A Monday Dropbox digest
Every Monday at 9:00, list what is in my Dropbox /Shared folder, compare it with last week's list, and write me a short note naming the files that are new, the ones that changed, and the ones that disappeared.
Verified MCP server: Dropbox
The tool list below is a live capture from the running server; an authenticated tool call is still pending credentials.
The short answer
Last verified 2026-08-03
The Dropbox MCP server gives an AI assistant a set of Dropbox actions: listing a folder, uploading and downloading files, copying, moving and deleting them, reading metadata and contents, creating share links, and indexing PDFs into a local searchable database. Dropbox itself now runs an official remote MCP server, in open beta, which you point a client at and sign in to rather than install; this page is about the other kind, a community package that runs on your own Mac, dbx-mcp-server on npm, from an independent developer. We ran it. With obvious placeholder strings in the five environment variables it refuses to start without, it started, completed the MCP handshake and answered tools/list with all 25 tools, and the table below is that response, word for word. What we could not do is complete an authenticated call: the one real call we made, list_files, came back with the server's own message that no token data is available, printed in full further down, because reaching an account needs an app you create in the Dropbox App Console and a consent flow we did not run. Two things are worth knowing before you install it. All eight releases on npm went out inside a single afternoon on 2025-06-15 and nothing has shipped since, and the GitHub repository the package declares as its home now returns 404, so the source cannot be read and there is no issue tracker to report anything to. Last week it was downloaded 30 times. [1][2][3][4][7]
Verification
Method
We spawned the server with npx over stdio, with obvious placeholder strings in the five environment variables it refuses to start without, completed the MCP initialize handshake, and called tools/list: the 25 tools below are that response, word for word. We then made one real tools/call, list_files against the root of the account, and it failed, as it had to. The excerpt under the sample call is the exact error it returned: the server's own token check, saying authentication has not been completed. So the tool list is a measurement, and nothing on this page describes what a successful Dropbox call returns, because an authenticated call needs a Dropbox app you create yourself plus a consent flow we did not run. Three deliberate failure probes ran the same day and are quoted in full in troubleshooting: a start with no credentials at all, a call with a missing argument and a typoed tool name, and a call against a path that does not exist.
Startup banner
warn: Using default value for DROPBOX_RECYCLE_BIN_PATH: /.recycle_bin {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.565Z"}
warn: Using default value for DROPBOX_MAX_DELETES_PER_DAY: 100 {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.568Z"}
warn: Using default value for DROPBOX_RETENTION_DAYS: 30 {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.569Z"}
warn: Using default value for DROPBOX_ALLOWED_PATHS: / {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.569Z"}
warn: Using default value for DROPBOX_BLOCKED_PATHS: /.recycle_bin,/.system {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.569Z"}
info: Schema configuration loaded {"documentTypes":4,"path":"/Users/[REDACTED]/code/routines/.marketing-drafts/2026-08-03/mcp-batch-8-receipts/schema-config.json","service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.579Z","version":"1.0.0"}
info: Initializing database schema {"dbPath":"/Users/[REDACTED]/code/routines/.marketing-drafts/2026-08-03/mcp-batch-8-receipts/dbx-db/documents.db","service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.593Z"}
info: Database schema initialized successfully {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.610Z"}
info: Connecting to transport... {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.610Z"}
info: Dbx MCP server running on stdio {"service":"dropbox-mcp-server","timestamp":"2026-08-03T20:57:12.611Z"}One real tool call
tools/call list_files {"path": ""}MCP error -32600: No token data available. Please complete authentication first by visiting the authorization URL.
Real lines from the captured result: enough to prove the call answered.
Tools
The server answered tools/list with 25 tools on 2026-08-03. The names, descriptions and parameters below are its own words, copied from that response and never edited.
| Tool | What it does |
|---|---|
| list_filespath | List files in a folder (integrates with Dropbox) |
| upload_filepath*content* | Upload a file (integrates with Dropbox) |
| download_filepath* | Download a file to local disk and return the file path. Files are saved to the "downloads" directory. (Integrates with Dropbox) |
| safe_delete_itempath*userId*skipConfirmationretentionDaysreasonpermanent | Safely delete a file or folder with recycle bin support, confirmation, and audit logging |
| delete_itemDeprecatedpath* | Legacy delete operation (deprecated, use safe_delete_item instead) |
| create_folderpath* | Create a new folder (integrates with Dropbox) |
| copy_itemfrom_path*to_path* | Copy a file or folder to a new location |
| move_itemfrom_path*to_path* | Move or rename a file or folder |
| get_file_metadatapath* | Get metadata for a file or folder |
| search_file_dbquery*pathmax_resultsfile_extensionsfile_categoriesdate_rangeinclude_content_matchsort_byorder | Advanced search for files and folders with filtering capabilities (integrates with Dropbox) |
| get_sharing_linkpath* | Create a shared link for a file or folder |
| get_account_info | Get information about the connected account (integrates with Dropbox) |
| get_file_contentpath* | Get the content of a file (integrates with Dropbox) |
| dropbox_analyze_pdfpath*prompt*useThinkingmaxReasoningTokens | Analyze PDF files from Dropbox using Gemini 2.5 Flash AI model with custom prompts |
| dropbox_index_filepath* | Index a single PDF file with AI analysis for structured document management |
| dropbox_index_folderpathpathsrecursivebatchSizeexcludePathsexcludePatternsrespectGlobalExclusionsscopeToDirectories | Recursively index PDF files in one or multiple Dropbox folders with AI analysis. Supports targeted directory indexing and exclusion patterns. |
| dropbox_search_indexedquery*docTypelimit | Search indexed documents by content, type, or metadata |
| dropbox_document_stats | Get statistics and business intelligence from indexed documents |
| dropbox_team_info | Get Dropbox Business team configuration and detect team space support for accessing team folders like /Surge |
| get_schema_configdocumentType | View current schema configuration including document types, fields, and prompts |
| update_document_typetypeName*descriptionenabledfieldsprompt | Update an existing document type configuration including fields and prompts |
| add_document_typename*description*enabledfields*prompt | Add a new custom document type with fields and prompts |
| remove_document_typetypeName*confirm* | Remove a document type from the schema configuration |
| update_global_promptbasePromptclassificationguidelines | Update the global prompt configuration used for all document analysis |
| test_schema_prompt | Generate and preview the current analysis prompt without analyzing a document |
Parameters marked with * are required.
Setup
Copy the block for the app you use. Each one is the configuration this server was verified with.
Open the file ~/Library/Application Support/Claude/claude_desktop_config.json (in Claude Desktop: Settings, then Developer, then Edit Config) and add:
{
"mcpServers": {
"dropbox": {
"command": "npx",
"args": [
"-y",
"dbx-mcp-server"
],
"env": {
"DROPBOX_APP_KEY": "YOUR_DROPBOX_APP_KEY",
"DROPBOX_APP_SECRET": "YOUR_DROPBOX_APP_SECRET",
"DROPBOX_REDIRECT_URI": "http://localhost:3000/callback",
"TOKEN_ENCRYPTION_KEY": "YOUR_32_PLUS_CHARACTER_ENCRYPTION_KEY",
"OPENROUTER_API_KEY": "YOUR_OPENROUTER_API_KEY"
}
}
}
