Backblaze B2 vs Box API + MCP

Backblaze B2

$6.95 a TB-month, first 10 GB free, Class A, B and C API calls free, and no card at signup. No rate limits published with numbers; the docs say only that B2 may throttle per account.

Box API + MCP

Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. 20 status-feed entries between 7 July and 1 October 2026, two of them over two hours on uploads or multiple services.

Backblaze B2

1. Take the region from the key's S3 endpoint (the second label of s3.<region>.backblazeb2.com) and pass it as the SDK region
2. Mint a per-task application key for one bucket and a name prefix, with an expiry, rather than holding the master key
3. Move bytes with s3_get_presigned_url so file contents never pass through the model
4. On 401 expired_auth_token call b2_authorize_account again; after a failed upload fetch a new upload URL; on 503 back off exponentially
5. Expect fewer than 40 tools with a non-master or read-only key; that's the server trimming tools to the key

Box API + MCP

1. Call who_am_i first; the tool list depends on the plan, the admin's toggles and the scopes granted
2. Expect download and upload URL, move and shared-link tools to be missing unless an admin has enabled them
3. Pass fields= to trim responses and page folder listings with limit and marker
4. Send a box-version header to pin an API version, and watch responses for a Deprecation header
5. For a link that expires, set shared_link.unshared_at on a paid account; the free plan can't