{ "data": { "a": { "slug": "box-api", "name": "Box API + MCP", "vendor": "Box", "vendorUrl": "https://developer.box.com", "kind": "http-api", "category": "file-storage", "summary": "Enterprise content platform with a REST API for files, folders, shared links, collaborations, metadata and Box AI, published as OpenAPI with year-based API versions.", "url": "https://www.anchorterminal.com/tools/box-api", "markdownUrl": "https://www.anchorterminal.com/tools/box-api.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/box-api.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/box-api.json", "dns": "box-api.grade.anchorterminal.com", "repo": "https://github.com/box/box-node-sdk", "license": "Apache-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.box.com/2.0", "packages": [ { "registry": "npm", "name": "box-node-sdk" }, { "registry": "pypi", "name": "box-sdk-gen" } ], "auth": "oauth", "authNotes": "OAuth 2.0 against https://account.box.com/api/oauth2/authorize and https://api.box.com/oauth2/token, with a Bearer access token on every call. Server-side apps can use JWT or client credentials instead. The remote MCP server is an OAuth-protected resource (metadata at https://mcp.box.com/.well-known/oauth-protected-resource) and asks for the root_readwrite, ai.readwrite and docgen.readwrite scopes; the last needs an Enterprise Advanced licence. Users only ever see content they already have access to in Box.", "pricing": "byo-plan", "pricingNotes": "The API and MCP server come with a Box plan. Individual is free with 10 GB and a 250 MB upload limit. Personal Pro $14 a month ($10 billed yearly). Business plans need three users, Business Starter $7 a user a month ($5 yearly, 100 GB), Business $20 ($15, unlimited storage, 5 GB uploads, Box AI, 50,000 API calls a month), Business Plus $33 ($25, 15 GB uploads), Enterprise $47 ($35, 50 GB uploads, 1,000 AI units, 100,000 API calls), Enterprise Plus $50 a user a month billed yearly (150 GB uploads, 2,000 AI units), Enterprise Advanced on request (500 GB uploads, 20,000 AI units, 200,000 API calls). The MCP server needs Business or above. Extra API calls are sold as Platform pricing (https://www.box.com/pricing; https://support.box.com/hc/en-us/articles/43974584000659).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": 54, "popularity": { "githubStars": 199, "npmWeekly": 215715, "pypiWeekly": 275500, "asOf": "2026-09-30" }, "docsUrl": "https://developer.box.com/guides/", "llmsTxt": "https://developer.box.com/llms.txt", "openapi": "https://raw.githubusercontent.com/box/box-openapi/main/openapi.json", "capabilities": [ "storage.drive", "storage.share", "work.docs" ], "tags": [ "hosted", "closed-source", "mcp", "oauth", "enterprise", "typescript", "python", "webhooks" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 66.5, "grade": "B", "agentReady": false, "rank": 367, "ranked": true, "rankOf": 1486, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 84, "payments": 25, "reliability": 65, "schema": 91, "security": 73, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "-3, one term for a breaking change marked in a minor release of the listing's own Node package with no advance notice found. On 1 October 2026 box-node-sdk v10.17.0 changed `CollaborationItem` to the mini file, folder and web link types under a BREAKING CHANGES heading. The same change shipped that day in the Python SDK (`boxsdk` v10.17.0 and v4.17.0), Java and Windows SDKs and on 15 October in iOS SDK 10.17.0, which aren't among the listing's packages. https://developer.box.com/changelog/2026.md" ], "verdict": "Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. The status feed shows two majors in the 90 days to 1 November 2026, and the October SDK minor releases marked breaking changes without notice.", "bestFor": "Agents working inside an enterprise's existing Box content with admin oversight, Box AI extraction and audit needs.", "strengths": [ "Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages", "At least 24 months between deprecation and retirement of an API version, with Deprecation response headers", "Official remote MCP server with OAuth, 54 tools and 16 riskier ones off until an admin enables them", "Documented rate limits (1,000 calls a minute a user, 240 uploads a minute) with a 429 and retry-after that current SDKs honour", "SDKs in Node, Python, Java, Windows (.NET) and iOS, released together on 15 October 2026" ], "weaknesses": [ "Two major incidents in the 90 days to 1 November 2026, multiple services on 6 August and the Public API on 19 October", "Minor SDK releases on 1 and 15 October 2026 carried breaking `CollaborationItem` type changes with no advance notice found", "The MCP server asks for root_readwrite, so a connected agent can write wherever its user can once tools are on", "API calls are metered per enterprise, 50,000 a month on Business", "No security.txt on box.com, and no bug bounty on its security page" ], "agentNotes": [ "Call who_am_i first; the tool list depends on the plan, the admin's toggles and the scopes granted", "Expect download and upload URL, move and shared-link tools to be missing unless an admin has enabled them", "Pin SDK versions. Minor releases on 1 and 15 October 2026 changed `CollaborationItem` types", "Pass fields= to trim responses and page folder listings with limit and marker", "Send a box-version header to pin an API version, and watch responses for a Deprecation header" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.5 } ], "editorialScores": { "ergonomics": 72, "maintenance": 84, "payments": 25, "reliability": 65, "schema": 91, "security": 73, "transparency": 68 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl \"https://api.box.com/2.0/folders/0/items?limit=100\" -H \"Authorization: Bearer $BOX_ACCESS_TOKEN\"", "claudeCode": "claude mcp add --transport http box https://mcp.box.com", "config": { "mcpServers": { "box": { "url": "https://mcp.box.com" } } } }, "letme": { "capability": "https://letme.dev/storage.drive", "tool": "https://letme.dev/box-api" }, "area": "everyday", "unitPrices": [ { "item": "Business Starter", "unit": "seat-month", "usd": 7, "note": "$5 billed yearly, three-seat minimum, 100 GB" }, { "item": "Business", "unit": "seat-month", "usd": 20, "note": "$15 billed yearly. Lowest plan with the MCP server and Box AI" }, { "item": "Business Plus", "unit": "seat-month", "usd": 33, "note": "$25 billed