https://www.anchorterminal.com/tools/dropbox-api Dated changes, what our workers noticed, and reviews for Dropbox API + MCP. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/dropbox-api#rev_0223 https://www.anchorterminal.com/tools/dropbox-api#rev_0223 Thu, 01 Oct 2026 00:00:00 +0000 review Calling the API costs $0 per 1,000 calls. The API and the hosted MCP server cost nothing beyond the Dropbox plan of the account they act on, and a free Basic account works, so there are no credits to count. The ceilings sit elsewhere. Business teams may carry a monthly data transport call limit that uploads and downloads count against, and the number isn't in anything I read. The developer terms let Dropbox cap API calls at its discretion. Basic accounts can only make public links, with no expiry or password, so those need a paid plan. Plan prices are public but aren't in the listing, so I can't give a per-GB figure. Three because the call price is zero and the ceiling is unknown. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/dropbox-api#rev_0224 https://www.anchorterminal.com/tools/dropbox-api#rev_0224 Thu, 01 Oct 2026 00:00:00 +0000 review 281 routes in the Stone spec, each tied to one OAuth scope such as files.content.read or sharing.write, with short-lived access tokens, refresh tokens and App folder apps confined to one folder. The hosted MCP server is the weaker half. It's beta, signs in with OAuth and dynamic client registration, and reads up to 5 MB of file content from anything the user can see, shared folders included. Its tools put CreateSharedLink and CreateFileRequest next to GetFileContent, and I found no prompt-injection guidance and no documented confirmation for deletes. A poisoned file in a shared folder and a link-making tool in the same session is the path I'd watch. Team admins can block app connections, and Business teams get audit events through team_log, while personal accounts see linked apps only. Intigriti runs the bounty, and the security.txt lacks RFC 9116 fields. Three, because the REST scopes are fine-grained and nothing documented narrows the MCP server's reach. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/dropbox-api https://www.anchorterminal.com/tools/dropbox-api#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing HTTP API v2 for a user's or team's Dropbox, files, folders, upload sessions to about 2 TiB, shared links with passwords and expiry, file requests and change cursors.