The Box MCP server is a Model Context Protocol implementation that exposes Box's API as a standardized set of tools to AI agents. Once connected, an agent like Claude can perform search_files, get_file, list_folders, list_collaborations, and metadata operations on the authenticated user's behalf — turning Box's API surface into AI-actionable capabilities.
The setup pattern is consistent with other MCP integrations: a Box OAuth app registered in the Developer Console, the appropriate scopes (root_readwrite, manage_managed_users, depending on use case), and the server starts serving tool calls.
From the user's perspective, the AI agent suddenly knows their Box. From the security perspective, the AI agent now has read access — and often write access — to every file the user can touch in Box, including content shared from external organizations into the user's collaboration scope.
That's the value. It's also where security teams need a control layer.
The risks fall into four categories that every healthcare, fintech, and legal security team should price into the deployment.
1. File search matches across the user's entire access scope. search_files for "contract", "diligence", or "patient" matches against every file the user can read — including files inherited from prior teams, files in shared workspaces the user has forgotten about, and files shared in error from external collaborators. The agent retrieves the matches and writes them into the model context.
2. File content includes PDFs, DOCX, XLSX, PPTX, and images. get_file returns raw content. Box files routinely contain PII, PHI, PCI, source code, contracts, M&A material, and credentials. Image files (screenshots, scanned documents) carry data invisible to text-only DLP — OCR-inside-images is mandatory.
3. External collaborators expand the agent's effective scope. Box's collaboration model means the authorizing user often has access to content shared into the company by external counterparties — diligence materials from a target, legal documents from outside counsel, vendor SOC 2 reports. All of it reachable via MCP.
4. Write tools create exfiltration paths. upload_file, update_file, create_shared_link let the agent emit data into Box or generate external share links — a confused or compromised agent that read a customer record can post a summary to a publicly-shareable folder in one call.
The traditional DLP a company already runs — at the network edge, on the file share, inside Box Shield's standard policy engine — does not sit in the MCP path. The tool response goes straight from Box into the AI agent's context window. That gap is where Strac Box MCP DLP lives.
The most common Box MCP deployment in 2026 is Claude as the AI client. The setup pattern:
.webp)
root_readwrite, manage_managed_users, depending on use case).search_files, get_file, list_folders, and related tools on the user's behalf.The Claude Cowork BAA gap matters here. Anthropic does not currently offer a Business Associate Agreement (BAA) for Claude consumer or Claude Cowork plans. For healthcare orgs running Cowork against Box folders containing PHI (clinical research data, EHR exports, patient correspondence), that means HIPAA exposure the moment a tool call crosses into the model context. Strac Box MCP DLP redacts PHI at the tool-call boundary so the model never sees the regulated data in the first place — closing the gap without depending on Anthropic to ship a BAA. See Is Claude HIPAA compliant? for the full vendor breakdown, and MCP security for the broader architecture.
For Claude Code / Cursor / ChatGPT deployments, the same Strac control plane applies — the redaction happens at the MCP layer, not at the model layer, so it's vendor-independent.
Strac wraps the official Box MCP server with a redaction engine. Every tool call from an AI agent passes through Strac before reaching Box — and every Box response passes through Strac before reaching the model.
Inspect every tool call payload using Strac's catalog of sensitive data elements — PII, PHI, PCI, credentials, source code, and any custom data class you define.
Redact sensitive fields inline, or tombstone entire responses based on policy. PDF diligence documents containing PII are masked. M&A cap-table XLSX files with regulated identifiers are quarantined. Image-based PDFs are OCR-inspected before reaching the model.
Vault redacted content in Strac's encrypted store, with re-identification gated by RBAC for the small subset of users who need the raw value.
Audit every call with full provenance: agent identity, tool name, timestamp, returned-data classification, and remediation action. The same audit feed powers compliance evidence for SOC 2, HIPAA, PCI, ISO 27001, GDPR, and the EU AI Act.
