AgentDrives
Free check
Boxbox.com

Can an AI agent use Box (box.com)?

As of 12 Oct 2026, an AI agent can't use Box on its own: hCaptcha on the sign-up form.

Level 1 · Needs a personAgents can't get in on their own.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean
Visit Box Follow changes

Driven 12 Oct 2026Same level in 2 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverStopped by a CAPTCHA on the sign-up form.
  • Signed agentsThe sign-up page opens. The CAPTCHA on the form stops them too.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Box (box.com).

On its own

  • Read all of Box's developer documentation and API reference as plain text, without needing an account
  • Find basic connection information for Box's AI-agent server without logging in

What it can't, and why

  • Create a Box accounta human-verification checkbox blocks both sign-up forms
  • Get an API key or make any API callneeds an account and a web dashboard, which was never reached
  • See the pricing pagea security check kept showing an interstitial page instead of content
Needs a person

Can an AI agent sign up for Box on its own?

No. Sign-up: needs a human. Both documented sign-ups (account.box.com/signup/personal and /signup/developer) show an hCaptcha 'I am human' checkbox on submit. No API or CLI sign-up.

Official server · no call worked

Does Box (box.com) have an MCP server, and can an agent connect to it?

Yes. Box has an official MCP server. The server is hosted and signs an agent in with OAuth.

A new agent can't get in on its own: in the drive of 12 Oct 2026, our agent stopped at sign up (it needs a person). Through the MCP server, 0 of our agent's 1 attempt worked.

What the drive found

APIOpenAPIMCP · officialCLISDKllms.txtWebhooksSandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Box.

Where agents stop in Box (box.com) today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

  1. Let verified agents pass sign-upStep-by-step guide
  2. Mint first credentials over an APIStep-by-step guide
  3. Support CIMD or device flow on OAuthStep-by-step guide
2 more fixes
  1. Let signed agents read www.box.com Step-by-step guide
  2. Offer an agent payment rail Step-by-step guide
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into Box (box.com), so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • MCP server
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 6 Oct 2026L1Needs a person
  2. 12 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 13 attempts.

