{
 "slug": "box",
 "name": "Box",
 "url": "https://box.com",
 "domain": "box.com",
 "category": "file-storage",
 "category_name": "File storage",
 "tested_at": "2026-10-12",
 "run": "20261012T090018Z",
 "draft": false,
 "reviewed": true,
 "owner_verified": null,
 "origin": "editorial",
 "history": [
  {
   "run": "20261006T000025Z",
   "date": "2026-10-06",
   "level": 1,
   "engine": {
    "runner": "omp",
    "model": "claude-opus-5-5",
    "driver": 2,
    "signed": true,
    "inbox": null,
    "robots": "start"
   }
  },
  {
   "run": "20261012T090018Z",
   "date": "2026-10-12",
   "level": 1,
   "engine": {
    "runner": "omp",
    "model": "claude-opus-5-5",
    "driver": 3,
    "signed": true,
    "inbox": [
     "agentdrives.com"
    ],
    "robots": "obey"
   }
  }
 ],
 "level": 1,
 "level_name": "Needs a person",
 "level_selfhost": null,
 "entry": "closed",
 "door": {
  "passed": 0,
  "tries": 2,
  "self_start": false
 },
 "badges": [],
 "stages": [
  {
   "key": "in",
   "label": "Access",
   "state": "no",
   "text": "Can't get in on its own",
   "at": "signup"
  },
  {
   "key": "work",
   "label": "Use",
   "state": "unreached",
   "text": "Work not measured"
  },
  {
   "key": "pay",
   "label": "Pay",
   "state": "unreached",
   "text": "Payment not reached",
   "value": "unreached",
   "route": "card_checkout"
  },
  {
   "key": "leave",
   "label": "Leave",
   "state": "unreached",
   "text": "Leaving not reached",
   "how": "no-account"
  }
 ],
 "outcomes": [
  {
   "key": "find",
   "label": "Find",
   "state": "yes",
   "text": "Docs agents can read: llms.txt, an OpenAPI and an MCP server",
   "have": [
    "llms_txt",
    "openapi",
    "mcp"
   ]
  },
  {
   "key": "access",
   "label": "Access",
   "state": "no",
   "text": "Can't get in on its own",
   "at": "signup",
   "stage": "in"
  },
  {
   "key": "use",
   "label": "Use",
   "state": "unreached",
   "text": "Work not measured",
   "stage": "work"
  },
  {
   "key": "pay",
   "label": "Pay",
   "state": "unreached",
   "text": "Payment not reached",
   "value": "unreached",
   "route": "card_checkout",
   "stage": "pay"
  },
  {
   "key": "leave",
   "label": "Leave",
   "state": "unreached",
   "text": "Leaving not reached",
   "how": "no-account",
   "stage": "leave"
  }
 ],
 "access": [
  {
   "key": "person",
   "label": "A person sets it up",
   "routes": [],
   "minutes": null,
   "core": null
  }
 ],
 "minutes": null,
 "next": {
  "to": 2,
  "text": "Next: let an agent sign up on its own"
 },
 "stop": "signup",
 "core": null,
 "scores": {
  "coverage": null,
  "reliability": null,
  "resilience": null,
  "setup": 100,
  "surface_coverage": null,
  "docs_accuracy": null,
  "docs_completeness": null
 },
 "parts": {
  "holds_up": null,
  "docs_match": null,
  "setup": 100,
  "security": null,
  "standards": [
   {
    "standard": "OpenAPI",
    "state": "behind",
    "behind": 2,
    "value": "3.0.2"
   }
  ]
 },
 "reliability_method": null,
 "resilience": null,
 "stress": [],
 "surface_audit": null,
 "coverage_core": null,
 "after_wall": null,
 "coverage_source": "reported",
 "driver": {
  "version": 3,
  "model": "claude-opus-5-5",
  "profile": "full",
  "assisted": false,
  "handoff": false,
  "prompt_sha": "076cd4c65a1a",
  "kb_version": "3+overlay-1353601952",
  "identity": "e8a92f24a9a8"
 },
 "methodology": 15,
 "rules_date": "2026-10-15",
 "engine": {
  "runner": "omp",
  "model": "claude-opus-5-5",
  "driver": 3,
  "signed": true,
  "inbox": [
   "agentdrives.com"
  ],
  "robots": "obey"
 },
 "same_level_drives": 2,
 "drives": 2,
 "works_assisted": null,
 "freshness": "fresh",
 "nothing_to_pay": false,