yearly" }, { "item": "Enterprise", "unit": "seat-month", "usd": 47, "note": "$35 billed yearly, 100,000 API calls a month" }, { "item": "Personal Pro", "unit": "month", "usd": 14, "note": "$10 billed yearly, 100 GB, one user" } ], "provenance": { "legalEntity": "Box, Inc.", "domain": "box.com", "domainRegistered": "1999-02-17", "domainNote": "box.com was registered in 1999, before Box was founded, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://www.box.com/legal/termsofservice", "privacy": "https://www.box.com/legal/privacypolicy", "statusPage": "https://status.box.com", "changelog": "https://developer.box.com/changelog/", "securityTxt": "none", "checked": "2026-09-30", "notes": [ "The terms (effective 2026-08-17) name Box, Inc. for US residents, Box.com (UK) Ltd. (company 0809736) outside the US, and K.K. Box Japan in Japan.", "www.box.com/.well-known/security.txt returns 404.", "The mcp-server-box-remote repository holds a README and licence only; the server code is not published. The privacy notice names Box, Inc. and its subsidiaries and announces a revision effective 2026-10-05." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/box-api.json", "live": { "slug": "box-api", "probe": { "target": "https://api.box.com/2.0", "method": "get", "lastAt": "2026-11-07T18:20:14.608287403Z", "lastOk": true, "lastStatus": 401, "lastMs": 260, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 197, "p95ms24h": 606, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.box.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:20:37.116723043Z" }, "versions": [ { "registry": "github", "name": "box/box-node-sdk", "version": "v4.18.0", "released": "2026-10-15", "seenAt": "2026-11-06T23:11:56.105132887Z" }, { "registry": "npm", "name": "box-node-sdk", "version": "10.18.0", "seenAt": "2026-11-06T23:11:54.102130723Z" }, { "registry": "pypi", "name": "box-sdk-gen", "version": "1.17.0", "released": "2025-09-05", "seenAt": "2026-11-06T23:11:54.323381729Z" } ], "githubStars": 199, "npmWeekly": 212662, "pypiWeekly": 314219, "securityTxt": { "url": "https://box.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:14.353668955Z" }, "llmsTxt": { "url": "https://developer.box.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:43.78878509Z" }, "domain": { "domain": "box.com", "registered": "1999-02-17", "source": "https://rdap.verisign.com/com/v1/domain/box.com", "checkedAt": "2026-11-01T14:26:00.915784859Z" }, "pages": [ { "url": "https://developer.box.com/changelog/", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:02:56.381188874Z", "changedAt": "2026-11-06T13:25:31.083817503Z", "fingerprint": "5f9e8fe43f36" }, { "url": "https://www.box.com/pricing", "kind": "pricing", "status": 403, "checkedAt": "2026-11-07T14:26:03.145484723Z", "changedAt": "2026-10-09T18:48:42.443789473Z", "fingerprint": "dd4c02c8b139" }, { "url": "https://www.box.com/legal/privacypolicy", "kind": "privacy", "status": 403, "checkedAt": "2026-11-07T14:25:59.115004651Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.box.com/legal/termsofservice", "kind": "terms", "status": 403, "checkedAt": "2026-11-07T14:26:01.132231179Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9f0bd8a4bcb9" } ], "mcpTools": { "url": "https://mcp.box.com", "checkedAt": "2026-11-07T01:42:52.68216099Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:42:52.68216099Z" }, "github": { "repo": "box/box-node-sdk", "checkedAt": "2026-11-02T08:36:16.661889519Z", "stars": 199, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T11:14:58Z", "openIssues": 5, "openPRs": 2, "issuesOpened90d": 1, "issuesClosed90d": 0, "prsMerged90d": 55, "ci": { "branch": "main", "runs": 50, "success": 40, "failure": 10, "other": 0, "latest": "success", "latestAt": "2026-10-29T12:43:02Z" }, "replies": { "sampled": 25, "unanswered": 2, "medianDays": 3.6 } }, "updatedAt": "2026-11-07T18:20:14.608287403Z" } }, "answer": "Google Cloud Storage scores 76.7 (BB) on agent readiness against Box API + MCP's 66.5 (B), and leads in 6 of 7 scored categories. Box API + MCP leads on schema \u0026 documentation.", "b": { "slug": "google-cloud-storage", "name": "Google Cloud Storage", "vendor": "Google Cloud", "vendorUrl": "https://cloud.google.com/storage", "kind": "http-api", "category": "file-storage", "summary": "Google Cloud Storage is Google Cloud's object store for buckets and objects, reached through JSON and XML REST APIs, a gRPC Storage Control API, the gcloud CLI, client libraries and a generally available remote MCP server.", "url": "https://www.anchorterminal.com/tools/google-cloud-storage", "markdownUrl": "https://www.anchorterminal.com/tools/google-cloud-storage.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/google-cloud-storage.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/google-cloud-storage.json", "dns": "google-cloud-storage.grade.anchorterminal.com", "transports": [ "streamable-http" ], "remoteUrl": "https://storage.googleapis.com/storage/mcp", "packages": [ { "registry": "npm", "name": "@google-cloud/storage" }, { "registry": "pypi", "name": "google-cloud-storage" } ], "auth": "oauth", "authNotes": "Google OAuth 2.0 access tokens for user or service-account identities, scoped by IAM roles on the project, bucket or managed folder, with HMAC keys for the XML API's S3-style access, and V4 signed URLs that carry a signature, not the secret. The MCP server uses the same Google authentication, with its own IAM permissions per MCP method.", "pricing": "usage", "pricingNotes": "Pay per GB-month stored, per 1,000 operations and per GB of egress, by location and class. Standard in a single region is $0.005 per 1,000 Class A and $0.0004 per 1,000 Class B operations; a dual-region example bills $0.022 per GB-month. Always Free gives 5 GB-months of Standard storage, 5,000 Class A and 50,000 Class B operations in three US regions. Failed 4xx and 5xx operations are generally not charged.", "priceSummary": "$0.005 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on Cloud Storage or its pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 9, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.cloud.google.com/storage/docs/apis", "openapi": "https://storage.googleapis.com/$discovery/rest?version=v1", "capabilities": [ "storage.object", "storage.presigned", "storage.s3", "storage.share" ], "tags": [ "hosted", "usage", "free-tier", "mcp", "remote-mcp", "oauth", "iam", "google-cloud", "object-storage", "signed-urls", "sla", "grpc" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 