}All five rows have to be there. The first two are copied from the app you create in the Dropbox App Console, DROPBOX_REDIRECT_URI has to match the redirect URI you register there, and TOKEN_ENCRYPTION_KEY is a long random string you invent and keep, at least 32 characters. The fifth, OPENROUTER_API_KEY, is the one nobody expects: the server loads its PDF analysis module at startup and quits if that variable is missing, even if you never touch a PDF tool. Then quit and reopen Claude Desktop. This file now holds secrets, so treat it like one. [11][4][5]
One command in your terminal, with the five variables passed as -e flags:
claude mcp add dropbox -s user \ -e DROPBOX_APP_KEY=YOUR_DROPBOX_APP_KEY \ -e DROPBOX_APP_SECRET=YOUR_DROPBOX_APP_SECRET \ -e DROPBOX_REDIRECT_URI=http://localhost:3000/callback \ -e TOKEN_ENCRYPTION_KEY=YOUR_32_PLUS_CHARACTER_ENCRYPTION_KEY \ -e OPENROUTER_API_KEY=YOUR_OPENROUTER_API_KEY \ -- npx -y dbx-mcp-server
Everything after the double dash is the exact command Claude Code will run, and it is the command we ran in the verification run. The -s user flag makes the server available in every project instead of just this one; drop it if you would rather keep it local. [12][4]
Add to ~/.cursor/mcp.json for every project, or to .cursor/mcp.json inside one project:
{
"mcpServers": {
"dropbox": {
"command": "npx",
"args": [
"-y",
"dbx-mcp-server"
],
"env": {
"DROPBOX_APP_KEY": "YOUR_DROPBOX_APP_KEY",
"DROPBOX_APP_SECRET": "YOUR_DROPBOX_APP_SECRET",
"DROPBOX_REDIRECT_URI": "http://localhost:3000/callback",
"TOKEN_ENCRYPTION_KEY": "YOUR_32_PLUS_CHARACTER_ENCRYPTION_KEY",
"OPENROUTER_API_KEY": "YOUR_OPENROUTER_API_KEY"
}
}
}
}Cursor picks the file up on restart. Because the secrets sit in the file itself, use the global ~/.cursor/mcp.json rather than a project one you might commit by accident. [13][4]
No JSON file and no terminal. In Routines: Settings, then Assistant, then Connections, then Add MCP Server. Switch the form to Command (stdio) and enter:
Name Dropbox Command npx Arguments -y dbx-mcp-server Environment Variables DROPBOX_APP_KEY YOUR_DROPBOX_APP_KEY DROPBOX_APP_SECRET YOUR_DROPBOX_APP_SECRET DROPBOX_REDIRECT_URI http://localhost:3000/callback TOKEN_ENCRYPTION_KEY YOUR_32_PLUS_CHARACTER_ENCRYPTION_KEY OPENROUTER_API_KEY YOUR_OPENROUTER_API_KEY
The Arguments field splits on spaces, so keep it to exactly those three words. All five Environment Variables rows are needed: with any one of them missing the server exits before it says a word, which is the first error in the troubleshooting section. Click Test Connection first: a working server answers with its tool count, twenty-five for this one. [14][4]
No terminal needed
You can set this one up without ever opening Terminal, but not without a detour through Dropbox's developer site: the server talks to your account through an app you create there, so you collect two keys first and fill in a form second. Routines is a Mac app that runs MCP servers for you, and once this one is added its tools are available to your AI in chat and in scheduled routines.
01
Download the app from getroutines.ai/download, drag it to Applications, and sign in.
02
Go to dropbox.com/developers/apps and click Create app. Choose Scoped access, pick the access level you want, and give it a name. On the Permissions tab tick the ones the tools need, which are files.metadata.read, files.content.read, files.content.write, sharing.write and account_info.read, then submit. Back on Settings, add http://localhost:3000/callback as a redirect URI and copy the App key and App secret.
03
Click your account at the bottom of the sidebar and choose Settings. Open the Assistant section, then the Connections tab, scroll to MCP Servers, and click Add MCP Server.
04
Switch the form to Command (stdio): this server is a command that runs on your Mac, not a web address. Name it Dropbox. Command: npx. Arguments: -y dbx-mcp-server, exactly those three words, because the field splits on spaces.