 "core_gated": false,
 "profiles": {},
 "agent_check": {
  "rung": "signup",
  "vendor": "hCaptcha",
  "visible": true,
  "type": "challenge",
  "human": null,
  "how": "Check the Web Bot Auth signature on the sign-up request (the agent's key directory is public) and skip hCaptcha for signed agents; or offer a documented sign-up API with email verification.",
  "signed": true
 },
 "agent_pass": null,
 "who_gets_in": {
  "server": {
   "state": "captcha"
  },
  "signed": {
   "state": "page",
   "kind": "signup",
   "at": "2026-10-12"
  },
  "browser": {
   "state": "captcha",
   "measured": false
  },
  "our_key": "pending",
  "robots": null,
  "tip": false
 },
 "ladder": {
  "docs": {
   "status": "headless",
   "note": "developer.box.com: llms.txt (368 guide + 413 reference pages), every page as Markdown via .md URL or Accept: text/markdown (vary: Accept). OpenAPI 3.0.2 in github.com/box/box-openapi (297 operations). www.box.com marketing pages (pricing, llms.txt) answer a Cloudflare challenge."
  },
  "signup": {
   "status": "human",
   "note": "Both documented sign-ups (account.box.com/signup/personal and /signup/developer) show an hCaptcha 'I am human' checkbox on submit. No API or CLI sign-up."
  },
  "verify": {
   "status": "",
   "note": "Not reached: sign-up stopped at the hCaptcha.",
   "reached": false
  },
  "credentials": {
   "status": "",
   "note": "Not reached. Docs: developer tokens and the free plan's auto-created CCG app credentials are read in the Developer Console web UI; the OAuth server has no registration endpoint, CIMD or device flow.",
   "reached": false
  },
  "first_call": {
   "status": "",
   "note": "Not reached. Unauthenticated GET api.box.com/2.0/users/me answers 401 with WWW-Authenticate Bearer error=invalid_request.",
   "reached": false
  },
  "first_action": {
   "status": "",
   "note": "Not reached: no account.",
   "reached": false
  },
  "pay": {
   "status": "",
   "grade": "P2",
   "rails": [
    "card checkout in the Box web app"
   ],
   "rail_ids": [
    "card"
   ],
   "first_party": true,
   "rail_scope": "none",
   "trial_path": "free tier",
   "note": "No agent rail: no 402 on box.com, api.box.com or x402./mpp./agents. subdomains, no MPP, Stripe Projects or Bazaar listing, no /.well-known/ucp, no billing API. Docs: upgrade is Upgrade Plan in the web app, then checkout with payment information; checkout not seen (behind sign-in) and www.box.com/pricing stayed on a Cloudflare interstitial. We paid nothing.",
   "reached": false
  },
  "cancel": {
   "status": "",
   "note": "Not reached: no plan or trial was started because sign-up never completed (hCaptcha wall). The API reference has no billing or subscription endpoint; plans are managed in the web app. Not tested, not a pass.",
   "docs_grade": "",
   "reached": false
  },
  "delete": {
   "status": "",
   "note": "Not reached: no account was created (sign-up stopped at the hCaptcha), so there was nothing to delete and no rejected-access call to show. Not tested.",
   "account": false,
   "reached": false
  }
 },
 "routes": [],
 "checkout": null,
 "docs": null,
 "claims": null,
 "pay_options": {
  "checked": "2026-10-12",
  "source": "probe",
  "options": [],
  "agentic": [],
  "paid": null,
  "exercised": null,
  "detected_grade": null,
  "trial": {
   "no_card": null,
   "card_required": null,
   "free_plan": null
  },
  "owner_fixes": [
   {
    "title": "Accept x402 or MPP on your API",
    "how": "Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card."
   },
   {
    "title": "List your plans on Stripe Projects",
    "how": "Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev)."