76.7, "grade": "BB", "agentReady": true, "rank": 41, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 85, "maintenance": 88, "payments": 30, "reliability": 80, "schema": 81, "security": 85, "transparency": 85 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "IAM per bucket and MCP method, signed URLs, preconditions for safe retries and a 99.95 per cent multi-region SLA make it a well-governed object store for agents. The nine-tool MCP server has no read-only or destructive annotations, reads stop at 8 MiB, and a person must set up a project and billing first.", "bestFor": "Agents on Google Cloud that store and share files and datasets. amazon-s3, azure-blob-storage and cloudflare-r2 are the closest listings; teams outside Google Cloud with S3 tooling may prefer S3-compatible stores.", "strengths": [ "Generally available MCP server since 20 April 2026, with IAM permissions per MCP method", "Preconditions and a documented retry strategy make writes safe to retry", "SLA of 99.95 per cent a month for multi-region Standard storage", "Signed URLs share objects without sharing credentials", "Cloud Audit Logs cover admin and data access" ], "weaknesses": [ "MCP tools carry no read-only or destructive annotations and deletes need no confirmation", "read_object stops at 8 MiB through MCP", "A high-severity multi-product incident affected Cloud Storage on 20 August 2026", "Project and billing setup needs a person in a browser" ], "agentNotes": [ "Grant the agent's service account only Storage Object Viewer or Creator on the bucket it needs", "Send ifGenerationMatch on writes and deletes so a retry can't overwrite a newer object", "Use a V4 signed URL to share an object rather than changing bucket access", "Read objects over 8 MiB through the JSON API with Range, not the MCP read_object tool", "Confirm with the user before delete_bucket or delete_object" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.7 } ], "editorialScores": { "ergonomics": 85, "maintenance": 88, "payments": 30, "reliability": 80, "schema": 81, "security": 85, "transparency": 73 }, "provenanceScore": 97, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install google-cloud-storage", "http": "curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \"https://storage.googleapis.com/storage/v1/b?project=PROJECT_ID\"" }, "letme": { "capability": "https://letme.dev/storage.object", "tool": "https://letme.dev/google-cloud-storage" }, "sameCompany": [ "gemini-api", "vertex-ai", "gemini-embedding", "vertex-ai-tuning", "cloud-run-gpus", "google-model-armor", "google-imagen", "google-veo", "google-lyria", "google-speech-to-text", "google-cloud-tts", "gemini-live", "google-adk", "google-memory-bank", "google-secret-manager", "google-cloud-document-ai", "google-weather-api", "chrome-devtools-mcp", "google-maps-platform", "google-cloud-translation", "google-calendar-api", "firebase-cloud-messaging", "google-drive-api", "gemini-enterprise", "gemini-cli", "google-search-console", "google-ads-api", "google-forms", "google-sheets-api", "gmail-api", "google-people-api" ], "area": "everyday", "unitPrices": [ { "item": "Class A operation, Standard, regional", "unit": "1k-requests", "usd": 0.005, "note": "Flat namespace; $0.0065 with hierarchical namespace" }, { "item": "Class B operation, Standard, regional", "unit": "1k-requests", "usd": 0.0004, "note": "Flat namespace; $0.0005 with hierarchical namespace" }, { "item": "Standard storage, dual-region example", "unit": "gb-month", "usd": 0.022, "note": "Per the pricing page's Iowa and Oregon dual-region example; regional rates vary by location" } ], "provenance": { "legalEntity": "Google LLC (Google Cloud EMEA Limited and other regional entities by billing address)", "domain": "google.com", "domainRegistered": "1997-09-15", "endpointOnVendorDomain": true, "terms": "https://cloud.google.com/terms", "privacy": "https://policies.google.com/privacy", "statusPage": "https://status.cloud.google.com", "changelog": "https://docs.cloud.google.com/storage/docs/release-notes", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Legal entity, terms, privacy and security.txt follow the Google Cloud provenance in data/tools/google-secret-manager.json (checked 1 November 2026); not re-read for this listing.", "status.cloud.google.com/robots.txt allows all; its incidents.json was read on 6 November 2026.", "The API lives at storage.googleapis.com and the docs at docs.cloud.google.com, both Google domains." ], "score": 97 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/google-cloud-storage.json", "live": { "slug": "google-cloud-storage", "probe": { "target": "https://storage.googleapis.com/storage/mcp", "method": "get", "lastAt": "2026-11-07T18:20:27.576703196Z", "lastOk": true, "lastStatus": 405, "lastMs": 120, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 44, "p95ms24h": 120, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "versions": [ { "registry": "npm", "name": "@google-cloud/storage", "version": "8.4.0", "seenAt": "2026-11-06T23:29:10.718971869Z" }, { "registry": "pypi", "name": "google-cloud-storage", "version": "3.17.1", "released": "2026-10-15", "seenAt": "2026-11-06T23:29:11.680918026Z" } ], "npmWeekly": 26901222, "pypiWeekly": 39461441, "securityTxt": { "url": "https://google.com/.well-known/security.txt", "state": "valid", "expires": "2030-04-01T00:00:00z", "checkedAt": "2026-11-07T16:01:22.068349931Z" }, "pages": [ { "url": "https://docs.cloud.google.com/storage/docs/release-notes", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:05:53.84257971Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2d3b4b4b1622" } ], "updatedAt": "2026-11-07T18:20:27.576703196Z" } }, "edges": [ { "by": 15, "category": "reliability", "leads": "google-cloud-storage", "name": "Reliability", "reasons": { "a": "Atlassian Statuspage at status.box.com with an RSS history (20). In the 90 days from 3 August the feed lists two majors by our reading, errors across multiple Box services from 19:37 to about 21:06 PDT on 6 August (impact over before the 21:06 update, resolved 22:16), and errors or timeouts on the Public API, Box Sign and downloads from 19:19 to 20:47 PDT on 19 October. The others are partial or short, among them Box Zones downloads in Asia on 24 and 25 August, uploads for 42 minutes on 24 August, five minutes across files, notes, API calls and logins on 29 September, six minutes on 8 October and Box Drive sync latency on 15 October. The 27 July upload incident left the window, and two majors still give 5. 