Dropbox API + MCP vs Google Cloud Storage

Dropbox API + MCP 60

Statuspage at status.dropbox.com with 12 components, the API and the MCP Server among them (20). history.atom, read on 1 November 2026, covers the 90 days from 3 August. One incident touches the API, "Dropbox is not working as expected for some users" on 21 August 2026 (13:18 to 15:12 UTC, Desktop Application, Mobile Application and API), partial and so minor. Website routes for some customers on 9 September, telephone support during an AWS outage on 3 and 4 September and Dropbox Protect on 25 and 26 August don't touch the API, and the 22 September and 13 October windows were announced maintenance. Minor incidents only (20). The performance guide says "Dropbox does not publish exact rate limits" (0). The guide says rate-limited responses always carry Retry-After in seconds and that the retries count against the limit, the error guide gives exponential backoff when the header is missing, and too_many_write_operations flags namespace write contention (15). No SLA found (0). The API is GA and the MCP server in open beta per its help page, updated 30 September 2026 (5). The 1 October reading of 12 rested on a window we could only partly read.

Google Cloud Storage 80

Google Cloud's status dashboard with a per-product incident feed (20). In the 90 days from 8 August, Cloud Storage appears in a high-severity incident on 20 August across 27 products (about 3 hours 40 minutes of timeouts and errors), a medium incident on 8 to 9 October with elevated upload and write errors, and a medium regional incident in europe-west2 on 20 October. One major outage (10). The request-rate guide gives numbers, no ramp-up needed below 1,000 writes or 5,000 reads a second per bucket, with gradual ramping above (15). The retry strategy page lists retryable responses, idempotent operations and preconditions that make writes safe to retry, and the client libraries back off exponentially (15). SLA with monthly uptime of 99.95 per cent for multi-region Standard and 99.9 per cent regional (10). Generally available, and the MCP server since 20 April 2026 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

Dropbox API + MCP 65

Closed service; the SDKs and the Stone spec are MIT (18). Privacy policy (posted 30 May 2025, deletion starts 30 days after an account is deleted) and developer terms (effective 1 March 2025) with named contracting entities; no DPA read (18). Deprecated routes marked in the spec, and the certificate change that broke old SDKs in January 2026 was announced on 26 June 2024, though the spec dropped the deprecated remove_file_member route on 21 October 2026 with no removal date given (15). The trust centre links a Dropbox sub-processor list, which returned only its title to our reader, and the privacy policy says data is stored in the United States and other locations (10).

Google Cloud Storage 85

Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.

Dropbox API + MCP 91

No OpenAPI, but the whole API is a public Stone spec, 276 routes with typed arguments, results and error unions, updated by a bot on 31 October 2026 (25). Docs at docs.dropboxapi.com with llms.txt indexes and a Markdown version of any page (10). Route descriptions say what a call does and how it fails, download_transform_output for example names the errors for an expired or foreign handle (16). Typed fields with length limits and unions in place of free-form JSON (15). 173 examples in files.stone alone and a typed error for every route (15). API v2, deprecated routes marked in the spec, but no human-written changelog beyond the developer blog (10).

Google Cloud Storage 81

The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.

Dropbox API + MCP 77

About 25 MCP tools, with no toolsets or read-only subset we could find (15). list_folder takes a limit and returns a cursor for list_folder/continue, and search takes max_results (20). Typed error tags such as path/not_found and retry_after an agent can act on (18). Upload sessions resume by offset, and writes can be conditional on a revision; MCP annotations unchecked (12). Official SDKs in Python, JavaScript, Java, .NET and Swift, but content endpoints take their arguments in a Dropbox-API-Arg header (12).

Google Cloud Storage 85

Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85.

Dropbox API + MCP 78

OAuth 2.0 with granular scopes per route (files.metadata.read, files.content.write, sharing.write and so on), short-lived access tokens with refresh tokens, and App folder apps limited to one folder (30). Read-only scopes and App folder access, and team admins can block app connections, but no documented confirmation for deletes (15). The MCP server reads file contents from shared folders into the model, and we found no prompt-injection guidance (3). Business teams get an audit log through the team_log routes; personal accounts see linked apps only (12). A paid bug bounty and a separate disclosure programme on Intigriti, named in www.dropbox.com/.well-known/security.txt, which lacks the RFC 9116 Contact and Expires fields. The trust centre lists Dropbox SOC 1, 2 and 3 reports for October 2024 to September 2025 and ISO 27001, 27017, 27018, 27701 and 22301 certificates (18 of 20, as dropbox-sign on the same programme). The 1 October note of 13 hadn't read the certifications.

Google Cloud Storage 85

IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85.

Dropbox API + MCP 35

No x402, MPP or L402 (0). The API and MCP server cost nothing beyond the account's plan, and plan prices are public (15). A free Basic account works with the API and the MCP server (20). A person signs in through OAuth, and production apps need Dropbox's approval (0).

Google Cloud Storage 30

No x402, MPP or L402 (0). Per-operation and per-GB prices public without login, though the regional storage table draws by script (20). Always Free covers 5 GB-months and small operation counts in three US regions, but a Google Cloud billing account is needed; whether a card is required wasn't confirmed today (10). A person creates the project and billing account in a browser (0). 0 + 20 + 10 + 0 = 30.