   }
  ]
 },
 "surfaces": {
  "api": true,
  "openapi": true,
  "cli": true,
  "sdk": true,
  "mcp": "official",
  "llms_txt": true,
  "webhooks": true,
  "sandbox": true
 },
 "surface_notes": {
  "api": "REST, 297 operations in the main spec",
  "openapi": "3.0.2, info.version 2024.0; a separate 2026.0 file with 5 paths",
  "mcp": "official remote server at mcp.box.com, OAuth with admin-issued client credentials",
  "cli": "@box/cli 4.10.1 on npm"
 },
 "can_do": [
  "Read every Box developer guide and API reference page as Markdown",
  "Find the MCP server's OAuth metadata without an account"
 ],
 "cannot_do": [
  {
   "what": "Create a Box account",
   "why": "hCaptcha checkbox on both sign-up forms"
  },
  {
   "what": "Get an API credential or call the API",
   "why": "needs an account and the Developer Console web UI"
  },
  {
   "what": "Read pricing on www.box.com",
   "why": "Cloudflare interstitial that did not clear for our signed agent"
  }
 ],
 "blockers": [
  "hCaptcha on account.box.com sign-up (personal and developer)"
 ],
 "tips_for_owner": [
  "Let verified agents pass sign-up",
  "Mint first credentials over an API",
  "Support CIMD or device flow on OAuth",
  "Let signed agents read www.box.com",
  "Offer an agent payment rail"
 ],
 "tips_for_agents": [
  "Docs are agent-friendly: append .md to any developer.box.com page or send Accept: text/markdown; start from developer.box.com/llms.txt.",
  "The free developer plan (account.box.com/signup/developer) auto-creates an authorized CCG app, the best headless route once a human gets past the hCaptcha.",
  "The MCP server at mcp.box.com/mcp needs admin-issued Integration Credentials; there is no dynamic client registration.",
  "Uploads go to upload.box.com/api/2.0/files/content, not api.box.com."
 ],
 "selfhost": null,
 "summary": "An agent cannot get into Box on its own: both documented sign-ups (personal and free developer) put an hCaptcha checkbox in front of account creation. Everything before the door is strong: Markdown docs with llms.txt, a public OpenAPI (3.0.2), a CLI and an official OAuth MCP server, but first credentials come from the Developer Console UI and paid plans only through a web checkout.",
 "wall": "hCaptcha on the sign-up form",
 "plan_scope": "",
 "robots_stop": null,
 "robots": null,
 "plain": {
  "summary": "Box is a cloud file-storage and e-signature product with AI add-ons. An agent trying to sign up on its own hit a human-verification checkbox on both the personal and developer sign-up forms, so the agent never got an account or any API access. Everything before account creation, the documentation site, worked well for an agent.",
  "can_do": [
   "Read all of Box's developer documentation and API reference as plain text, without needing an account",
   "Find basic connection information for Box's AI-agent server without logging in"
  ],
  "cannot_do": [
   {
    "what": "Create a Box account",
    "why": "a human-verification checkbox blocks both sign-up forms"
   },
   {
    "what": "Get an API key or make any API call",
    "why": "needs an account and a web dashboard, which was never reached"
   },
   {
    "what": "See the pricing page",
    "why": "a security check kept showing an interstitial page instead of content"
   }
  ]
 },
 "plan_gated": [],
 "reply": null,
 "capabilities": [
  {
   "id": "cap-01",
   "group": "Content storage",
   "capability": "Upload a file",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /files/content (and chunked upload session)",
    "mcp": "upload_file",
    "cli": "box files:upload",
    "ui": "Upload button / drag-and-drop in any folder"
   },
   "check": "GET /files/{id} returns the new file with matching name and size",
   "source": "https://developer.box.com/guides/uploads/; https://developer.box.com/guides/box-mcp/tools"
  },
  {
   "id": "cap-02",
   "group": "Content storage",
   "capability": "Download a file",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "GET /files/{id}/content",
    "mcp": "get_download_url / get_file_content",
    "cli": "box files:download",
    "ui": "Download action on a file"
   },
   "check": "Downloaded byte stream matches the file's stored content/sha1",
   "source": "https://developer.box.com/guides/downloads/"
  },
  {
   "id": "cap-03",
   "group": "Content storage",
