# Box: L1 · Needs a person As of 12 Oct 2026, an AI agent can't use Box on its own: hCaptcha on the sign-up form. Source: https://agentdrives.com/tools/box?via=md · driven 12 Oct 2026 by AgentDrives's agent · Same level in 2 drives in a row · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 L1 · Needs a person describes Box today. Our agent stopped at signup: both the personal and developer forms put an hCaptcha checkbox in front of account creation, and there is no API or CLI path around it. Everything before that door works well: Markdown docs with llms.txt, a public OpenAPI reference, a CLI and an official OAuth MCP server. Past that wall, work, keys and paying all wait in the Developer Console and web checkout, so a person has to open the account before any of it runs. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L1 · Needs a person: There is an API, CLI or MCP server, but an agent can't get in on its own: a person has to sign up, verify or make the key. What it does once a person sets it up shows next to the level. - Find: Docs for agents (llms.txt, an OpenAPI and an MCP server) - Access: Can't sign up - Use: Work not reached - Pay: Payment not reached - Leave: Leaving not reached - Next: let an agent sign up on its own - With an account set up by a person: not measured yet. ## Level history - 6 Oct 2026: L1 · Needs a person - 12 Oct 2026: L1 · Needs a person ## Part scores - Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI found - Not measured in this drive: Holds up, Docs match ## Who gets in - Agents on a server: Stopped by a CAPTCHA on the sign-up form. - Signed agents: The sign-up page opens. The CAPTCHA on the form stops them too. - Agents in a person's browser: Not measured yet. Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Checkpoints - **Docs**: Headless: developer.box.com: llms.txt (368 guide + 413 reference pages), every page as Markdown via .md URL or Accept: text/markdown (vary: Accept). OpenAPI 3.0.2 in github.com/box/box-openapi (297 operations). www.box.com marketing pages (pricing, llms.txt) answer a Cloudflare challenge. - **Sign up**: Needs a human: Both documented sign-ups (account.box.com/signup/personal and /signup/developer) show an hCaptcha 'I am human' checkbox on submit. No API or CLI sign-up. - **Verify**: Not reached: Not reached: sign-up stopped at the hCaptcha. - **Key**: Not reached: Not reached. Docs: developer tokens and the free plan's auto-created CCG app credentials are read in the Developer Console web UI; the OAuth server has no registration endpoint, CIMD or device flow. - **First call**: Not reached: Not reached. Unauthenticated GET api.box.com/2.0/users/me answers 401 with WWW-Authenticate Bearer error=invalid_request. - **First action**: Not reached: Not reached: no account. - **Pay**: Not reached: No agent rail: no 402 on box.com, api.box.com or x402./mpp./agents. subdomains, no MPP, Stripe Projects or Bazaar listing, no /.well-known/ucp, no billing API. Docs: upgrade is Upgrade Plan in the web app, then checkout with payment information; checkout not seen (behind sign-in) and www.box.com/pricing stayed on a Cloudflare interstitial. We paid nothing. - **Cancel**: Not reached: Not reached: no plan or trial was started because sign-up never completed (hCaptcha wall). The API reference has no billing or subscription endpoint; plans are managed in the web app. Not tested, not a pass. - **Delete**: Not reached: Not reached: no account was created (sign-up stopped at the hCaptcha), so there was nothing to delete and no rejected-access call to show. Not tested. ## Does Box (box.com) have an MCP server, and can an agent connect to it? Yes. Box has an official MCP server. The server is hosted and signs an agent in with OAuth. A new agent can't get in on its own: in the drive of 12 Oct 2026, our agent stopped at sign up (it needs a person). Through the MCP server, 0 of our agent's 1 attempt worked. ## How does an AI agent get a Box (box.com) API key? Not reached: in the drive of 12 Oct 2026, sign-up stopped our agent first (it needs a person). Not reached. Docs: developer tokens and the free plan's auto-created CCG app credentials are read in the Developer Console web UI; the OAuth server has no registration endpoint, CIMD or device flow. ## Paying the agent way Payment not reached. What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. - List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev). Ways to pay checked 12 Oct 2026. ## What an agent can do - Read every Box developer guide and API reference page as Markdown - Find the MCP server's OAuth metadata without an account ## What it cannot do - Create a Box account: hCaptcha checkbox on both sign-up forms - Get an API credential or call the API: needs an account and the Developer Console web UI - Read pricing on www.box.com: Cloudflare interstitial that did not clear for our signed agent ## Tips for the owner 1. Let verified agents pass sign-up 2. Mint first credentials over an API 3. Support CIMD or device flow on OAuth 4. Let signed agents read www.box.com 5. Offer an agent payment rail Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in File storage - [Cloudinary](https://agentdrives.com/tools/cloudinary.md?via=md): L4 · Runs on its own · [Box vs Cloudinary](https://agentdrives.com/compare/box-vs-cloudinary?via=md) - [Backblaze B2](https://agentdrives.com/tools/backblaze.md?via=md): L1 · Needs a person · [Box vs Backblaze B2](https://agentdrives.com/compare/backblaze-vs-box?via=md) - [Dropbox](https://agentdrives.com/tools/dropbox.md?via=md): L1 · Needs a person · [Box vs Dropbox](https://agentdrives.com/compare/box-vs-dropbox?via=md) - [Pinata](https://agentdrives.com/tools/pinata.md?via=md): L1 · Needs a person · [Box vs Pinata](https://agentdrives.com/compare/box-vs-pinata?via=md) ## Tips for agent builders - Docs are agent-friendly: append .md to any developer.box.com page or send Accept: text/markdown; start from developer.box.com/llms.txt. - The free developer plan (account.box.com/signup/developer) auto-creates an authorized CCG app, the best headless route once a human gets past the hCaptcha. - The MCP server at mcp.box.com/mcp needs admin-issued Integration Credentials; there is no dynamic client registration. - Uploads go to upload.box.com/api/2.0/files/content, not api.box.com.