05
DROPBOX_APP_KEY and DROPBOX_APP_SECRET are the two you copied. DROPBOX_REDIRECT_URI is http://localhost:3000/callback, matching what you added in the App Console. TOKEN_ENCRYPTION_KEY is a long random string you make up and keep somewhere safe, at least 32 characters. OPENROUTER_API_KEY is the surprise: the server loads its PDF analysis module at startup and refuses to run without that variable, so put a value there even if you never plan to analyse a PDF.
06
Click Test Connection: Routines starts the server and reports how many tools it found, twenty-five for this one. Then click Add Server. Be aware of what that count does and does not prove, because it is exactly where our own run stopped: it means the server started and answered, not that it can reach your Dropbox. Until you complete the authorization the server asks for, every tool call answers with the token error printed below. Once it is authorized, the tools work in chat; to let a scheduled routine use them, open the routine, find the Tools & connections card, and tick the server under Apps.
Routine ideas
Once the server is connected, a scheduled routine can use its tools while you are away. Copy a prompt, paste it into Routines, and pick a time.
Every Monday at 9:00, list what is in my Dropbox /Shared folder, compare it with last week's list, and write me a short note naming the files that are new, the ones that changed, and the ones that disappeared.
On the first of every month at 8:00, index the PDFs in my Dropbox /Invoices folder, then give me a table of every invoice added last month with its supplier, date and total, and flag any that look like duplicates.
Every Friday at 17:00, search my indexed Dropbox documents for contracts, list the ones with an end date in the next 90 days, and write the list to contracts-expiring.md with one line each on what renewing would involve.
Troubleshooting
Real errors captured during the verification run, printed exactly as the server returned them.
What you see
file:///Users/[REDACTED]/.npm/_npx/05b5b7e5ee941318/node_modules/dbx-mcp-server/build/src/config.js:20
throw new McpError(ErrorCode.InvalidParams, `Missing required environment variable: ${envVar}`);
^
McpError: MCP error -32602: Missing required environment variable: DROPBOX_APP_KEY
at validateConfig (file:///Users/[REDACTED]/.npm/_npx/05b5b7e5ee941318/node_modules/dbx-mcp-server/build/src/config.js:20:19)
at file:///Users/[REDACTED]/.npm/_npx/05b5b7e5ee941318/node_modules/dbx-mcp-server/build/src/config.js:27:5
at ModuleJob.run (node:internal/modules/esm/module_job:439:25)
at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:643:26)
at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5) {
code: -32602,
data: undefined
}
Node.js v24.18.0The fix
A variable is missing. The server checks its configuration while it is still loading, before it opens the connection your client is waiting on, so it dies with a Node crash dump instead of an MCP error your client can show you; we triggered this on purpose by starting it with nothing set. It names only the first variable it misses, which is why the fix is to supply all five at once: DROPBOX_APP_KEY, DROPBOX_APP_SECRET, DROPBOX_REDIRECT_URI, TOKEN_ENCRYPTION_KEY and OPENROUTER_API_KEY. The check that printed the crash above covers the first four only, so supplying just the one it named moves the same crash on to the next name. The fifth is not covered by that check at all: the PDF analysis module builds itself a moment later, while the server is still loading, and throws its own error if OPENROUTER_API_KEY is absent, so the process cannot start without it whether or not you ever analyse a document.
What you see
MCP error -32600: No token data available. Please complete authentication first by visiting the authorization URL.
The fix
This is the state our verification run was in, and it is the honest reason this page is marked as enumerated rather than fully verified. The five variables are enough for the server to start and describe itself; they are not enough for it to reach Dropbox. The app key and secret only identify the app that is asking. What is missing is the token that says you agreed, which the server stores itself after you complete the authorization flow it points you at in that very message. Create the app in the Dropbox App Console with the redirect URI you configured, complete the sign-in, and restart your MCP client. The same message comes back later if the stored token is deleted or your app is revoked.
What you see
MCP error -32600: No token data available. Please complete authentication first by visiting the authorization URL.