   "capability": "Organize files into folders",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /folders, PUT /files/{id} (move), PUT /folders/{id} (move)",
    "mcp": "create_folder, move_file, move_folder, copy_file, copy_folder",
    "cli": "box folders:create",
    "ui": "New Folder / drag files between folders"
   },
   "check": "GET /files/{id} or GET /folders/{id} shows the new parent folder id",
   "source": "https://developer.box.com/reference/#content-management"
  },
  {
   "id": "cap-04",
   "group": "Content storage",
   "capability": "Delete and restore content (trash)",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "DELETE /files/{id}, POST /files/{id} (restore from trash)",
    "mcp": null,
    "cli": "box files:delete",
    "ui": "Delete / Trash in the web app"
   },
   "check": "GET /folders/trash/items lists the item; restoring makes it reappear in its original folder",
   "source": "https://developer.box.com/reference/#content-management"
  },
  {
   "id": "cap-05",
   "group": "Content storage",
   "capability": "Keep and browse file version history",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "GET /files/{id}/versions",
    "mcp": "upload_file_version",
    "cli": "box files:versions",
    "ui": "Version history panel on a file"
   },
   "check": "GET /files/{id}/versions lists prior versions with distinct sha1 after re-upload",
   "source": "https://developer.box.com/reference/files-resources#file-versions"
  },
  {
   "id": "cap-06",
   "group": "Collaboration",
   "capability": "Collaborate easily and securely on content with teammates and outsiders",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /collaborations",
    "mcp": "create_collaboration, list_item_collaborations, update_collaboration",
    "cli": "box collaborations:create",
    "ui": "Invite People / Collaborators dialog"
   },
   "check": "GET /files/{id}/collaborations or GET /folders/{id}/collaborations lists the invited user with the granted role",
   "source": "https://www.box.com/home; https://developer.box.com/guides/collaborations/index"
  },
  {
   "id": "cap-07",
   "group": "Collaboration",
   "capability": "Get AI insights from content (summarize, ask questions, generate text)",
   "weight": "core",
   "plan": "paid",
   "surfaces": {
    "api": "POST /ai/ask, POST /ai/text_gen",
    "mcp": "ai_qa_single_file, ai_qa_multi_file, ai_qa_hub",
    "cli": null,
    "ui": "Box AI panel on a file preview / Box Hub"
   },
   "check": "POST /ai/ask response includes an answer grounded in the referenced file's content",
   "source": "https://www.box.com/home; https://developer.box.com/ai/box-ai-api"
  },
  {
   "id": "cap-08",
   "group": "Content intelligence",
   "capability": "Extract critical structured data from documents with AI",
   "weight": "core",
   "plan": "paid",
   "surfaces": {
    "api": "POST /ai/extract, POST /ai/extract_structured",
    "mcp": "ai_extract_freeform, ai_extract_structured, ai_extract_structured_from_fields, ai_extract_structured_from_metadata_template",
    "cli": null,
    "ui": "Box Extract agent configuration in admin/app"
   },
   "check": "POST /ai/extract_structured response returns key-value fields matching the document's content (e.g. invoice total)",
   "source": "https://www.box.com/extract; https://developer.box.com/ai/box-ai-api"
  },
  {
   "id": "cap-09",
   "group": "Workflow automation",
   "capability": "Automate multi-step content workflows with AI agents (Box Automate)",
   "weight": "core",
   "plan": "paid",
   "surfaces": {
    "api": "GET /automate_workflows, POST /automate_workflows/{id}/start",
    "mcp": null,
    "cli": null,
    "ui": "Box Automate drag-and-drop workflow builder"
   },
   "check": "GET /automate_workflows/{id}/runs (or run status) shows the triggered run progressed through its outcomes",
   "source": "https://www.box.com/automate; https://developer.box.com/guides/intelligent-workflow"
  },
  {
   "id": "cap-10",
   "group": "e-Signature",
   "capability": "Send a document for e-signature and track it to completion",
   "weight": "core",
   "plan": "free",
   "surfaces": {
    "api": "POST /sign_requests",
    "mcp": null,
    "cli": null,
    "ui": "Box Sign request creation page"
   },