Setup is agentless and under 10 minutes per Box workspace. No application code changes, no agent SDK changes, no Box re-permissioning.
Box joins Strac's MCP DLP coverage across every major SaaS surface AI agents touch in 2026:
Phase 1 — Inventory and BAA
Phase 2 — MCP layer protection
Phase 3 — Governance and audit
Yes. The Box MCP server is set up as a custom connector in Claude Desktop, Claude Code, or Claude for Cowork — the same pattern as other MCP integrations. You register a Box OAuth app, paste the client ID/secret into the Claude connector config, and Claude can call search_files, get_file, list_folders, and related tools. For HIPAA-regulated content, route the connector through Strac Box MCP DLP so PHI is redacted before reaching the model context. See Is Claude HIPAA compliant? for the BAA picture.
Box's collaboration model means the authorizing user often has access to files shared into the company by external counterparties — diligence materials, vendor contracts, legal documents. Strac Box MCP DLP inspects every tool-call response regardless of file origin. If a diligence PDF from an outside counterparty contains regulated data, it gets redacted at the MCP boundary just like internal files.
Yes. Strac inspects Box Notes content, PDF text and previews, and image-based PDFs via OCR. Sensitive data inside scanned contracts, screenshots, and image attachments is detected and redacted at the tool-call boundary.
Box Shield enforces user-facing policy at the Box layer: classification labels, malware detection, anomalous-access alerts, basic content controls. Box Shield does not sit at the MCP path — when an AI agent calls get_file, the response goes straight to the agent without inspection. Strac Box MCP DLP fills that gap: every tool-call response is inspected, classified, and redacted before reaching the model. The two controls layer cleanly together; Strac complements Box Shield rather than replacing it.
Yes. The MCP protocol is vendor-independent. Strac's Box MCP DLP sits between any MCP-aware client (Claude, Cursor, ChatGPT, Perplexity, custom agents) and the Box API, so the same redaction and audit pipeline applies regardless of which AI client a user picks.
This is the highest-value Box use case for MCP DLP. Diligence rooms typically hold cap tables, customer lists with regulated identifiers, financial statements, contracts, employee data, and IP. An AI agent retrieving "summarize the diligence folder" pulls all of it into the model context. Strac redacts the regulated identifiers and writes a clean summary path with full audit evidence per file.
The Box MCP server itself is just a transport layer. Safety for healthcare depends on three things: (1) the corporate Box tenant has a BAA in place; (2) the AI client has its own BAA (ChatGPT Enterprise, M365 Copilot, Gemini Workspace yes; Claude Cowork no); (3) sensitive data is redacted at the MCP tool-call boundary before reaching the model. Strac handles (3). See MCP security for the full risk landscape.
Under 10 minutes per Box workspace. Agentless: no application code changes, no Box re-permissioning, no agent SDK rewrites. Connect the Box OAuth app, deploy Strac's MCP gateway, and live redaction starts on the next tool call.
Yes. Every tool call generates an audit event with full provenance — agent identity, tool name, timestamp, returned-data classification, and remediation action. Audit logs export to SIEM and GRC platforms; pre-built mappings cover SOC 2 CC6, HIPAA Security Rule, PCI Req. 3/4/7/10, GDPR Art. 5/25/30/32, EU AI Act Article 12, and ISO 42001 Annex A.8.
Strac SaaS DLP enforces user-facing policy at the Box-tenant level — classification labels, real-time scanning of new content, automated remediation of risky shares. Strac Box MCP DLP enforces agent-facing policy at the MCP tool-call layer — inspects and redacts what AI agents retrieve from Box. Most enterprises deploy both for full coverage.
Box is one of the highest-leverage enterprise content stores for AI deployments — and one of the highest-risk if MCP is connected without a data-layer control. Strac Box MCP DLP is the agent-aware redaction layer that closes the gap, on top of Box Shield and your existing SaaS DLP.
.avif){kind=icon}
.gif)
