AgentDrives
Free check
Dropboxdropbox.com

Can an AI agent use Dropbox?

As of 12 Oct 2026, an AI agent can't use Dropbox on its own: Arkose puzzle on the sign-up form.

Level 1 · Needs a personAgents can't get in on their own.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean
Visit Dropbox Follow changes

Driven 12 Oct 2026Same level in 2 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverStopped by a CAPTCHA on the sign-up form.
  • Signed agentsThe sign-up page opens. The CAPTCHA on the form stops them too.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 13 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Dropbox.

On its own

  • Read Dropbox's help pages and developer docs without signing up
  • Start registering an app for API access without logging in

What it can't, and why

  • Create a Dropbox accounta picture puzzle appears that only a human can solve
  • Upload, share, or manage any filesthis needs a working account, which couldn't be created
  • Start a free trial of the paid planit requires entering a card or bank payment detail
Needs a person

Can an AI agent sign up for Dropbox on its own?

No. Sign-up: needs a human. No API sign-up; web form shows an Arkose Labs puzzle after 'Agree and sign up'.

Official server · a new agent can't get in alone

Does Dropbox have an MCP server, and can an agent connect to it?

Yes. Dropbox has an official MCP server. The server is hosted and signs an agent in with OAuth.

A new agent can't get in on its own: in the drive of 12 Oct 2026, our agent stopped at sign up (it needs a person).

What the drive found

API–OpenAPIMCP · official–CLIllms.txt–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Dropbox.

Where agents stop in Dropbox today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

  1. Let verified agents sign up without a puzzleStep-by-step guide
  2. Publish a device authorization endpointStep-by-step guide
  3. Support CIMD for MCP client registrationStep-by-step guide
2 more fixes
  1. Offer a trial without a card Step-by-step guide
  2. Serve markdown docs and an OpenAPI file Step-by-step guide
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into Dropbox, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • MCP server
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 6 Oct 2026L1Needs a person
  2. 12 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 17 attempts.