   "check": "GET /sign_requests/{id} shows status transition to signed, and the signed PDF plus signing log appear in the destination folder",
   "source": "https://www.box.com/esignature; https://developer.box.com/guides/box-sign"
  },
  {
   "id": "cap-11",
   "group": "Security",
   "capability": "Protect content with security controls, classification, and threat detection",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /metadata (classification), security/shield admin console",
    "mcp": null,
    "cli": null,
    "ui": "Box Shield / Security Center in admin console"
   },
   "check": "Admin console Security Center shows an alert or applied classification label on the flagged file",
   "source": "https://www.box.com/shield"
  },
  {
   "id": "cap-12",
   "group": "Developer platform",
   "capability": "Build custom apps against Box content with AI-native APIs",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "https://api.box.com/2.0 (full REST surface)",
    "mcp": null,
    "cli": "Box CLI (box)",
    "ui": "Developer Console (app creation, scopes, credentials)"
   },
   "check": "A custom OAuth app successfully calls GET /users/me and receives the authenticated service account profile",
   "source": "https://www.box.com/platform; https://developer.box.com/reference"
  },
  {
   "id": "cap-13",
   "group": "Secondary",
   "capability": "Search content and metadata across the account",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "GET /search",
    "mcp": "search_files_keyword, search_files_metadata, search_folders_by_name",
    "cli": "box search",
    "ui": "Search bar in the web app"
   },
   "check": "GET /search?query=... returns entries including the target file in the results array",
   "source": "https://developer.box.com/guides/search/index"
  },
  {
   "id": "cap-14",
   "group": "Secondary",
   "capability": "Create a shared link to a file or folder",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "PUT /files/{id} (shared_link), PUT /folders/{id}",
    "mcp": "add_file_shared_link, add_folder_shared_link",
    "cli": "box files:share",
    "ui": "Share button on a file/folder"
   },
   "check": "GET /files/{id} shows a shared_link.url field resolving to the item without login (when access=open)",
   "source": "https://developer.box.com/guides/shared-links"
  },
  {
   "id": "cap-15",
   "group": "Secondary",
   "capability": "Tag files/folders with custom structured metadata",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "POST /files/{id}/metadata/{scope}/{template}, POST /metadata_templates",
    "mcp": "set_file_metadata, set_folder_metadata, create_metadata_template",
    "cli": "box metadata:templates:create",
    "ui": "Metadata panel in file details sidebar"
   },
   "check": "GET /files/{id}/metadata/{scope}/{template} returns the field values just set",
   "source": "https://developer.box.com/guides/metadata/index"
  },
  {
   "id": "cap-16",
   "group": "Secondary",
   "capability": "Comment on and assign tasks against a file",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "POST /comments, POST /tasks, POST /task_assignments",
    "mcp": "create_file_comment, list_file_comments, list_tasks",
    "cli": "box comments:create",
    "ui": "Comments/Tasks panel in file preview"
   },
   "check": "GET /files/{id}/comments or GET /tasks lists the new comment/task with the assigned user and status",
   "source": "https://developer.box.com/reference/comments-resources#comment"
  },
  {
   "id": "cap-17",
   "group": "Secondary",
   "capability": "Create a public upload form (File Request) to collect content from others",
   "weight": "secondary",
   "plan": "free",
   "surfaces": {
    "api": "POST /file_requests",
    "mcp": null,
    "cli": null,
    "ui": "File Request creation in a folder"
   },
   "check": "Visiting the generated File Request URL and submitting a file results in it appearing in the target folder",
   "source": "https://developer.box.com/reference/files-resources#file-request"
  },
  {
   "id": "cap-18",
   "group": "Secondary",
   "capability": "React to content events with webhooks",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /webhooks",
    "mcp": null,
    "cli": "box webhooks:create",
    "ui": "Webhooks setup in developer console"
   },
