Boxes MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Boxes MCPfind items missing photos or receipts in the garage"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Boxes MCP
An unofficial, local-first Model Context Protocol server for inventory data exported from Boxes: Storage made simple.
Boxes MCP turns your spaces, containers, nested items, values, custom fields, and downloaded photos into a private mirror that an MCP client can search and analyze. Boxes remains the capture app and source of truth.
This project is not affiliated with, endorsed by, or sponsored by StackTracks, LLC. “Boxes” is used only to identify compatibility with the Boxes app. No Boxes logos or proprietary code are included.
Status
Early preview. The server, format-tolerant CSV/ZIP importer, signed webhook verifier, and export-request adapter are implemented. Exact field mapping will be tightened against a sanitized real export.
The package is named boxes-home-inventory-mcp because the npm name boxes-mcp is already used by an unrelated GNOME virtualization project.
Related MCP server: MCP_Documents
Quick start
Requires Node.js 20 or newer.
npm install
npm run build
node dist/src/cli.js import /path/to/boxes-export.zip
node dist/src/cli.js serveAdd the local server to an MCP client:
{
"mcpServers": {
"boxes": {
"command": "node",
"args": ["/absolute/path/to/boxes-mcp/dist/src/cli.js", "serve"],
"env": {
"BOXES_MCP_DATA_FILE": "/absolute/private/path/inventory.json",
"BOXES_MCP_MEDIA_DIR": "/absolute/private/path/media"
}
}
}
}Inventory data and images are ignored by Git. Do not commit real exports or your data/ directory.
Tools
search_inventory— search names, notes, locations, tags, and custom fields.get_inventory_object— fetch a record by stable ID.list_contents— list the objects directly inside a space or container.inventory_totals— summarize counts, quantity, and declared value.documentation_audit— find items missing photos, values, receipts, or other requested evidence.get_sync_status— inspect import/webhook freshness.request_export— call a Boxes-approved export endpoint when one is configured.
Importing exports and images
Request an export in Boxes from Dashboard → Manage Data → Export Data. Import the downloaded CSV, a directory of CSVs, or a ZIP containing CSVs:
boxes-mcp import ~/Downloads/boxes-export.zipIf your image ZIP is separate, import it too. Image files are copied into the private media directory with SHA-256 filenames so duplicates are stored once.
The importer preserves every original column in raw, even when it does not recognize the field yet.
Export-request automation
Boxes currently documents export requests through its iOS interface, not a public API. Its terms prohibit reverse-engineering and unauthorized automated access. For that reason, this project does not embed private mobile endpoints or ask for your Boxes password.
The MCP tool is ready for an approved endpoint. Once Boxes provides an export URL and authentication method, configure:
BOXES_EXPORT_REQUEST_URL=https://approved.example/export
BOXES_EXPORT_REQUEST_TOKEN=...
BOXES_EXPORT_ALLOWED_HOSTS=approved.exampleUntil then, request_export returns a clear not_configured result instead of pretending an export was requested.
Event notifications
Pro accounts can send signed HTTPS event notifications to Boxes MCP:
BOXES_WEBHOOK_SECRET=... boxes-mcp webhooksThe receiver listens on POST /webhooks/boxes, verifies the X-Boxes-Signature HMAC over timestamp.raw_body, rejects stale requests, and deduplicates event UUIDs. It stores the entity snapshot while discarding actor email and device metadata by default.
Webhooks are an incremental signal, not a complete backup. Use periodic full exports to reconcile missed events and photos.
Privacy and security
Local storage by default; no analytics or telemetry.
Raw exports, photos, secrets, and the mirror database are Git-ignored.
Actor email/device metadata from webhooks is not retained.
Export endpoints require HTTPS and an explicit hostname allowlist.
Read tools are marked read-only in their MCP annotations.
See SECURITY.md before exposing the HTTP receiver to the internet.
Development
npm run typecheck
npm testContributions are welcome. Synthetic fixtures only—never attach a real household export to a public issue or pull request.
License
Apache-2.0.
Available Tools
7 toolsdocumentation_auditAudit inventory documentationBRead-only
Find item records missing selected claim-documentation fields in the local mirror.
