revoke access — and approves or blocks risky actions per agent, and keeps the audit trail — the call and its contents.
One inline pass over each MCP response — five actions, enforced by your policy:
Inspect every tool call payload using Strac's catalog of sensitive data elements — PII, PHI, PCI, credentials, source code, and any custom data class you define.
Redact sensitive fields inline, or tombstone entire responses based on policy. PDF diligence documents containing PII are masked. M&A cap-table XLSX files with regulated identifiers are quarantined. Image-based PDFs are OCR-inspected before reaching the model.
Vault redacted content in Strac's encrypted store, with re-identification gated by RBAC for the small subset of users who need the raw value.
Audit every call with full provenance: agent identity, tool name, timestamp, returned-data classification, and remediation action. The same audit feed powers compliance evidence for SOC 2, HIPAA, PCI, ISO 27001, GDPR, and the EU AI Act.
Setup is agentless and under 10 minutes per Box workspace. No application code changes, no agent SDK changes, no Box re-permissioning.
Box joins Strac's MCP DLP coverage across every major SaaS surface AI agents touch in 2026:
Phase 1 — Inventory and BAA
Phase 2 — MCP layer protection
Phase 3 — Governance and audit
Yes. The Box MCP server is set up as a custom connector in Claude Desktop, Claude Code, or Claude for Cowork — the same pattern as other MCP integrations. You register a Box OAuth app, paste the client ID/secret into the Claude connector config, and Claude can call search_files, get_file, list_folders, and related tools. For HIPAA-regulated content, route the connector through Strac Box MCP DLP so PHI is redacted before reaching the model context. See Is Claude HIPAA compliant? for the BAA picture.
Identical component, different vocabulary. The MCP docs say server; Claude's Connectors directory calls it the Box connector. Files, folders, and Box Notes are reachable either way, and Strac's Box MCP connector redacts content across diligence rooms and external-collaborator folders on every call.
They sit on opposite sides of the boundary. Box AI is Box's own in-product intelligence — it runs inside Box, answers questions and generates content against your files using Box's own model plumbing and its native permission model. The Box MCP server is the reverse direction: it lets an external agent like Claude or Cursor reach into Box over the Model Context Protocol and pull file content back out to wherever that client runs. With Box AI the data largely stays in Box's walls; with Box MCP it crosses out to a third-party model context. That hand-off back to the external client is precisely where Strac Box MCP DLP inspects and redacts — at the tool-call boundary, before regulated content leaves for the agent.
Box's collaboration model means the authorizing user often has access to files shared into the company by external counterparties — diligence materials, vendor contracts, legal documents. Strac Box MCP DLP inspects every tool-call response regardless of file origin. If a diligence PDF from an outside counterparty contains regulated data, it gets redacted at the MCP boundary just like internal files.
Yes. Strac inspects Box Notes content, PDF text and previews, and image-based PDFs via OCR. Sensitive data inside scanned contracts, screenshots, and image attachments is detected and redacted at the tool-call boundary.
Box Shield enforces user-facing policy at the Box layer: classification labels, malware detection, anomalous-access alerts, basic content controls. Box Shield does not sit at the MCP path — when an AI agent calls get_file, the response goes straight to the agent without inspection. Strac Box MCP DLP fills that gap: every tool-call response is inspected, classified, and redacted before reaching the model. The two controls layer cleanly together; Strac complements Box Shield rather than replacing it.
Yes. The MCP protocol is vendor-independent. Strac's Box MCP DLP sits between any MCP-aware client (Claude, Cursor, ChatGPT, Perplexity, custom agents) and the Box API, so the same redaction and audit pipeline applies regardless of which AI client a user picks.
This is the highest-value Box use case for MCP DLP. Diligence rooms typically hold cap tables, customer lists with regulated identifiers, financial statements, contracts, employee data, and IP. An AI agent retrieving "summarize the diligence folder" pulls all of it into the model context. Strac redacts the regulated identifiers and writes a clean summary path with full audit evidence per file.
The Box MCP server itself is just a transport layer. Safety for healthcare depends on three things: (1) the corporate Box tenant has a BAA in place; (2) the AI client has its own BAA (ChatGPT Enterprise, M365 Copilot, Gemini Workspace yes; Claude Cowork no); (3) sensitive data is redacted at the MCP tool-call boundary before reaching the model. Strac handles (3). See MCP security for the full risk landscape.
Under 10 minutes per Box workspace. Agentless: no application code changes, no Box re-permissioning, no agent SDK rewrites. Connect the Box OAuth app, deploy Strac's MCP gateway, and live redaction starts on the next tool call.
Yes. Every tool call generates an audit event with full provenance — agent identity, tool name, timestamp, returned-data classification, and remediation action. Audit logs export to SIEM and GRC platforms; pre-built mappings cover SOC 2 CC6, HIPAA Security Rule, PCI Req. 3/4/7/10, GDPR Art. 5/25/30/32, EU AI Act Article 12, and ISO 42001 Annex A.8.
Strac SaaS DLP enforces user-facing policy at the Box-tenant level — classification labels, real-time scanning of new content, automated remediation of risky shares. Strac Box MCP DLP enforces agent-facing policy at the MCP tool-call layer — inspects and redacts what AI agents retrieve from Box. Most enterprises deploy both for full coverage.
Box is one of the highest-leverage enterprise content stores for AI deployments — and one of the highest-risk if MCP is connected without a data-layer control. Strac Box MCP DLP is the agent-aware redaction layer that closes the gap, on top of Box Shield and your existing SaaS DLP.
.avif){kind=icon}
.gif)