   "check": "Performing the watched event (e.g. upload) triggers an HTTP POST to the configured webhook endpoint with a matching event payload",
   "source": "https://developer.box.com/guides/webhooks/index"
  },
  {
   "id": "cap-19",
   "group": "Secondary",
   "capability": "Curate content into a Box Hub and ask AI questions grounded in it",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /hubs, POST /hub_items",
    "mcp": "create_hub, add_items_to_hub, ai_qa_hub, list_hubs, get_hub_items",
    "cli": null,
    "ui": "Box Hubs section of the web app"
   },
   "check": "GET /hubs/{id}/items lists the added files, and ai_qa_hub answers cite content from them",
   "source": "https://www.box.com/hubs; https://developer.box.com/guides/box-mcp/tools"
  },
  {
   "id": "cap-20",
   "group": "Secondary",
   "capability": "Generate business documents from templates and data (Box Doc Gen)",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /docgen_batches",
    "mcp": "create_docgen_batch, create_docgen_template, list_docgen_templates",
    "cli": null,
    "ui": "Doc Gen template creator add-in for Microsoft Word"
   },
   "check": "GET /docgen_batch_jobs/{id} completes and the output docx/pdf appears in the destination folder with template fields filled",
   "source": "https://developer.box.com/guides/intelligent-workflow"
  },
  {
   "id": "cap-21",
   "group": "Secondary",
   "capability": "Lock a folder to prevent further changes",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /folder_locks",
    "mcp": null,
    "cli": null,
    "ui": "Folder lock option in folder settings"
   },
   "check": "GET /folder_locks?folder_id={id} shows an active lock, and further writes to the folder are rejected",
   "source": "https://developer.box.com/reference/folders-resources#folder-lock"
  },
  {
   "id": "cap-22",
   "group": "Secondary",
   "capability": "Pin files/folders for offline device access",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "GET /device_pinners",
    "mcp": null,
    "cli": null,
    "ui": "Box Drive/mobile app offline toggle"
   },
   "check": "GET /device_pinners lists the pinned device entry for the user",
   "source": "https://developer.box.com/reference/device-pinners-resources#device-pinner"
  },
  {
   "id": "cap-23",
   "group": "Secondary",
   "capability": "Apply retention policies and legal holds to content",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "POST /retention_policies, POST /legal_hold_policies",
    "mcp": null,
    "cli": null,
    "ui": "Governance section of admin console"
   },
   "check": "GET /retention_policy_assignments shows the policy applied to the folder, and the content becomes undeletable until disposition",
   "source": "https://www.box.com/security-compliance"
  },
  {
   "id": "cap-25",
   "group": "Secondary",
   "capability": "Create and use custom AI agents (Box AI Studio)",
   "weight": "secondary",
   "plan": "paid",
   "surfaces": {
    "api": "Box AI Studio agent config endpoints",
    "mcp": null,
    "cli": null,
    "ui": "Box AI Studio builder"
   },
   "check": "The custom agent appears in the agent list and produces responses grounded in its configured knowledge sources with citations",
   "source": "https://developer.box.com/guides/intelligent-workflow"
  },
  {
   "id": "cap-26",
   "group": "Peripheral",
   "capability": "Manage users and groups in the enterprise",
   "weight": "peripheral",
   "plan": "paid",
   "surfaces": {
    "api": "POST /users, POST /groups, POST /group_memberships",
    "mcp": null,
    "cli": "box users:create",
    "ui": "Admin Console > Users & Groups"
   },
   "check": "GET /users/{id} shows the newly created user; GET /groups/{id}/memberships lists the added member",
   "source": "https://developer.box.com/reference/users-resources#user"
  },
  {
   "id": "cap-27",
   "group": "Peripheral",
   "capability": "Restrict collaboration to approved domains",
   "weight": "peripheral",
   "plan": "paid",
   "surfaces": {
    "api": "POST /collaboration_whitelist_entries",
    "mcp": null,
    "cli": null,
    "ui": "Admin Console > Enterprise Settings > Collaboration"
   },
   "check": "GET /collaboration_whitelist_entries lists the approved domain, and inviting an outside-domain collaborator is blocked",
   "source": "https://developer.box.com/reference/user-collaborations-resources#collaboration-allowlist-entry"
