Search

Ask me anything

Connect the Box MCP server to your Workspace

Connect ClickUp to Box's hosted MCP server so your AI tools can search, read, upload, and organize Box content. Setup takes about 10 minutes.

Box scopes and the permissions of the Box account that authorized the connection apply to every request.

What you'll need

  • A ClickUp Workspace and the ClickUp browser app.
  • A Box Business plan or higher. Business Starter isn't supported. Individual MCP features or scopes may require a higher plan.
  • A Box admin or co-admin who can set up integrations and MCP credentials.
  • Workspace owner or admin for a Workspace connection. Members need the Connect Personal MCP Server permission for a personal connection. Guests and limited members can't connect MCP servers.

Step 1: Open Integrations in the Admin Console

A Box admin or co-admin completes Steps 1 to 4:

  1. Sign in to the Box Admin Console.
  2. Select Integrations.
  3. Search for Custom Box MCP Server.
  4. Hover over it and select Configure.

Screenshot of the Integrations page

Step 2: Add Integration Credentials

To create the credentials entry:

  1. In Additional Configuration, select + Add Integration Credentials.

Screenshot of the Configuration tab

  1. Enter a name for the entry and select Save.
  2. Expand the new entry.
  3. Copy its Client ID and Client Secret to a secure location.

If ClickUp shows an invalid_client error, the Client ID and Client Secret don't match one credentials entry. Copy both values again from the same entry.

Keep the Client Secret out of comments, screenshots, and shared documents.

Step 3: Add the redirect URI

To add the redirect URI:

  1. Under Redirect URIs, add https://search.clickup-prod.com/connect/boxmcp.
  2. Leave the credentials entry open.

Enter the URI exactly as shown, with no trailing slash. A generic MCP redirect URI fails with redirect_uri_mismatch.

Screenshot of the credentials blurred

Step 4: Select access scopes

Available scopes depend on your Box plan and admin settings. To select scopes:

  1. Select only the Access Scopes needed for the work you want ClickUp to do in Box.

Screenshot of the configuration and URI

  1. Select Save.
  2. Confirm the saved entry shows the redirect URI and scopes.

Box scopes set the maximum actions the integration can request. They don't grant access to content the authorizing Box identity can't already access.

If ClickUp shows an insufficient_scope error, ask your Box admin to select and save the scopes for the tools you need. Box admins can also turn off tools.

If the connection succeeds but shows no tools, ClickUp needs at least one tool from the server. Check that at least one scope is saved, and ask your Box admin to confirm the tools you need are turned on.

Connect in ClickUp

To connect the MCP server in ClickUp:

  1. In the ClickUp browser app, open the App Center.
  2. Search for and select Box MCP.
  3. Select Personal or Workspace:
    • Personal (Just for me): Only you can use this connection's tools. Use it when each person needs Box access under their own account.
    • Workspace (For all members): A Workspace owner or admin sets it up, and every member can use its tools. Every member acts as the Box account that authorized the connection, so make sure that account's access is safe to share.
  4. Select Connect.
  5. Enter the Client ID and Client Secret you copied in Step 2.

Screenshot of the app center connetion

  1. Sign in to Box with the account you want the connection to use, then allow access.
  2. Wait for ClickUp to validate the connection.

Validation takes up to 15 seconds and fails if Box returns no tools.

The Box MCP connection uses https://mcp.box.com. You don't need a separate OAuth app.

Box MCP's default OAuth flow acts as the Box user who authorizes it. Box continues to enforce that identity's access, collaboration permissions, and the scopes selected by the admin.

Available tools

Available tools depend on your Box scopes, plan, admin settings, and the permissions of the Box account that authorized the connection. Below are some examples of tools:

Tool Capability
search_files_keyword Search Box files by keyword, with optional filters and folder scoping.
get_file_content Retrieve the content of a Box file.
upload_file Upload a file to Box.
create_folder Create a folder in Box.

Limitations

Box plan and admin settings affect what you can set up and use:

  • Plan-dependent features: Not every Box plan includes every scope and tool. For example,the docgen.readwrite scope requires the Box Enterprise Advanced plan. Ask your Box admin which scopes are available to your organization.
  • Admin Console access: If you can't find Integrations or set up the Box MCP, ask a Box admin. Co-admin permissions and Box plan features can affect which settings are visible.

Troubleshooting

If your connection fails, match the error ClickUp shows:

Error Action
redirect_uri_mismatch Confirm that the Box credentials entry saved the exact redirect URI from Step 3. Check it character for character, including https:// and no trailing slash. If Box doesn't save your values, ask your Box admin or Box Support for help before connecting.
invalid_client See the tips in Step 2 and Step 4.
insufficient_scope See the tips in Step 2 and Step 4.

Disconnect or revoke access

Only Workspace owners and admins can disconnect a Workspace connection.

To disconnect Box from ClickUp:

  1. Open the App Center.
  2. Select MCP Servers.
  3. Open the Box MCP connection.
  4. Select the Personal or Workspace tab.
  5. Select the ellipsis ... icon next to Connected.
  6. Select Disconnect.

Disconnecting in ClickUp removes only the ClickUp connection. To revoke access in Box, ask your Box admin to revoke the token for this connection, or contact Box Support.

Revoking a token that another client also uses breaks that client's connection.

Security considerations

Request only the Box access scopes needed for your use case and review which Box identity authorizes the connection before making it available to the whole Workspace.

Box MCP doesn't bypass the authorizing identity's existing Box permissions.