shigechika-boxadmSAFE
MCP server for Box admin-log analytics — external-sharing visibility, read-only
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | 日本語
MCP (Model Context Protocol) server that surfaces external file flow from a Box admin's point of view. It reads Box's enterprise event log (admin_logs) to highlight "who shares a lot with the outside" and "which files get accessed from outside" — an early-warning signal for leakage, not a general-purpose file browser.
Documentation:
Read-only: it never revokes shares, deletes files, or otherwise mutates anything — it only surfaces risk. This is a different tool from a general-purpose Box file MCP (the official Box MCP, or the claude.ai Box connector): those operate on a user's own files and cannot see enterprise events, which is exactly what this server is for.
Named after the admin-console viewpoint (boxadm = Box admin), sibling of `gwsadm-mcp`.
Features
88ae37ca9ef3OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add boxadm-mcp -- None boxadm-mcp==0.10.0
Exposed tools (9)
9 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
daily_brief | read | Morning DLP brief: external access (events) + external-sharing state (enumeration). |
external_access_events | read | Surface external file access (DOWNLOAD / PREVIEW) from enterprise admin_logs. |
external_collaborators | read | List external collaborators on Box folders (current state, enumeration). |
get_user | read | Look up ONE Box account by its exact login (the account |
health_check | read | Report server version, Box connectivity/auth, and configuration. |
list_folder_items | read | List ONE Box folder |
public_shared_links | read | List items with an open ( |
recent_admin_events | read | Fetch recent enterprise ``admin_logs`` events (raw passthrough). |
top_external_sharers | read | Rank internal owners by their external exposure (enumeration). |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (3)
.release-please-manifest.json
probes_module = importlib.import_module(args.probes)
"../../admin",
Gates applied: no_behavioural_pass.
88ae37ca9ef3full audit observations/trust-audit/mcp-server/shigechika__boxadm-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 88ae37ca9ef3 | SAFE | B | 89 | first audit |
Questions
What is the shigechika-boxadm MCP server?
MCP server for Box admin-log analytics — external-sharing visibility, read-only
What tools does shigechika-boxadm expose?
9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is shigechika-boxadm safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does shigechika-boxadm need?
It reads BOX_AUTH_MODE, BOX_CLIENT_SECRET, BOX_OAUTH_REDIRECT_URI and BOX_TOKEN_CACHE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does shigechika-boxadm run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as boxadm-mcp.
How current is this page?
The grade is for one exact copy of the source (88ae37ca9ef3), read on 2026-10-14. The repository is watched and re-audited when it changes.