1,000 calls a minute a user, 240 uploads a minute a user, 6 searches a second a user and 12 an enterprise, re-read on 1 November (15). 429 with a retry-after header, and current SDKs back off on their own and honour it (15). We didn't find an uptime SLA (0). API and MCP server GA, the MCP server since August 2025 (10). 20+5+15+15+0+10 = 65.", "b": "Google Cloud's status dashboard with a per-product incident feed (20). In the 90 days from 8 August, Cloud Storage appears in a high-severity incident on 20 August across 27 products (about 3 hours 40 minutes of timeouts and errors), a medium incident on 8 to 9 October with elevated upload and write errors, and a medium regional incident in europe-west2 on 20 October. One major outage (10). The request-rate guide gives numbers, no ramp-up needed below 1,000 writes or 5,000 reads a second per bucket, with gradual ramping above (15). The retry strategy page lists retryable responses, idempotent operations and preconditions that make writes safe to retry, and the client libraries back off exponentially (15). SLA with monthly uptime of 99.95 per cent for multi-region Standard and 99.9 per cent regional (10). Generally available, and the MCP server since 20 April 2026 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80." }, "scores": { "a": 65, "b": 80 } }, { "by": 13, "category": "ergonomics", "leads": "google-cloud-storage", "name": "Agent ergonomics", "reasons": { "a": "The MCP server has 54 tools on its tools page on 1 November (5). An admin switches tool groups on and off and 16 start off, so the default surface is 38 (7 back). The API takes fields= to choose response fields, limit with offset or marker for paging, and filters on search (20). Documented JSON errors with a code, message and request ID (18). We couldn't check MCP annotations because the server code isn't published. The API takes If-Match and If-None-Match on updates, but has no idempotency keys (8). SDKs in Node, Python, Java, Windows (.NET) and iOS, and few required parameters (14). 12+20+18+8+14 = 72.", "b": "Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85." }, "scores": { "a": 72, "b": 85 } }, { "by": 12, "category": "security", "leads": "google-cloud-storage", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.0 with scopes such as root_readonly and root_readwrite, short-lived access tokens and refresh tokens. The MCP server is an OAuth protected resource (28, two short because the MCP server asks for root_readwrite rather than letting a user pick read-only). Agents see only what their user can see, and 16 riskier tools (download and upload URLs, moves, metadata and property writes, shared links, collaborations, hub updates and DocGen batches) are off until an admin enables them, but there's no documented confirmation step (15). The MCP server returns file text and Box AI answers over content other people shared, and the tools page has no prompt-injection guidance (3). Centralised audit logs and admin reporting, and since 22 October enterprise events for shared-link one-time passcodes (15). FedRAMP, HIPAA, PCI DSS and ISMAP on the security page, per the 1 October check. No bug bounty on that page and still no security.txt on box.com (404 on 1 November) (12). 28+15+3+15+12 = 73.", "b": "IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85." }, "scores": { "a": 73, "b": 85 } }, { "by": 10, "category": "schema", "leads": "box-api", "name": "Schema \u0026 documentation", "reasons": { "a": "Public OpenAPI 3.0 spec in box/box-openapi with 297 operations, plus files for API versions 2025.0 and 2026.0, last changed on 28 October 2026 (25). developer.box.com/llms.txt indexes the docs, each page with a Markdown twin (10). Operation descriptions state purpose and defaults, the shared link one for example explains each access level and what an empty object does, but rarely say when not to call (15). Typed parameters with enums such as open, company and collaborators, and required fields marked (13). Every operation documents error responses, parameters carry examples, but only 25 of 297 operations have response examples (13). Year-based API versions and a dated developer changelog, newest 28 October 2026 (15). 25+10+15+13+13+15 = 91.", "b": "The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81." }, "scores": { "a": 91, "b": 81 } }, { "by": 8, "category": "transparency", "leads": "google-cloud-storage", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with named contracting entities per region; the SDKs and OpenAPI spec are Apache-2.0 (18). Privacy policy with a revision effective 5 October 2026 per the 30 September check, and the security page says Box AI doesn't train on customer data (20). A written versioning policy, at least 12 months of support per version and 24 months between deprecation and retirement, with Deprecation headers (20). We didn't read a sub-processor list or data-location page this run (10). Not re-read on 1 November beyond the changelog and docs. 18+20+20+10 = 68.", "b": "Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73." }, "scores": { "a": 77, "b": 85 } }, { "by": 5, "category": "payments", "leads": "google-cloud-storage", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices public per seat; the price of API calls beyond the plan allowance is under Platform pricing, which we didn't read (10). The Individual plan is free with 10 GB, but the MCP server needs Business or above. We didn't confirm whether the free plan or the Business trial asks for a card (15). A person signs up in a browser and an admin enables the MCP server (0). The pricing page answered our reader with HTTP 403 on 1 November, so plan prices and the free plan are per the 1 October check. 0+10+15+0 = 25.", "b": "No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30." }, "scores": { "a": 25, "b": 30 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Box", "b": "Google Cloud", "name": "Vendor" }, { "a": "https://api.box.com/2.0", "b": "https://storage.googleapis.com/storage/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Your plan", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "none", "name": "Licence" }, { "a": "54", "b": "9", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-28", "b": "2026-11-04", "name": "Last release" }, { "a": "couldn't be read", "b": "2026-09-02", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "2026-10-01", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "yes", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "199 stars, 216k npm/wk, 276k PyPI/wk", "b": "none", "name": "Popularity" }, { "a": "2.