How an agent connects · 3 tips

/api/tools/dropbox.json/tools/dropbox.mdMCP get_tool {"slug":"dropbox"}

  • Have a human create the account: sign-up shows an Arkose puzzle
  • For MCP use DCR at https://www.dropbox.com/oauth2/register with a public client and PKCE; it assigns fixed localhost/127.0.0.1 redirect URIs
  • robots.txt disallows /home* and /account*: a robots-respecting browser agent cannot use the web file browser or settings
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlessHTTP API reference and /llms.txt fetched headless; no OpenAPI, no markdown pages
  2. Sign upNeeds a humanNo API sign-up; web form shows an Arkose Labs puzzle after 'Agree and sign up'.
  3. VerifyNot reachednot reached: sign-up stopped at the Arkose puzzle
  4. KeyNot reachedDCR at /oauth2/register gave a client id headless (201), but a token needs a signed-in user at /oauth2/authorize or the App Console; no account
  5. First callNot reachedno token; unauthenticated list_folder answers 400 'Invalid authorization value'
  6. First actionNot reachednot reached: no token
  7. PayNot reachedNo 402/x402/MPP/UCP/registry listing; we paid nothing. Free Basic plan (2 GB); the 30-day Standard trial checkout asks for payment details (card, PayPal or IBAN). No billing API in the HTTP API docs.
  8. CancelNot reachednot tested: no plan or trial was started; trial page says 'Cancel anytime'
  9. DeleteNot reachedno account was created (sign-up wall); robots.txt disallows /account*
The attempt log · 17 attempts
CapabilityRouteResultEvidence
MCP version: POST server/discover to https://mcp.dropbox.com/mcpapipartial ✓HTTP 401 text/plain "missing bearer token"; WWW-Authenticate: Bearer resource_metadata="https://mcp.dropbox.com/.well-known/oauth-protected-resource/mcp"
MCP auth metadata: GET PRM and AS metadataapidone ✓PRM 200 application/json: resource https://mcp.dropbox.com/mcp, authorization_servers [https://www.dropbox.com], scopes files.*, sharing.*, file_requests.*, account_info.read. AS metadata https://www.dropbox.com/.well-known/oauth-authorization-server 200 JSON: registration_endpoint https://www.dropbox.com/oauth2/register (DCR), no client_id_metadata_document_supported, grant_types include device_code but no device_authorization_endpoint, code_challenge_methods plain,S256
Cards: server card, AI catalog, A2A cards, ucp, auth.md, SKILL.mdapidone ✓https://mcp.dropbox.com/mcp/server-card 429 (no body); www.dropbox.com/.well-known/ai-catalog.json 404, agent-card.json 404, agent.json 404, mcp/server-card.json 404, ucp 404, /auth.md 404, /SKILL.md 404 (all text/html)
robots.txt and aipref: GET https://www.dropbox.com/robots.txtapidone ✓200, 39 lines; User-agent * group disallows /home*, /account*, /sharing/*, /s/, /scl/, /preview/, /recover*, /downgrade* etc.; no Content-Usage or Content-signal lines; /register and /developers/apps not disallowed
llms.txt and markdown: GET /llms.txt; Accept: text/markdown on developers docs; .md URLapidone ✓https://www.dropbox.com/llms.txt 200 text/plain 209 KB, H1 "# Dropbox", links marketing+developers pages. Accept: text/markdown on /developers/documentation/http/documentation -> text/html, Vary: Accept-Encoding only; .md URL 404
Find docs: Read API docs and llms.txtapidone ✓https://www.dropbox.com/developers/documentation/http/documentation 200 text/html (HTTP API reference); /llms.txt 200 lists developers pages; no OpenAPI (api.dropbox.com/openapi.json 404 per pay_probe)
Sign up headless: Find a documented API/CLI sign-upnoneblockedNo sign-up endpoint in the HTTP API docs; AS metadata has no agent_auth block; /auth.md 404
Sign up in browser: Register at https://www.dropbox.com/register with the agent's inboxbrowserblocked ✓Email -> name/password form accepted; first click on "Agree and sign up" refused a password without a digit (clear inline rule); after "Agree and sign up" the page showed an Arkose Labs puzzle: "Protecting your account. Please solve this puzzle so we know you are a real person. Start Puzzle" (screenshot browser/shots/006.png). pw captcha flags all false (Arkose not detected by our snapshot)
Pay: public probes: 402 challenges, registries, well-knowns, checkout and trialbrowserdone ✓pay_probe.json: no 402 challenges on dropbox.com/api.dropbox.com, x402./mpp./agents. subdomains do not resolve, no mpp/Stripe Projects/Bazaar listing, /.well-known/ucp 404, MCP has no payment tools visible (401). pay_tx.json: refused, no 402 asking for USDC. /plans: "Basic Free 2 GB to store and share your files"; trial link /checkout?key=[redacted] shows "Try free for 30 days ... No charge until 11/11/2026 ... Payment details ... Credit card. We accept visa, mastercard, amex, discover / Paypal / Account holder name, IBAN" (Adyen direct debit) -> card trial
OAuth client registration (DCR): POST https://www.dropbox.com/oauth2/register (from AS metadata)apipartial ✓201 application/json {client_id: [redacted], token_endpoint_auth_method: none, redirect_uris: their fixed localhost/127.0.0.1 list (our :8765 URI replaced)}
Scoped API key: Create an access tokennoneblockedTokens come from the App Console (/developers/apps, web) or the OAuth code flow; both need a signed-in account; sign-up stopped at the Arkose puzzle
First API call: POST https://api.dropboxapi.com/2/files/list_folder without tokenapiblocked ✓400 text/plain: Error in call to API function "files/list_folder": Invalid authorization value in HTTP header/URL parameter
Verify email: Verification mailnoneblockedsign-up not completed (Arkose puzzle); no account
Create a file: Upload a filenoneblockedno token
Cancel plan: Cancel a started plannoneskippedno plan or trial was started (trial needs a payment method; no account)
Delete account: Delete the accountnoneblockedno account was created (sign-up stopped at the Arkose puzzle); robots.txt disallows /account* where account settings live
Inbox: Check inbox for any Dropbox mailnonedone ✓inbox read the agent's inbox: "No mail" (expected: sign-up never completed)

Also in File storage.

All of File storage, by level