Atlas / MCP servers / amgadabdelhafez / Dropbox Integration

Dropbox IntegrationSAFE

Name: Dropbox Integration
Author: amgadabdelhafez

mcp/amgadabdelhafez/dropbox-integration

MCP server by amgadabdelhafez · Audited 2026-10-08

⚑ Report / re-scan Source ↗

MCP Server for Dropbox

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

25 18r · 4w · 3d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server that provides integration with Dropbox, allowing MCP-compatible clients to interact with Dropbox through a set of powerful tools.

Important Disclaimer: This project is not affiliated with, endorsed by, or sponsored by Dropbox. It is an independent integration that works with Dropbox's public API.

Quick Start
Installation
Authentication
Available Tools
Required Dropbox Permissions
Usage Examples
Development
License

Quick Start

Clone the repository
Run npm install to install dependencies
Run npm run build to build the project
Run npm run setup
Configure your MCP client to use the server

Prerequisites

Choose "Scoped access" API
Choose the access type your app needs
Name your app and click "Create app"
Under "Permissions", select the desired permissions for the actions you will be using, for example:
files.metadata.read
files.content.read
files.content.write
sharing.write
account_info.read
Add http://localhost as your redirect URI
Note your App key and App secret

Installation

Clone the repository

git clone https://github.com/your-username/dbx-mcp-server.git
cd dbx-mcp-server

Install dependencies and build

npm install
npm run build

Run the setup script

npm run setup

Add to MCP settings

Add the following to your MCP settings file:

{
"mcpServers": {
"dbx": {
"command": "node",
"args": ["/path/to/dbx-mcp-server/build/index.js"]
}
}
}

Authentication

The server uses OAuth 2.0

Read from source at commit 7c87610f8c63OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add dbx-mcp-server --env DROPBOX_ACCESS_TOKEN=${DROPBOX_ACCESS_TOKEN} --env DROPBOX_APP_KEY=${DROPBOX_APP_KEY} --env DROPBOX_APP_SECRET=${DROPBOX_APP_SECRET} --env MAX_TOKEN_REFRESH_RETRIES=${MAX_TOKEN_REFRESH_RETRIES} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "dbx-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "DROPBOX_ACCESS_TOKEN": "${DROPBOX_ACCESS_TOKEN}",
        "DROPBOX_APP_KEY": "${DROPBOX_APP_KEY}",
        "DROPBOX_APP_SECRET": "${DROPBOX_APP_SECRET}",
        "MAX_TOKEN_REFRESH_RETRIES": "${MAX_TOKEN_REFRESH_RETRIES}"
      }
    }
  }
}

Exposed tools (25)

18 read · 4 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`copy_item`	read	Copy a file or folder to a new location
`create_folder`	write	Create a new folder (integrates with Dropbox)
`dbx_help`	read	Get help with file operations and commands (integrates with Dropbox)
`delete_item`	destructive	Legacy delete operation (deprecated, use safe_delete_item instead)
`download_file`	read	Download a file to local disk and return the file path. Files are saved to the
`file1`	read	Path to the first file
`file2`	read	Path to the second file
`fileTypes`	read	Comma-separated list of file extensions to include (e.g.,
`file_compare`	read	Compare two files and highlight differences
`file_comparison`	read	Compare two files
`file_detail`	read	Provide detailed analysis of a specific file
`file_review`	read	Review files in a specified folder and provide analysis
`folder_review`	read	Review contents of a folder
`get_account_info`	read	Get information about the connected account (integrates with Dropbox)
`get_file_content`	read	Get the content of a file (integrates with Dropbox)
`get_file_metadata`	read	Get metadata for a file or folder
`get_sharing_link`	write	Create a shared link for a file or folder
`list_files`	read	List files in a folder (integrates with Dropbox)
`move_item`	write	Move or rename a file or folder
`operation`	destructive	The operation to review (e.g., delete, move, copy)
`path`	read	The file/folder path involved
`review_operation`	read	Review a file operation before executing it (integrates with Dropbox)
`safe_delete_item`	destructive	Safely delete a file or folder with recycle bin support, confirmation, and audit logging
`search_file_db`	read	Advanced search for files and folders with filtering capabilities (integrates with Dropbox)
`upload_file`	write	Upload a file (integrates with Dropbox)

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (4 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (7)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_item, operation, safe_delete_item

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius