Box API + MCP vs Tigris

Box API + MCP

Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. 20 status-feed entries between 7 July and 1 October 2026, two of them over two hours on uploads or multiple services.

Tigris

No egress fees, and one endpoint (t3.storage.dev) with region auto for every location. 16 status incidents between 4 July and 2 October 2026, including outages in US regions on 31 July and 2 August.

Box API + MCP

1. Call who_am_i first; the tool list depends on the plan, the admin's toggles and the scopes granted
2. Expect download and upload URL, move and shared-link tools to be missing unless an admin has enabled them
3. Pass fields= to trim responses and page folder listings with limit and marker
4. Send a box-version header to pin an API version, and watch responses for a Deprecation header
5. For a link that expires, set shared_link.unshared_at on a paid account; the free plan can't

Tigris

1. Point the AWS SDK at https://t3.storage.dev with region auto; the stdio MCP README still shows the older fly.storage.tigris.dev endpoint
2. Ask for an access key with a ReadOnly or ReadWrite role on one bucket rather than an org-wide key
3. Keep presigned URLs short; Tigris accepts up to 90 days
4. Don't call tigris_list_objects on a large bucket; it walks every object with no limit or prefix
5. Use @tigrisdata/iam 2.6.0 or later before writing policies with conditions