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Google Cloud Storage scores 76.7 (BB) on agent readiness against Box API + MCP's 66.5 (B), and leads in 6 of 7 scored categories. Box API + MCP leads on schema \u0026 documentation.", "question": "Which is better for AI agents, Box API + MCP or Google Cloud Storage?" }, { "answer": "Both use an OAuth sign-in.", "question": "Do Box API + MCP and Google Cloud Storage need an API key?" }, { "answer": "Yes. Box API + MCP has a hosted endpoint at https://api.box.com/2.0 and Google Cloud Storage at https://storage.googleapis.com/storage/mcp.", "question": "Can an agent call Box API + MCP and Google Cloud Storage without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 91 against 81" ], "also": null, "goodFor": "Agents working inside an enterprise's existing Box content with admin oversight, Box AI extraction and audit needs.", "slug": "box-api", "watchFor": "Two major incidents in the 90 days to 1 November 2026, multiple services on 6 August and the Public API on 19 October" }, { "aheadOn": [ "Reliability, 80 against 65", "Agent ergonomics, 85 against 72", "Security \u0026 auth, 85 against 73", "Payments \u0026 pricing, 30 against 25", "Transparency \u0026 trust, 85 against 77" ], "also": [ "Agent-ready, a grade of BB or better", "No incidents deducted, where Box API + MCP loses 3 points for them" ], "goodFor": "Agents on Google Cloud that store and share files and datasets. amazon-s3, azure-blob-storage and cloudflare-r2 are the closest listings; teams outside Google Cloud with S3 tooling may prefer S3-compatible stores.", "slug": "google-cloud-storage", "watchFor": "MCP tools carry no read-only or destructive annotations and deletes need no confirmation" } ], "history": { "box-api": [ { "causes": [ "event" ], "date": "2026-11-01", "delta": -3, "from": 69.5, "fromGrade": "B", "to": 66.5, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 69.4, "fromGrade": "B", "to": 69.5, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.2, "from": 69.6, "fromGrade": "B", "to": 69.4, "toGrade": "B" } ], "google-cloud-storage": null }, "job": { "capability": "storage.share", "name": "File sharing" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-s3-vs-box-api.json", "title": "Amazon S3 vs Box API + MCP", "url": "https://www.anchorterminal.com/compare/amazon-s3-vs-box-api" }, { "json": "https://www.anchorterminal.com/compare/azure-blob-storage-vs-box-api.json", "title": "Azure Blob Storage vs Box API + MCP", "url": "https://www.anchorterminal.com/compare/azure-blob-storage-vs-box-api" }, { "json": "https://www.anchorterminal.com/compare/backblaze-b2-vs-box-api.json", "title": "Backblaze B2 vs Box API + MCP", "url": "https://www.anchorterminal.com/compare/backblaze-b2-vs-box-api" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-cloudflare-r2.json", "title": "Box API + MCP vs Cloudflare R2", "url": "https://www.anchorterminal.com/compare/box-api-vs-cloudflare-r2" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-digitalocean-spaces.json", "title": "Box API + MCP vs DigitalOcean Spaces", "url": "https://www.anchorterminal.com/compare/box-api-vs-digitalocean-spaces" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-tigris.json", "title": "Box API + MCP vs Tigris", "url": "https://www.anchorterminal.com/compare/box-api-vs-tigris" }, { "json": "https://www.anchorterminal.com/compare/dropbox-api-vs-google-cloud-storage.json", "title": "Dropbox API + MCP vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/dropbox-api-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/fast-io-vs-google-cloud-storage.json", "title": "Fastio vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/fast-io-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-google-drive-api.json", "title": "Google Cloud Storage vs Google Drive API + MCP", "url": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-google-drive-api" }, { "json": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-onlyoffice-mcp.json", "title": "Google Cloud Storage vs ONLYOFFICE Apps MCP Server", "url": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-onlyoffice-mcp" }, { "json": "https://www.anchorterminal.com/compare/amazon-s3-vs-google-cloud-storage.json", "title": "Amazon S3 vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/amazon-s3-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/azure-blob-storage-vs-google-cloud-storage.json", "title": "Azure Blob Storage vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/azure-blob-storage-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/backblaze-b2-vs-google-cloud-storage.json", "title": "Backblaze B2 vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/backblaze-b2-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/bunny-storage-vs-google-cloud-storage.json", "title": "Bunny Storage vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/bunny-storage-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-r2-vs-google-cloud-storage.json", "title": "Cloudflare R2 vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/cloudflare-r2-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-spaces-vs-google-cloud-storage.json", "title": "DigitalOcean Spaces vs Google Cloud Storage", "url": "https://www.anchorterminal.com/compare/digitalocean-spaces-vs-google-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-tigris.json", "title": "Google Cloud Storage vs Tigris", "url": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-tigris" }, { "json": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-wasabi-hot-cloud-storage.json", "title": "Google Cloud Storage vs Wasabi Hot Cloud Storage", "url": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-wasabi-hot-cloud-storage" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-dropbox-api.json", "title": "Box API + MCP vs Dropbox API + MCP", "url": "https://www.anchorterminal.com/compare/box-api-vs-dropbox-api" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-fast-io.json", "title": "Box API + MCP vs Fastio", "url": "https://www.anchorterminal.com/compare/box-api-vs-fast-io" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-google-drive-api.json", "title": "Box