| Name | Required | Description | Default |
|---|---|---|---|
| receiptField | No | receipt_available | |
| requirePhoto | No | ||
| requireValue | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already establish readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds the 'local mirror' scoping and the missing-fields focus, but does not disclose output shape, pagination, or whether results are exhaustive; that is acceptable given the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the core purpose and includes the important local-mirror qualifier. It is concise with no filler, though 'selected claim-documentation fields' is slightly imprecise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no parameter descriptions, and sibling tools that also operate on inventory records, this description does not give an agent enough to invoke the tool confidently or interpret its result. It conveys purpose but omits how the parameters map and what the returned records look like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description does not explain receiptField, requirePhoto, or requireValue. 'Selected claim-documentation fields' only vaguely gestures at the parameters, leaving the agent to guess what each boolean controls or what a valid receiptField value looks like.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Find item records missing...') and a resource ('item records') with a scope qualifier ('in the local mirror'). It is clear enough to stand apart from generic search/list siblings, though it doesn't explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The wording implies this tool is for auditing documentation completeness rather than normal search, but it never states when to prefer it over search_inventory or list_contents. No exclusions or alternative routing are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_inventory_objectGet a Boxes objectARead-only
Get one inventory record by its stable Boxes MCP ID.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description does not need to restate safety. It adds that the ID is stable and that exactly one record is returned, but it does not describe behavior for missing IDs, error cases, or the return shape. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word contributes to the tool's purpose and key parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only lookup tool, the description is nearly sufficient. The only notable gaps are no explicit mention of the return value and no guidance on how the stable Boxes MCP ID is obtained, but these are minor for a simple get-by-ID operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only defines an id string with minLength 1, providing no semantic context. The description adds meaningful meaning by identifying the parameter as a stable Boxes MCP ID used to fetch a single inventory record, going beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Get one inventory record') and the distinguishing identifier ('stable Boxes MCP ID'). This clearly separates it from sibling tools like search_inventory, list_contents, and inventory_totals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when the agent already has a stable Boxes MCP ID for a single inventory record. However, it does not explicitly say when not to use it or point to alternatives such as search_inventory when the ID is unknown.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_sync_statusGet Boxes mirror statusARead-only
Return import, image, and webhook freshness for the private local mirror.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds value by naming the specific output dimensions (import, image, webhook freshness) but does not explain how 'freshness' is expressed or whether there are latency or failure behaviors. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. Every phrase ('import', 'image', 'webhook freshness', 'private local mirror') provides useful information, making it appropriately concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only status tool, the description names the exact freshness dimensions returned and the resource scope, while annotations cover the safety aspects. It does lack a definition of what 'freshness' means or the exact response shape, but since there is no output schema, the description is still largely complete for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema description coverage, so the description cannot meaningfully add parameter-level semantics. With no parameters to document, the baseline is 4; the description's mention of what is returned is more than sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Return') and resource ('import, image, and webhook freshness for the private local mirror'), making the tool's function immediately clear. It also distinguishes itself from inventory-oriented siblings like search_inventory and list_contents by focusing on mirror status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context about what the tool targets ('private local mirror') but does not explicitly say when to use it versus siblings or when not to use it. Usage is implied by the name and resource scope, but no alternatives or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_totalsSummarize inventory totalsARead-only
Return record counts, quantity, and declared value grouped by object type and currency.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds that it returns grouped totals but does not disclose additional behaviors like whether it reflects real-time data, pagination, or any limitations. With annotations in place, the description adds moderate value but lacks deeper behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that states the core action and output without any fluff. Every word contributes meaning, and it is appropriately sized for a tool with no parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with annotations covering safety and no output schema, the description fully specifies what the tool returns and how it is grouped. Nothing essential is missing for an agent to call it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema carries no burden. The baseline for no-parameter tools is 4, and the description does not need to explain parameter semantics. The description implicitly confirms that no inputs are required, which is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Return') and resource ('inventory totals') with explicit output fields (record counts, quantity, declared value) and grouping criteria (object type and currency). This distinguishes it from siblings like search_inventory (searching) and get_inventory_object (retrieving a specific object).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention when an agent should prefer this over search_inventory or list_contents, nor does it state exclusions or prerequisites. The purpose implies it's for aggregate summaries, but that is not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_contentsList container contentsARead-only
List records directly inside a space or box using an external or stable parent ID.