  },
  {
   "id": "cap-28",
   "group": "Peripheral",
   "capability": "Terminate active user/group sessions remotely",
   "weight": "peripheral",
   "plan": "paid",
   "surfaces": {
    "api": "POST /session_termination_messages",
    "mcp": null,
    "cli": null,
    "ui": "Admin Console user session management"
   },
   "check": "The targeted user's active Box session is invalidated and they must re-authenticate",
   "source": "https://developer.box.com/reference/session-termination-resources#session-termination-message"
  },
  {
   "id": "cap-29",
   "group": "Peripheral",
   "capability": "Browse and install third-party app integrations (1,500+ marketplace apps)",
   "weight": "peripheral",
   "plan": "free",
   "surfaces": {
    "api": null,
    "mcp": null,
    "cli": null,
    "ui": "Box App Center / integrations marketplace"
   },
   "check": "Installed integration appears under the user's connected apps and can be authorized",
   "source": "https://www.box.com/integrations"
  }
 ],
 "attempts": [
  {
   "t": "00:48",
   "cap": "discovery",
   "capability": "MCP discovery",
   "task": "POST server/discover to https://mcp.box.com/mcp",
   "route": "mcp",
   "documented": true,
   "result": "blocked",
   "verified": true,
   "evidence": "HTTP 401 empty body, WWW-Authenticate: Bearer resource_metadata=https://mcp.box.com/.well-known/oauth-protected-resource; PRM 200 JSON, authorization_servers [https://api.box.com/]; server-card URL also 401",
   "notes": "auth-required before discover; AS metadata at api.box.com: authorization_code+refresh_token, PKCE S256, no registration_endpoint, no client_id_metadata_document_supported, no device flow -> pre-registered client only",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "00:49",
   "cap": "discovery",
   "capability": "Docs, llms.txt, markdown",
   "task": "Fetch developer.box.com llms.txt, Accept: text/markdown and .md URL",
   "route": "api",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "developer.box.com/llms.txt 200 (Box Dev Docs, 368+413 pages); /guides/uploads with Accept: text/markdown -> content-type text/markdown, vary includes Accept; /guides/uploads.md 200 text/markdown. robots.txt developer.box.com: Content-Signal: ai-train=yes, search=yes, ai-input=yes (Cloudflare Content Signals, parses). www.box.com/llms.txt and /pricing: 403 cf-mitigated: challenge (Cloudflare managed challenge on our signed agent). /.well-known/ai-catalog.json and agent-card.json 404",
   "notes": "",
   "quality": {}
  },
  {
   "t": "02:46",
   "cap": "signup",
   "capability": "Sign up (Box Individual free)",
   "task": "Create free account at account.box.com/signup/personal",
   "route": "browser",
   "documented": true,
   "result": "blocked",
   "verified": true,
   "evidence": "Form filled (name, email the agent's inbox, password, TOS). On submit an hCaptcha checkbox widget appeared (I am human) with Field Required. Screenshot browser/shots/004.png. No API or CLI sign-up documented; OAuth AS has no registration",
   "notes": "visible hCaptcha on sign-up; asking a human via live handoff",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "02:56",
   "cap": "signup",
   "capability": "Sign up (human handoff)",
   "task": "Ask a human to solve the hCaptcha on the sign-up form",
   "route": "browser",
   "documented": true,
   "result": "blocked",
   "verified": true,
   "evidence": "",
   "notes": "HCaptcha checkbox on sign-up",
   "quality": {}
  },
  {
   "t": "04:00",
   "cap": "signup",
   "capability": "Sign up (free developer plan)",
   "task": "Create free developer account at account.box.com/signup/developer (docs: developer.box.com/guides/getting-started/free-developer-plan)",
   "route": "browser",
   "documented": true,
   "result": "blocked",
   "verified": true,
   "evidence": "Form filled; on Get Started the same hCaptcha I am human checkbox appeared with Field Required. (browser/shots/006.png)",
   "notes": "same hCaptcha wall",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "05:34",
   "cap": "pay",
   "capability": "Pay step public probes",
   "task": "Look for agent payment rails, billing API, checkout",
   "route": "none",
   "documented": true,
   "result": "done",
   "verified": true,
