Loading ToolBench
Box (enterprise cloud storage) MCP Pack - provides read-only access to Box cloud storage via OAuth
Box MCP server has well-structured tool definitions with clear naming (verb_noun pattern) and comprehensive descriptions (avg 180 chars, within 10-1024 baseline). All 5 tools have input schemas with type definitions and parameter descriptions. However, output schemas are not documented, LLMs cannot predict response structure for downstream chaining. Error handling returns structured error objects but lacks recovery guidance (e.g., 'connection_required' does not suggest next steps). Parameter descriptions are good but some lack format/constraint details (e.g., folder_id accepts any string; no validation hints). No tool annotations (readOnlyHint, idempotentHint) despite all tools being read-only. Missing pagination guidance for list_folder despite potential for large result sets.
Get full metadata for a single Box (cloud storage) file by its file id. Returns id, name, size, description, created and modified times, parent folder name, shared link URL, and file extension. Use after listing or searching to inspect one document.
Download and return the text content of a Box (cloud storage) file by its file id. Best for plain-text, Markdown, CSV, and other text documents; binary formats (Office docs, PDFs, images) will return unreadable bytes. Content is capped at ~100,000 characters and flagged when truncated.
Get the signed-in Box (cloud storage) user's profile: id, name, login email, total storage space (space_amount in bytes), and used storage (space_used in bytes). Use to identify the connected account or report storage usage.
List the files and subfolders inside a Box (enterprise cloud storage) folder. Pass a folder id, or omit it to list the root folder ("0"). Returns each item's id, type (file or folder), name, size in bytes, and last-modified time. Use to browse a user's Box documents and files.
Search a user's Box (cloud storage) account for files and folders matching a query string across names and content. Optionally restrict to only files or only folders. Returns matching items with id, type, name, size, and last-modified time. Use to find documents by keyword.
Output schemas not documented. LLMs cannot predict response structure (e.g., what fields box_list_folder returns, whether entries are paginated, what box_get_file_text returns when truncated). This breaks tool chaining and forces agents to guess field names.
Error responses lack recovery guidance. 'connection_required' error does not tell the LLM what to do next (e.g., 'Connect your Box account at https://pipeworx.io/account' is in the error message, but no actionable next step for the agent). Non-2xx API errors return raw status codes and body text without categorization (retryable vs. user-fixable).
No tool annotations. All 5 tools are read-only (GET operations), but inputSchema lacks readOnlyHint annotation. This prevents agents from understanding which tools are safe to call speculatively vs. which modify state. Idempotent operations should be marked idempotentHint.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 69 | 2026-07-28+ | v2 |
Pagination not addressed for box_list_folder. API supports limit (max 1000) but no offset/cursor or total_count guidance in description. If a folder has 5000 items, agents cannot discover or iterate beyond the first batch. Description should state 'Returns up to N items; use limit and offset for pagination.'
Parameter constraints not fully specified. folder_id and file_id accept any string; no validation hints (e.g., 'Box folder IDs are numeric strings'). box_get_file_text caps content at ~100k chars but does not specify how truncation is flagged in the response (boolean field? suffix marker?).