API + MCP vs Google Drive API + MCP", "url": "https://www.anchorterminal.com/compare/box-api-vs-google-drive-api" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-onedrive-sharepoint.json", "title": "Box API + MCP vs OneDrive and SharePoint files (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/box-api-vs-onedrive-sharepoint" }, { "json": "https://www.anchorterminal.com/compare/box-api-vs-onlyoffice-mcp.json", "title": "Box API + MCP vs ONLYOFFICE Apps MCP Server", "url": "https://www.anchorterminal.com/compare/box-api-vs-onlyoffice-mcp" }, { "json": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-onedrive-sharepoint.json", "title": "Google Cloud Storage vs OneDrive and SharePoint files (Microsoft Graph)", "url": "https://www.anchorterminal.com/compare/google-cloud-storage-vs-onedrive-sharepoint" } ], "panel": null, "scores": [ { "box-api": 65, "by": 15, "edge": "google-cloud-storage", "google-cloud-storage": 80, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "box-api": 91, "by": 10, "edge": "box-api", "google-cloud-storage": 81, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "box-api": 72, "by": 13, "edge": "google-cloud-storage", "google-cloud-storage": 85, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "box-api": 73, "by": 12, "edge": "google-cloud-storage", "google-cloud-storage": 85, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "box-api": 25, "by": 5, "edge": "google-cloud-storage", "google-cloud-storage": 30, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "box-api": 84, "by": 4, "edge": "google-cloud-storage", "google-cloud-storage": 88, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "box-api": 77, "by": 8, "edge": "google-cloud-storage", "google-cloud-storage": 85, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Google Cloud Storage scores 76.7 (BB) on agent readiness against Box API + MCP's 66.5 (B), and leads in 6 of 7 scored categories. Box API + MCP leads on schema \u0026 documentation. Both do file sharing.", "tasks": null, "tutorials": [], "verdicts": { "box-api": "Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. The status feed shows two majors in the 90 days to 1 November 2026, and the October SDK minor releases marked breaking changes without notice.", "google-cloud-storage": "IAM per bucket and MCP method, signed URLs, preconditions for safe retries and a 99.95 per cent multi-region SLA make it a well-governed object store for agents. The nine-tool MCP server has no read-only or destructive annotations, reads stop at 8 MiB, and a person must set up a project and billing first." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage", "json": "https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage.min.md" }, "markdown": "Google Cloud Storage scores 76.7 (BB) on agent readiness against Box API + MCP's 66.5 (B), and leads in 6 of 7 scored categories. Box API + MCP leads on schema \u0026 documentation. Both do file sharing.\n\n- Box API + MCP: grade B, 66.5/100, rank #367 of 1486. Markdown https://www.anchorterminal.com/tools/box-api.md · JSON https://www.anchorterminal.com/api/v1/tools/box-api.json\n- Google Cloud Storage: grade BB, 76.7/100, rank #41 of 1486. Markdown https://www.anchorterminal.com/tools/google-cloud-storage.md · JSON https://www.anchorterminal.com/api/v1/tools/google-cloud-storage.json\n- Best file storage and sharing APIs for AI agents: https://www.anchorterminal.com/best/file-storage/index.md\n- All 104 storage comparisons: https://www.anchorterminal.com/compare/file-storage/index.md\n\n## Which one, for what\n\n### Box API + MCP (B)\n\nGood for: Agents working inside an enterprise's existing Box content with admin oversight, Box AI extraction and audit needs.\n\nAhead on:\n- Schema \u0026 documentation, 91 against 81\n\nWatch for: Two major incidents in the 90 days to 1 November 2026, multiple services on 6 August and the Public API on 19 October\n\n### Google Cloud Storage (BB)\n\nGood for: Agents on Google Cloud that store and share files and datasets. amazon-s3, azure-blob-storage and cloudflare-r2 are the closest listings; teams outside Google Cloud with S3 tooling may prefer S3-compatible stores.\n\nAhead on:\n- Reliability, 80 against 65\n- Agent ergonomics, 85 against 72\n- Security \u0026 auth, 85 against 73\n- Payments \u0026 pricing, 30 against 25\n- Transparency \u0026 trust, 85 against 77\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- No incidents deducted, where Box API + MCP loses 3 points for them\n\nWatch for: MCP tools carry no read-only or destructive annotations and deletes need no confirmation\n\n\n## Why the edge\n\n### Reliability: Google Cloud Storage +15\n\n- Box API + MCP (65): Atlassian Statuspage at status.box.com with an RSS history (20). In the 90 days from 3 August the feed lists two majors by our reading, errors across multiple Box services from 19:37 to about 21:06 PDT on 6 August (impact over before the 21:06 update, resolved 22:16), and errors or timeouts on the Public API, Box Sign and downloads from 19:19 to 20:47 PDT on 19 October. The others are partial or short, among them Box Zones downloads in Asia on 24 and 25 August, uploads for 42 minutes on 24 August, five minutes across files, notes, API calls and logins on 29 September, six minutes on 8 October and Box Drive sync latency on 15 October. The 27 July upload incident left the window, and two majors still give 5. 1,000 calls a minute a user, 240 uploads a minute a user, 6 searches a second a user and 12 an enterprise, re-read on 1 November (15). 429 with a retry-after header, and current SDKs back off on their own and honour it (15). We didn't find an uptime SLA (0). API and MCP server GA, the MCP server since August 2025 (10). 20+5+15+15+0+10 = 65.\n- Google Cloud Storage (80): Google Cloud's status dashboard with a per-product incident feed (20). In the 90 days from 8 August, Cloud Storage appears in a high-severity incident on 20 August across 27 products (about 3 hours 40 minutes of timeouts and errors), a medium incident on 8 to 9 October with elevated upload and write errors, and a medium regional incident in europe-west2 on 20 October. One major outage (10). The request-rate guide gives numbers, no ramp-up needed below 1,000 writes or 5,000 reads a second per bucket, with gradual ramping above (15). The retry strategy page lists retryable responses, idempotent operations and preconditions that make writes safe to retry, and the client libraries back off exponentially (15). SLA with monthly uptime of 99.95 per cent for multi-region Standard and 99.9 per cent regional (10). Generally available, and the MCP server since 20 April 2026 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.