How an agent connects · 4 tips

/api/tools/box.json/tools/box.mdMCP get_tool {"slug":"box"}

  • Docs are agent-friendly: append .md to any developer.box.com page or send Accept: text/markdown; start from developer.box.com/llms.txt.
  • The free developer plan (account.box.com/signup/developer) auto-creates an authorized CCG app, the best headless route once a human gets past the hCaptcha.
  • The MCP server at mcp.box.com/mcp needs admin-issued Integration Credentials; there is no dynamic client registration.
  • Uploads go to upload.box.com/api/2.0/files/content, not api.box.com.
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlessdeveloper.box.com: llms.txt (368 guide + 413 reference pages), every page as Markdown via .md URL or Accept: text/markdown (vary: Accept). OpenAPI 3.0.2 in github.com/box/box-openapi (297 operations). www.box.com marketing pages (pricing, llms.txt) answer a Cloudflare challenge.
  2. Sign upNeeds a humanBoth documented sign-ups (account.box.com/signup/personal and /signup/developer) show an hCaptcha 'I am human' checkbox on submit. No API or CLI sign-up.
  3. VerifyNot reachedNot reached: sign-up stopped at the hCaptcha.
  4. KeyNot reachedNot reached. Docs: developer tokens and the free plan's auto-created CCG app credentials are read in the Developer Console web UI; the OAuth server has no registration endpoint, CIMD or device flow.
  5. First callNot reachedNot reached. Unauthenticated GET api.box.com/2.0/users/me answers 401 with WWW-Authenticate Bearer error=invalid_request.
  6. First actionNot reachedNot reached: no account.
  7. PayNot reachedNo agent rail: no 402 on box.com, api.box.com or x402./mpp./agents. subdomains, no MPP, Stripe Projects or Bazaar listing, no /.well-known/ucp, no billing API. Docs: upgrade is Upgrade Plan in the web app, then checkout with payment information; checkout not seen (behind sign-in) and www.box.com/pricing stayed on a Cloudflare interstitial. We paid nothing.
  8. CancelNot reachedNot reached: no plan or trial was started because sign-up never completed (hCaptcha wall). The API reference has no billing or subscription endpoint; plans are managed in the web app. Not tested, not a pass.
  9. DeleteNot reachedNot reached: no account was created (sign-up stopped at the hCaptcha), so there was nothing to delete and no rejected-access call to show. Not tested.
The attempt log · 13 attempts
CapabilityRouteResultEvidence
MCP discovery: POST server/discover to https://mcp.box.com/mcpmcpblocked ✓HTTP 401 empty body, WWW-Authenticate: Bearer resource_metadata=https://mcp.box.com/.well-known/oauth-protected-resource; PRM 200 JSON, authorization_servers [https://api.box.com/]; server-card URL also 401
Docs, llms.txt, markdown: Fetch developer.box.com llms.txt, Accept: text/markdown and .md URLapidone ✓developer.box.com/llms.txt 200 (Box Dev Docs, 368+413 pages); /guides/uploads with Accept: text/markdown -> content-type text/markdown, vary includes Accept; /guides/uploads.md 200 text/markdown. robots.txt developer.box.com: Content-Signal: ai-train=yes, search=yes, ai-input=yes (Cloudflare Content Signals, parses). www.box.com/llms.txt and /pricing: 403 cf-mitigated: challenge (Cloudflare managed challenge on our signed agent). /.well-known/ai-catalog.json and agent-card.json 404
Sign up (Box Individual free): Create free account at account.box.com/signup/personalbrowserblocked ✓Form filled (name, email the agent's inbox, password, TOS). On submit an hCaptcha checkbox widget appeared (I am human) with Field Required. Screenshot browser/shots/004.png. No API or CLI sign-up documented; OAuth AS has no registration
Sign up (human handoff): Ask a human to solve the hCaptcha on the sign-up formbrowserblocked ✓
Sign up (free developer plan): Create free developer account at account.box.com/signup/developer (docs: developer.box.com/guides/getting-started/free-developer-plan)browserblocked ✓Form filled; on Get Started the same hCaptcha I am human checkbox appeared with Field Required. (browser/shots/006.png)
Pay step public probes: Look for agent payment rails, billing API, checkoutnonedone ✓pay_probe.json: no 402 challenges (box.com, api.box.com 401, x402./mpp./agents. 302), no MPP/Stripe Projects/Bazaar listing, /.well-known/ucp 404, MCP needs OAuth (tools not listed), pricing page 403. pay_tx.json: refused, no 402 asking for USDC. This run: www.box.com/pricing shows a Cloudflare interstitial in the browser that did not clear after 15 s (browser/shots/008.png); docs search for x402/402/machine payments/Stripe Projects in developer.box.com home index: 0 hits; no billing/subscription endpoint in the API reference index. free-developer-plan.md: upgrade = Upgrade Plan in web app, Complete checkout and enter payment information
Cancel plan: Cancel a paid plannoneskippedno plan or trial started; no billing/subscription API in the API reference index
verify: verify after sign-upnoneblockednot reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session
credentials: credentials after sign-upnoneblockednot reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session
The first call: The first call after sign-upnoneblockednot reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session
The first action: The first action after sign-upnoneblockednot reached: sign-up stopped at hCaptcha. Unauthenticated GET https://api.box.com/2.0/users/me -> 401 WWW-Authenticate Bearer error=invalid_request, empty body; developer tokens / CCG apps need a Developer Console session
Create a scoped key headless: Create API credentials via API/CLInoneblockedDocs (getting-started/index.md): Developer Token is generated in the Developer Console web UI; free developer plan auto-creates a CCG app whose client id/secret are read in the console; OAuth AS metadata has no registration_endpoint/CIMD/device flow. No account, so not reached
Delete account: Delete the accountnoneskippedno account was created (sign-up stopped at hCaptcha)

Also in File storage.

All of File storage, by level