The fix
Not a coincidence, and worth knowing before you spend an hour on it: the server checks for a Dropbox token before it validates arguments and before it even looks up the tool name. We proved it three ways on the same day, the first two on one running server and the third on a fresh start a minute later: calling upload_file without its required content argument, calling a tool name that does not exist, and calling list_files against a path no account could have. All three returned the message above, identical each time. So while you are unauthenticated this one error means only that you are unauthenticated; it tells you nothing about whether the rest of your request was right. Finish the authorization first, then debug the call.
The fix
The npx command belongs to Node.js. If Node is not installed on your Mac, every client on this page fails at the spawn step before the server can say anything. Install Node from nodejs.org, restart your MCP client, and try again.
FAQ
It is a small program that gives an AI assistant a set of Dropbox actions: listing a folder, uploading and downloading files, copying, moving and deleting them, reading metadata and file contents, creating shared links, and a second layer that indexes PDFs into a local database you can then search by content or document type. It runs as a local process on your Mac and talks to your AI app over stdio, using a Dropbox app you create in your own account. The package is dbx-mcp-server on npm. [1][4]
Yes, and it is not the one on this page. Dropbox runs its own remote MCP server, in open beta, at https://mcp.dropbox.com/mcp: you point a supported client at that address and sign in with Dropbox, so there is nothing to install and no app key to paste into a config file, and Dropbox's help article documents its tool set, from ListFolder and GetFileContent through to GetTranscript and GetMarkdown. There is a second Dropbox one for Dash, its search product, at its own address. We did not run either, so nothing on this page is a measurement of them. What this page verifies is the other kind of server: a community package that runs as a process on your Mac and reaches your account through an app you create yourself. It is not the only one of those either, because npm carries other installable Dropbox servers we did not run, among them dropbox-analytics-mcp-server, which advertises a mode that reads public shared links with no credentials at all. What does still hold is that the Model Context Protocol project's own reference server collection has no Dropbox server in it. One naming warning while you are here: the project most often linked to by MCP directories is amgadabdelhafez/dbx-mcp-server on GitHub, which shares a name with the npm package on this page but is a different, unrelated project. It has 29 stars, was last pushed in July 2025, and installs only by cloning and building it yourself, so it cannot be run with npx and it is not what we verified here. [7][8][9][6][10]
We started the server, completed the MCP handshake and read the tool list off the wire; that part is measured, and the table above is the raw response, all 25 tools of it. We also made one real tool call, list_files on the root of the account, and it failed with the server's own message that no token data is available, because a real call needs a Dropbox app and a completed sign-in and we had neither. So the tool list is evidence, and nothing on this page describes what a successful Dropbox call returns. Every error we did get is printed in full in the troubleshooting section.
The running server exposes 25: files and folders (list_files, upload_file, download_file, create_folder, copy_item, move_item, get_file_metadata, get_file_content, safe_delete_item, plus the deprecated delete_item), search and sharing (search_file_db, get_sharing_link), account (get_account_info, dropbox_team_info), a PDF layer (dropbox_analyze_pdf, dropbox_index_file, dropbox_index_folder, dropbox_search_indexed, dropbox_document_stats) and the settings behind that layer (get_schema_config, add_document_type, update_document_type, remove_document_type, update_global_prompt, test_schema_prompt). The table above is the live tools/list output, word for word.
