Box
Connect an agent to Box folders, files, users, groups, and collaborations through Membrane’s CLI without hand-rolling OAuth refresh.
Overview
box is an agent skill for the Build phase that uses the Membrane CLI to authenticate and perform Box file, folder, user, group, and collaboration operations.
Install
npx skills add https://github.com/membranedev/application-skills --skill boxWhat is this skill?
- Box coverage: files, versions, folders, collaborations, web links, tasks, users, groups, events, and search.
- Membrane CLI handles tenant login, credential refresh, and action dispatch.
- Install via `npm install -g @membranehq/cli@latest` and `membrane login --tenant`.
- Free-tier Membrane accounts supported per skill compatibility note.
- MIT-licensed skill pointing to official Box developer docs.
- Membrane application skill metadata version 1.0
- Documented object areas include File, Folder, User, Group, Task, Event, and Search
Adoption & trust: 1.2k installs on skills.sh; 178 GitHub stars; 2/3 security scanners passed (skills.sh audits).
What problem does it solve?
You need your agent to read or change Box files and permissions, but Box OAuth, token refresh, and API surface area slow down shipping the actual feature.
Who is it for?
Indie developers building workflows or apps that must sync with Box for business customers already standardized on that CMIS.
Skip if: Builders who only need local disk sync, lack a Membrane account, or cannot allow network access from the agent environment.
When should I use this skill?
User wants to interact with Box data—folders, files, users, groups, or collaborations—or mentions Box with Membrane.
What do I get? / Deliverables
You run Membrane login once and invoke named Box actions from the CLI so agents can list, share, search, and manage Box objects consistently.
- Authenticated Membrane session for Box tenant
- Executed Box API actions (CRUD/search) via CLI commands
Recommended Skills
Journey fit
Box access is implemented during product build when you wire enterprise file storage into apps or internal automations. integrations is the correct shelf for Membrane-mediated Box API actions (folders, collabs, search, tasks).
How it compares
Membrane-backed Box CLI integration—not a self-contained MCP server you host without Membrane tenancy.
Common Questions / FAQ
Who is box for?
Solo and small-team developers using Claude Code, Cursor, or similar agents who integrate Box via Membrane instead of writing OAuth clients by hand.
When should I use box?
During Build when the user wants to create folders, manage collaborations, search Box, or sync file metadata while Membrane handles credentials.
Is box safe to install?
It requires network access and Membrane login tied to your tenant; check the Security Audits panel on this Prism page and scope Box grants to least privilege.
SKILL.md
READMESKILL.md - Box
# Box Box is a cloud-based content management and file sharing service. It's used by businesses of all sizes to securely store, access, and collaborate on files from anywhere. Think of it as a more business-focused alternative to Dropbox or Google Drive. Official docs: https://developer.box.com/ ## Box Overview - **File** - **File Version** - **Folder** - **Folder Collaboration** - **Web Link** - **Task** - **User** - **Group** - **Event** - **Search** Use action names and parameters as needed. ## Working with Box This skill uses the Membrane CLI to interact with Box. Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing. ### Install the CLI Install the Membrane CLI so you can run `membrane` from the terminal: ```bash npm install -g @membranehq/cli@latest ``` ### Authentication ```bash membrane login --tenant --clientName=<agentType> ``` This will either open a browser for authentication or print an authorization URL to the console, depending on whether interactive mode is available. **Headless environments:** The command will print an authorization URL. Ask the user to open it in a browser. When they see a code after completing login, finish with: ```bash membrane login complete <code> ``` Add `--json` to any command for machine-readable JSON output. **Agent Types** : claude, openclaw, codex, warp, windsurf, etc. Those will be used to adjust tooling to be used best with your harness ### Connecting to Box Use `membrane connection ensure` to find or create a connection by app URL or domain: ```bash membrane connection ensure "https://www.box.com/home" --json ``` The user completes authentication in the browser. The output contains the new connection id. This is the fastest way to get a connection. The URL is normalized to a domain and matched against known apps. If no app is found, one is created and a connector is built automatically. If the returned connection has `state: "READY"`, skip to **Step 2**. #### 1b. Wait for the connection to be ready If the connection is in `BUILDING` state, poll until it's ready: ```bash npx @membranehq/cli connection get <id> --wait --json ``` The `--wait` flag long-polls (up to `--timeout` seconds, default 30) until the state changes. Keep polling until `state` is no longer `BUILDING`. The resulting state tells you what to do next: - **`READY`** — connection is fully set up. Skip to **Step 2**. - **`CLIENT_ACTION_REQUIRED`** — the user or agent needs to do something. The `clientAction` object describes the required action: - `clientAction.type` — the kind of action needed: - `"connect"` — user needs to authenticate (OAuth, API key, etc.). This covers initial authentication and re-authentication for disconnected connections. - `"provide-input"` — more information is needed (e.g. which app to connect to). - `clientAction.description` — human-readable explanation of what's needed. - `clientAction.uiUrl` (optional) — URL to a pre-built UI where the user can complete the action. Show this to the user when present. - `clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically. After the user completes the action (e.g. authenticates in the browser), poll again with `membrane connection get <id> --json` to check if the state moved to `READY`. - **`CONFIGURATION_ERROR`** or **`SETUP_FAILED`** — something went wrong. Check the `error` field for details. ### Searching for actions Search using a natur