Box API + MCP vs Google Cloud Storage

Box API + MCP 65

Atlassian Statuspage at status.box.com with an RSS history (20). In the 90 days from 3 August the feed lists two majors by our reading, errors across multiple Box services from 19:37 to about 21:06 PDT on 6 August (impact over before the 21:06 update, resolved 22:16), and errors or timeouts on the Public API, Box Sign and downloads from 19:19 to 20:47 PDT on 19 October. The others are partial or short, among them Box Zones downloads in Asia on 24 and 25 August, uploads for 42 minutes on 24 August, five minutes across files, notes, API calls and logins on 29 September, six minutes on 8 October and Box Drive sync latency on 15 October. The 27 July upload incident left the window, and two majors still give 5. 1,000 calls a minute a user, 240 uploads a minute a user, 6 searches a second a user and 12 an enterprise, re-read on 1 November (15). 429 with a retry-after header, and current SDKs back off on their own and honour it (15). We didn't find an uptime SLA (0). API and MCP server GA, the MCP server since August 2025 (10). 20+5+15+15+0+10 = 65.

Google Cloud Storage 80

Google Cloud's status dashboard with a per-product incident feed (20). In the 90 days from 8 August, Cloud Storage appears in a high-severity incident on 20 August across 27 products (about 3 hours 40 minutes of timeouts and errors), a medium incident on 8 to 9 October with elevated upload and write errors, and a medium regional incident in europe-west2 on 20 October. One major outage (10). The request-rate guide gives numbers, no ramp-up needed below 1,000 writes or 5,000 reads a second per bucket, with gradual ramping above (15). The retry strategy page lists retryable responses, idempotent operations and preconditions that make writes safe to retry, and the client libraries back off exponentially (15). SLA with monthly uptime of 99.95 per cent for multi-region Standard and 99.9 per cent regional (10). Generally available, and the MCP server since 20 April 2026 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

Box API + MCP 72

The MCP server has 54 tools on its tools page on 1 November (5). An admin switches tool groups on and off and 16 start off, so the default surface is 38 (7 back). The API takes fields= to choose response fields, limit with offset or marker for paging, and filters on search (20). Documented JSON errors with a code, message and request ID (18). We couldn't check MCP annotations because the server code isn't published. The API takes If-Match and If-None-Match on updates, but has no idempotency keys (8). SDKs in Node, Python, Java, Windows (.NET) and iOS, and few required parameters (14). 12+20+18+8+14 = 72.

Google Cloud Storage 85

Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85.

Box API + MCP 73

OAuth 2.0 with scopes such as root_readonly and root_readwrite, short-lived access tokens and refresh tokens. The MCP server is an OAuth protected resource (28, two short because the MCP server asks for root_readwrite rather than letting a user pick read-only). Agents see only what their user can see, and 16 riskier tools (download and upload URLs, moves, metadata and property writes, shared links, collaborations, hub updates and DocGen batches) are off until an admin enables them, but there's no documented confirmation step (15). The MCP server returns file text and Box AI answers over content other people shared, and the tools page has no prompt-injection guidance (3). Centralised audit logs and admin reporting, and since 22 October enterprise events for shared-link one-time passcodes (15). FedRAMP, HIPAA, PCI DSS and ISMAP on the security page, per the 1 October check. No bug bounty on that page and still no security.txt on box.com (404 on 1 November) (12). 28+15+3+15+12 = 73.

Google Cloud Storage 85

IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85.

Box API + MCP 91

Public OpenAPI 3.0 spec in box/box-openapi with 297 operations, plus files for API versions 2025.0 and 2026.0, last changed on 28 October 2026 (25). developer.box.com/llms.txt indexes the docs, each page with a Markdown twin (10). Operation descriptions state purpose and defaults, the shared link one for example explains each access level and what an empty object does, but rarely say when not to call (15). Typed parameters with enums such as open, company and collaborators, and required fields marked (13). Every operation documents error responses, parameters carry examples, but only 25 of 297 operations have response examples (13). Year-based API versions and a dated developer changelog, newest 28 October 2026 (15). 25+10+15+13+13+15 = 91.

Google Cloud Storage 81

The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.

Box API + MCP 77

Closed service with named contracting entities per region; the SDKs and OpenAPI spec are Apache-2.0 (18). Privacy policy with a revision effective 5 October 2026 per the 30 September check, and the security page says Box AI doesn't train on customer data (20). A written versioning policy, at least 12 months of support per version and 24 months between deprecation and retirement, with Deprecation headers (20). We didn't read a sub-processor list or data-location page this run (10). Not re-read on 1 November beyond the changelog and docs. 18+20+20+10 = 68.

Google Cloud Storage 85

Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.

Box API + MCP 25

No x402, MPP or L402 (0). Plan prices public per seat; the price of API calls beyond the plan allowance is under Platform pricing, which we didn't read (10). The Individual plan is free with 10 GB, but the MCP server needs Business or above. We didn't confirm whether the free plan or the Business trial asks for a card (15). A person signs up in a browser and an admin enables the MCP server (0). The pricing page answered our reader with HTTP 403 on 1 November, so plan prices and the free plan are per the 1 October check. 0+10+15+0 = 25.

Google Cloud Storage 30

No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30.