| Name | Required | Description | Default |
|---|---|---|---|
| parentId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the operation read-only and non-destructive. The description adds behavioral value by scoping results to records 'directly inside' the container, implying non-recursive traversal, and by clarifying that the parent ID is external/stable rather than an internal key.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is a single front-loaded sentence that conveys action, object scope, and parameter type with no filler. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list operation with one parameter, the description plus annotations cover safety and scope. It does not detail the return value's shape or pagination, but the title and 'List records' phrase adequately convey the expected result for a basic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and only one parameter, the description must add meaning, and it does: parentId is an external or stable identifier for a space or box. It does not specify the ID format or how to obtain it, but for a single-parameter tool this is reasonable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('List records directly inside a space or box') and a distinctive input ('external or stable parent ID'). This clearly differentiates it from siblings like search_inventory and get_inventory_object, which target search or single-object retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when you need direct child records of a container and have a parent ID, but it does not explicitly state when to prefer it over search_inventory or get_inventory_object. No exclusions or alternative routing are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_exportRequest a Boxes exportA
Request a full account export through a provider-approved endpoint configured by the user.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Confirm that sending an export email is desired |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only, non-idempotent, and open-world behavior, so the bar is lower. The description adds useful context about the provider-approved endpoint, but it does not spell out side effects such as triggering an email export or that the result may be asynchronous. The confirm parameter's description mentions the email side effect, but the tool description itself stays thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the action and resource, with no filler. The endpoint qualifier earns its place by explaining the delivery mechanism without bloating the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a confirm-only action with one required boolean parameter and no output schema, the definition covers purpose, consent, and channel adequately. It could more fully describe what happens after the request, such as the asynchronous delivery of an export email, but nothing needed to invoke the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the confirm parameter is fully documented as consent to sending an export email. The description adds no parameter-level detail, so the baseline of 3 applies because the schema already carries the semantic weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ('request') with a specific resource ('full account export') and adds the qualifier 'through a provider-approved endpoint configured by the user.' This clearly distinguishes it from the sibling inventory and search tools, which are not export-related.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it, namely when a full account export is desired, and it identifies the delivery channel. However, it does not explicitly contrast the tool with siblings or state when not to use it; the guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_inventorySearch Boxes inventoryARead-only
Search object names, descriptions, tags, locations, and custom fields in the local Boxes mirror.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds that the search operates on a 'local Boxes mirror', implying data may be a snapshot rather than live, which is useful context. However, it does not disclose query behavior (e.g., fuzzy vs exact match) or any pagination/limitations beyond what the schema's limit parameter already provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that immediately states the action and scope. It is front-loaded with the verb 'Search' and contains no superfluous words. Every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with two parameters, the description covers the 'what' (fields searched) and 'where' (local mirror), but does not explain result format, query matching behavior, or how it relates to sibling tools. Since there is no output schema and no further context, an agent might need to infer how to handle responses, though the read-only nature is clear from annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It specifies which fields the query targets, giving meaning to the 'query' parameter. However, it does not explain query syntax (e.g., case sensitivity, wildcards) or the semantics of the 'limit' parameter beyond what the schema defaults imply. It partially compensates but leaves gaps in full parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: searching across specific fields (names, descriptions, tags, locations, custom fields) within the local Boxes mirror. It uses a specific verb and resource, and distinguishes from siblings like get_inventory_object (which fetches a specific object) or list_contents (which lists contents), making the search function unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention when to choose search over get_inventory_object or list_contents, nor any exclusions or prerequisites. The context of 'local Boxes mirror' is mentioned but not framed as a usage condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
documentation_audit - First observed
get_inventory_object - First observed
get_sync_status - First observed
inventory_totals - First observed
list_contents - First observed
request_export - First observed
search_inventory
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: search, get single, list by parent, aggregate totals, audit gaps, sync status, and export. No overlap in functionality, so an agent can reliably select the right tool.
All tool names follow a consistent verb_noun pattern (search_inventory, get_inventory_object, list_contents, inventory_totals, documentation_audit, get_sync_status, request_export). This makes the set predictable and easy to navigate.
Seven tools is a well-scoped number for an inventory mirror server. Each tool addresses a specific need without bloat, and the count is within the ideal 3-15 range.
The tool set covers search, retrieval, listing, totals, audit, sync status, and export—covering the key workflows for a read-only mirror. The only minor gap is the lack of a direct 'trigger sync' or 'refresh' tool, but the presence of sync status and export mitigates this.
Maintenance
Related MCP Connectors
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Inspect XLSX/XLSM workbooks, validate email, generate SVG QR codes, and look up domain DNS and TLS.
Query Inbin's parsed email events (newsletters, invoices, alerts) as typed JSON tools.
Create, validate, edit, export (markdown/svg/png/mermaid), and search JSON Canvas files.
Related MCP Servers
- AlicenseAqualityAmaintenanceRead-only access to a local Hiberden backup catalog: list projects, archives, tapes, and jobs, check 3-2-1 coverage, and verify a stored copy by reading it back and re-hashing it. Runs against the catalog on your own machine, so nothing leaves it.14MIT
- FlicenseBqualityAmaintenanceEnables local, offline document extraction and manipulation—PDF first but also HTML, DOCX, XLSX, PPTX, EML, EPUB, Markdown, and plain text—through tools for probing, locating, extracting, converting, assembling, OCR, protecting, and redacting documents, with nothing leaving the machine.7-
- AlicenseAqualityBmaintenanceEnables users to create frozen, auditable snapshots of selected Markdown or text-layer PDFs and perform read-only, verifiable local searches with SQLite FTS5/BM25, preserving source hashes, schemas, and page/line anchors.82Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables safe, local DevOps inspection through a JSON-lines server with schema validation, path isolation, and redaction, supporting read-only Git operations, Kubernetes YAML validation, Terraform plan summaries, and sanitized log analysis.MIT