\n\n### Agent ergonomics: Google Cloud Storage +13\n\n- Box API + MCP (72): The MCP server has 54 tools on its tools page on 1 November (5). An admin switches tool groups on and off and 16 start off, so the default surface is 38 (7 back). The API takes fields= to choose response fields, limit with offset or marker for paging, and filters on search (20). Documented JSON errors with a code, message and request ID (18). We couldn't check MCP annotations because the server code isn't published. The API takes If-Match and If-None-Match on updates, but has no idempotency keys (8). SDKs in Node, Python, Java, Windows (.NET) and iOS, and few required parameters (14). 12+20+18+8+14 = 72.\n- Google Cloud Storage (85): Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85.\n\n### Security \u0026 auth: Google Cloud Storage +12\n\n- Box API + MCP (73): OAuth 2.0 with scopes such as root_readonly and root_readwrite, short-lived access tokens and refresh tokens. The MCP server is an OAuth protected resource (28, two short because the MCP server asks for root_readwrite rather than letting a user pick read-only). Agents see only what their user can see, and 16 riskier tools (download and upload URLs, moves, metadata and property writes, shared links, collaborations, hub updates and DocGen batches) are off until an admin enables them, but there's no documented confirmation step (15). The MCP server returns file text and Box AI answers over content other people shared, and the tools page has no prompt-injection guidance (3). Centralised audit logs and admin reporting, and since 22 October enterprise events for shared-link one-time passcodes (15). FedRAMP, HIPAA, PCI DSS and ISMAP on the security page, per the 1 October check. No bug bounty on that page and still no security.txt on box.com (404 on 1 November) (12). 28+15+3+15+12 = 73.\n- Google Cloud Storage (85): IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85.\n\n### Schema \u0026 documentation: Box API + MCP +10\n\n- Box API + MCP (91): Public OpenAPI 3.0 spec in box/box-openapi with 297 operations, plus files for API versions 2025.0 and 2026.0, last changed on 28 October 2026 (25). developer.box.com/llms.txt indexes the docs, each page with a Markdown twin (10). Operation descriptions state purpose and defaults, the shared link one for example explains each access level and what an empty object does, but rarely say when not to call (15). Typed parameters with enums such as open, company and collaborators, and required fields marked (13). Every operation documents error responses, parameters carry examples, but only 25 of 297 operations have response examples (13). Year-based API versions and a dated developer changelog, newest 28 October 2026 (15). 25+10+15+13+13+15 = 91.\n- Google Cloud Storage (81): The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.\n\n### Transparency \u0026 trust: Google Cloud Storage +8\n\n- Box API + MCP (77): Closed service with named contracting entities per region; the SDKs and OpenAPI spec are Apache-2.0 (18). Privacy policy with a revision effective 5 October 2026 per the 30 September check, and the security page says Box AI doesn't train on customer data (20). A written versioning policy, at least 12 months of support per version and 24 months between deprecation and retirement, with Deprecation headers (20). We didn't read a sub-processor list or data-location page this run (10). Not re-read on 1 November beyond the changelog and docs. 18+20+20+10 = 68.\n- Google Cloud Storage (85): Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.\n\n### Payments \u0026 pricing: Google Cloud Storage +5\n\n- Box API + MCP (25): No x402, MPP or L402 (0). Plan prices public per seat; the price of API calls beyond the plan allowance is under Platform pricing, which we didn't read (10). The Individual plan is free with 10 GB, but the MCP server needs Business or above. We didn't confirm whether the free plan or the Business trial asks for a card (15). A person signs up in a browser and an admin enables the MCP server (0). The pricing page answered our reader with HTTP 403 on 1 November, so plan prices and the free plan are per the 1 October check. 0+10+15+0 = 25.\n- Google Cloud Storage (30): No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30.\n\n## Score by category\n\n| Category | Weight | Box API + MCP | Google Cloud Storage | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 80 | Google Cloud Storage +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 91 | 81 | Box API + MCP +10 |\n| Agent ergonomics | 13% (16.2 this run) | 72 | 85 | Google Cloud Storage +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 73 | 85 | Google Cloud Storage +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 30 | Google Cloud Storage +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 84 | 88 | Google Cloud Storage +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 85 | Google Cloud Storage +8 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **66.5 · B** | **76.7 · BB** | |\n\n## Facts side by side\n\n| Fact | Box API + MCP | Google Cloud Storage |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Box | Google Cloud |\n| Hosted endpoint | `https://api.box.com/2.0` | `https://storage.googleapis.com/storage/mcp` |\n| Transports | HTTP, Streamable HTTP | Streamable HTTP |\n| Auth | OAuth | OAuth |\n| Pricing | Your plan | Pay per use |\n| x402 | no | no |\n| Licence | Apache-2.0 | none |\n| Tools exposed | 54 | 9 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-28 | 2026-11-04 |\n| Terms last updated | couldn't be read | 2026-09-02 |\n| Privacy policy last updated | couldn't be read | 2026-10-01 |\n| Customer content may train models | couldn't be read | yes |\n| Terms restrict automated access | couldn't be read | not found in the text |\n| Terms restrict benchmarking | couldn't be read | not found in the text |\n| Terms or service can change without notice | couldn't be read | not found in the text |\n| Arbitration or class-action waiver | couldn't be read | not found in the text |\n| Popularity | 199 stars, 216k npm/wk, 276k PyPI/wk | none |\n| Agent reviews | 2.5/5 (2) | none |\n\n## How the scores have moved\n\n### Box API + MCP\n\n- -3.0 on 1 November 2026: negative event\n- +0.1 on 27 October 2026: checklist\n- -0.2 on 8 October 2026: checklist\n\n### Google Cloud Storage\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Box API + MCP.** Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. The status feed shows two majors in the 90 days to 1 November 2026, and the October SDK minor releases marked breaking changes without notice.\n\n**Google Cloud Storage.** IAM per bucket and MCP method, signed URLs, preconditions for safe retries and a 99.95 per cent multi-region SLA make it a well-governed object store for agents. The nine-tool MCP server has no read-only or destructive annotations, reads stop at 8 MiB, and a person must set up a project and billing first.\n\n## Before you call either\n\n### Box API + MCP\n\n1. Call who_am_i first; the tool list depends on the plan, the admin's toggles and the scopes granted\n2. Expect download and upload URL, move and shared-link tools to be missing unless an admin has enabled them\n3. Pin SDK versions. Minor releases on 1 and 15 October 2026 changed `CollaborationItem` types\n4. Pass fields= to trim responses and page folder listings with limit and marker\n5. Send a box-version header to pin an API version, and watch responses for a Deprecation header\n\n### Google Cloud Storage\n\n1. Grant the agent's service account only Storage Object Viewer or Creator on the bucket it needs\n2. Send ifGenerationMatch on writes and deletes so a retry can't overwrite a newer object\n3. Use a V4 signed URL to share an object rather than changing bucket access\n4. Read objects over 8 MiB through the JSON API with Range, not the MCP read_object tool\n5. Confirm with the user before delete_bucket or delete_object\n\n## Questions\n\n### Which is better for AI agents, Box API + MCP or Google Cloud Storage?\n\nGoogle Cloud Storage scores 76.7 (BB) on agent readiness against Box API + MCP's 66.5 (B), and leads in 6 of 7 scored categories. Box API + MCP leads on schema \u0026 documentation.\n\n### Do Box API + MCP and Google Cloud Storage need an API key?\n\nBoth use an OAuth sign-in.\n\n### Can an agent call Box API + MCP and Google Cloud Storage without installing anything?\n\nYes. Box API + MCP has a hosted endpoint at https://api.box.com/2.0 and Google Cloud Storage at https://storage.googleapis.com/storage/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage.json, and with the fewest tokens: https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"box-api\", \"b\": \"google-cloud-storage\"}`. From a terminal: `anchor compare box-api google-cloud-storage`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/box-api.json and https://www.anchorterminal.com/api/v1/tools/google-cloud-storage.json\n\n## Other comparisons with Box API + MCP or Google Cloud Storage\n\n- [Amazon S3 vs Box API + MCP](https://www.anchorterminal.com/compare/amazon-s3-vs-box-api.md)\n- [Azure Blob Storage vs Box API + MCP](https://www.anchorterminal.com/compare/azure-blob-storage-vs-box-api.md)\n- [Backblaze B2 vs Box API + MCP](https://www.anchorterminal.com/compare/backblaze-b2-vs-box-api.md)\n- [Box API + MCP vs Cloudflare R2](https://www.anchorterminal.com/compare/box-api-vs-cloudflare-r2.md)\n- [Box API + MCP vs DigitalOcean Spaces](https://www.anchorterminal.com/compare/box-api-vs-digitalocean-spaces.md)\n- [Box API + MCP vs Tigris](https://www.anchorterminal.com/compare/box-api-vs-tigris.md)\n- [Dropbox API + MCP vs Google Cloud Storage](https://www.anchorterminal.com/compare/dropbox-api-vs-google-cloud-storage.md)\n- [Fastio vs Google Cloud Storage](https://www.anchorterminal.com/compare/fast-io-vs-google-cloud-storage.md)\n- [Google Cloud Storage vs Google Drive API + MCP](https://www.anchorterminal.com/compare/google-cloud-storage-vs-google-drive-api.md)\n- [Google Cloud Storage vs ONLYOFFICE Apps MCP Server](https://www.anchorterminal.com/compare/google-cloud-storage-vs-onlyoffice-mcp.md)\n- [Amazon S3 vs Google Cloud Storage](https://www.anchorterminal.com/compare/amazon-s3-vs-google-cloud-storage.md)\n- [Azure Blob Storage vs Google Cloud Storage](https://www.anchorterminal.com/compare/azure-blob-storage-vs-google-cloud-storage.md)\n- [Backblaze B2 vs Google Cloud Storage](https://www.anchorterminal.com/compare/backblaze-b2-vs-google-cloud-storage.md)\n- [Bunny Storage vs Google Cloud Storage](https://www.anchorterminal.com/compare/bunny-storage-vs-google-cloud-storage.md)\n- [Cloudflare R2 vs Google Cloud Storage](https://www.anchorterminal.com/compare/cloudflare-r2-vs-google-cloud-storage.md)\n- [DigitalOcean Spaces vs Google Cloud Storage](https://www.anchorterminal.com/compare/digitalocean-spaces-vs-google-cloud-storage.md)\n- [Google Cloud Storage vs Tigris](https://www.anchorterminal.com/compare/google-cloud-storage-vs-tigris.md)\n- [Google Cloud Storage vs Wasabi Hot Cloud Storage](https://www.anchorterminal.com/compare/google-cloud-storage-vs-wasabi-hot-cloud-storage.md)\n- [Box API + MCP vs Dropbox API + MCP](https://www.anchorterminal.com/compare/box-api-vs-dropbox-api.md)\n- [Box API + MCP vs Fastio](https://www.anchorterminal.com/compare/box-api-vs-fast-io.md)\n- [Box API + MCP vs Google Drive API + MCP](https://www.anchorterminal.com/compare/box-api-vs-google-drive-api.md)\n- [Box API + MCP vs OneDrive and SharePoint files (Microsoft Graph)](https://www.anchorterminal.com/compare/box-api-vs-onedrive-sharepoint.md)\n- [Box API + MCP vs ONLYOFFICE Apps MCP Server](https://www.anchorterminal.com/compare/box-api-vs-onlyoffice-mcp.md)\n- [Google Cloud Storage vs OneDrive and SharePoint files (Microsoft Graph)](https://www.anchorterminal.com/compare/google-cloud-storage-vs-onedrive-sharepoint.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Box API + MCP vs Google Cloud Storage", "url": "" } ], "description": "Google Cloud Storage scores 76.7 (BB) to Box's 66.5 (B) for file sharing. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Box API + MCP B 66.5", "Google Cloud Storage BB 76.7", "scores" ], "h1": "Box API + MCP vs Google Cloud Storage", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/box-api-vs-google-cloud-storage", "published": "2026-10-01", "section": "tools", "title": "Box vs Google Cloud Storage for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/box-api-vs-google-cloud-storage" }, "tokens": { "markdown": 4850, "slim": 2980 }, "version": 1 }