   "evidence": "pay_probe.json: no 402 challenges (box.com, api.box.com 401, x402./mpp./agents. 302), no MPP/Stripe Projects/Bazaar listing, /.well-known/ucp 404, MCP needs OAuth (tools not listed), pricing page 403. pay_tx.json: refused, no 402 asking for USDC. This run: www.box.com/pricing shows a Cloudflare interstitial in the browser that did not clear after 15 s (browser/shots/008.png); docs search for x402/402/machine payments/Stripe Projects in developer.box.com home index: 0 hits; no billing/subscription endpoint in the API reference index. free-developer-plan.md: upgrade = Upgrade Plan in web app, Complete checkout and enter payment information",
   "notes": "free tier exists (Box Individual 10 GB, free developer plan); paid plans only through the web app checkout with a card",
   "quality": {}
  },
  {
   "t": "05:34",
   "cap": "cancel",
   "capability": "Cancel plan",
   "task": "Cancel a paid plan",
   "route": "none",
   "documented": true,
   "result": "skipped",
   "verified": false,
   "evidence": "no plan or trial started; no billing/subscription API in the API reference index",
   "notes": "not tested: no plan or trial was started",
   "quality": {}
  },
  {
   "t": "05:34",
   "cap": "verify",
   "capability": "verify",
   "task": "verify after sign-up",
   "route": "none",
   "documented": true,
   "result": "blocked",
   "verified": false,
   "evidence": "not reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session",
   "notes": "blocked behind the sign-up hCaptcha",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "05:34",
   "cap": "credentials",
   "capability": "credentials",
   "task": "credentials after sign-up",
   "route": "none",
   "documented": true,
   "result": "blocked",
   "verified": false,
   "evidence": "not reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session",
   "notes": "blocked behind the sign-up hCaptcha",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "05:35",
   "cap": "first_call",
   "capability": "The first call",
   "task": "The first call after sign-up",
   "route": "none",
   "documented": true,
   "result": "blocked",
   "verified": false,
   "evidence": "not reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session",
   "notes": "blocked behind the sign-up hCaptcha",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "05:35",
   "cap": "first_action",
   "capability": "The first action",
   "task": "The first action after sign-up",
   "route": "none",
   "documented": true,
   "result": "blocked",
   "verified": false,
   "evidence": "not reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session",
   "notes": "blocked behind the sign-up hCaptcha",
   "quality": {
    "error_legibility": "clear"
   }
  },
  {
   "t": "05:35",
   "cap": "credentials",
   "key": "create",
   "capability": "Create a scoped key headless",
   "task": "Create API credentials via API/CLI",
   "route": "none",
   "documented": true,
   "result": "blocked",
   "verified": false,
   "evidence": "Docs (getting-started/index.md): Developer Token is generated in the Developer Console web UI; free developer plan auto-creates a CCG app whose client id/secret are read in the console; OAuth AS metadata has no registration_endpoint/CIMD/device flow. No account, so not reached",
   "notes": "no documented API route to mint a first credential; needs console after sign-up",
   "quality": {}
  },
  {
   "t": "05:36",
   "cap": "delete",
   "capability": "Delete account",
   "task": "Delete the account",
   "route": "none",
   "documented": true,
   "result": "skipped",
   "verified": false,
   "evidence": "no account was created (sign-up stopped at hCaptcha)",
   "notes": "nothing to delete",
   "quality": {}
  }
 ],
 "stale": false,
 "icon": "/logos/box.png",
 "monitored": false,
 "verdict": "L1 · Needs a person describes Box today. Our agent stopped at signup: both the personal and developer forms put an hCaptcha checkbox in front of account creation, and there is no API or CLI path around it. Everything before that door works well: Markdown docs with llms.txt, a public OpenAPI reference, a CLI and an official OAuth MCP server. Past that wall, work, keys and paying all wait in the Developer Console and web checkout, so a person has to open the account before any of it runs.",
 "page": "https://agentdrives.com/tools/box?via=api"
}