Box Admin Analytics MCP server

<!-- mcp-name: io.github.shigechika/boxadm-mcp -->

boxadm-mcp

English | 日本語

MCP (Model Context Protocol) server that surfaces external file flow from a Box admin's point of view. It reads Box's enterprise event log (admin_logs) to highlight "who shares a lot with the outside" and "which files get accessed from outside" — an early-warning signal for leakage, not a general-purpose file browser.

Documentation:

Read-only: it never revokes shares, deletes files, or otherwise mutates anything — it only surfaces risk. This is a different tool from a general-purpose Box file MCP (the official Box MCP, or the claude.ai Box connector): those operate on a user's own files and cannot see enterprise events, which is exactly what this server is for.

Named after the admin-console viewpoint (boxadm = Box admin), sibling of gwsadm-mcp.

Features

Auth model

Two modes, selected via BOXAUTHMODE:

refresh token keeps it running unattended after that.

• oauth — OAuth 2.0 (user auth). An admin authorizes once in a browser; the

unattended if your Box tenant has an available server-authentication app slot.

• ccg — Client Credentials Grant (server-to-server). Simpler to run

adminlogs (enterprise events) is readable in either mode, provided the authorizing/impersonated user is an admin and the app has the Manage enterprise properties** scope.

OAuth setup (one-time, by a Box admin)

Authentication (OAuth 2.0)**

1. Developer Console → Create Platform App → **Custom App → User

for adminlogs). Add Read all files and folders too if you also want collaboration/share-link enumeration, and Manage users if you want the getuser lookup (each scope change requires re-consent via boxadm-mcp auth)

1. Redirect URI: http://localhost:8787/callback
2. Application Scopes: check Manage enterprise properties (required

default under most tenant policies)

1. Enable the app in the Admin Console (unpublished apps are disabled by

auth** → authorize in the browser → a token cache is written to ~/.config/boxadm-mcp/token.json (chmod 600)

1. Note the Client ID / Client Secret
2. First login: set BOXAUTHMODE=oauth etc., then run **boxadm-mcp

Setup

# uv
uv pip install boxadm-mcp

# pip
pip install boxadm-mcp

Or from source:

Shortened. The full README is on GitHub.