Decide that with the whole picture in front of you. Nothing here is a Dropbox password: you create an app in the Dropbox App Console and grant it named permissions, so the narrower you keep those permissions the less the server can do, and you can revoke the app from that same console at any moment. Against that, three real cautions. The tool set includes delete and overwrite, and safe_delete_item defaults to a recycle bin rather than a permanent delete, but the deprecated delete_item does not. Your app key and secret sit in a plain config file or a form field, so keep that file out of any repository. And TOKEN_ENCRYPTION_KEY, which encrypts the stored token, is only checked when the token is decrypted, not at startup: we ran the server with an eight-character key, far under the documented 32-character minimum, and it started and listed all 25 tools without a word of complaint. A clean start is not proof that key is valid. [5][4]
Because of the PDF layer. Three of the tools send documents to an AI model through OpenRouter for analysis, dropbox_analyze_pdf, dropbox_index_file and dropbox_index_folder, and two more read the local index those analyses build. The module that does the sending is constructed while the server is still loading, so it throws and takes the whole process down if OPENROUTER_API_KEY is missing, whether or not you ever call one of those tools. The package README does list the variable as required, so this is not a documentation gap; the trap is where it fires. The startup check that reports a missing variable covers the other four only, so a config holding four of the five looks correct right up to the moment the process dies with a different error, thrown from a module you never asked for. We found it by starting the server, watching it die, and reading the crash. Budget for it, since it means a second paid account on top of Dropbox if you actually use the PDF tools. [4]
The evidence says no, and you should weigh that before you build anything on it. All eight versions on npm, 1.0.0 through 1.3.2, were published on 2025-06-15 inside a window of under three hours, and nothing has shipped in the roughly fourteen months since. The GitHub repository the package declares as its home, olivierdebeuf/dbx-mcp-server, returns 404, and so does the account that owns it, so the source cannot be read and there is nowhere to file a bug. It was downloaded 30 times last week. None of that stops it working: the npm tarball still installs, still starts and still answers the protocol, which is what we measured on 2026-08-03. It does mean that anything that breaks, breaks permanently. [1][2][3]
Sources
Anything on this page we did not observe in the run is linked here, with the date we read it. The run itself is the receipt for the rest.
[1]
Latest version 1.3.2. All eight versions, 1.0.0 through 1.3.2, were published on 2025-06-15 between 18:08:45Z and 20:55:56Z. License MIT, author Olivier Debeuf De Rijcker, repository git+https://github.com/olivierdebeuf/dbx-mcp-server.git.
[2]
[3]
Returns {"message":"Not Found"}, as does https://api.github.com/users/olivierdebeuf. The repository the npm package declares does not resolve, so no stars, push date or issue tracker can be reported for it.
[4]
Read by running npm pack dbx-mcp-server and extracting the tarball, because the linked GitHub repository is gone. Documents the claude mcp add usage and lists five required environment variables, DROPBOX_APP_KEY, DROPBOX_APP_SECRET, DROPBOX_REDIRECT_URI, TOKEN_ENCRYPTION_KEY with a 32 character minimum, and OPENROUTER_API_KEY for the AI analysis, which it also covers in its own setup step.
[5]
Where the Scoped access app, its permissions and the http://localhost:3000/callback redirect URI are created, and where the App key and App secret are read.
[6]
No Dropbox server among the project's own reference servers. It says nothing about what Dropbox itself publishes.
[7]
Dropbox's own remote MCP server, at https://mcp.dropbox.com/mcp, described as in open beta and connected over HTTP with Dropbox OAuth, with Dynamic Client Registration for a listed set of clients. Article updated 2026-03-18. It documents the server's tools, among them ListFolder, GetFileMetadata, GetFileContent, GetUsageAndQuota, Search, CreateFile, CreateSharedLink, Copy, Move, Delete, GetTranscript and GetMarkdown. Not run for this page.
[8]
A second, separate Dropbox remote MCP server, for Dropbox Dash, at https://mcp.dropbox.com/dash, also over HTTP with OAuth. Article updated 2026-06-11. Not run for this page.
[9]
dropbox-analytics-mcp-server 0.4.7, MIT, published 2026-07-08, describes itself as reading public shared links without auth or browsing a private Dropbox with an OAuth refresh token. dropbox-mcp-server 2.2.2, published 2026-07-21, carries no license field. Both declare a bin and can be started with npx. Neither was run for this page.
[10]
A separate project sharing the same name: 29 stars, 21 forks, 1 open issue, MIT, not archived, last push 2025-07-16. Installs by git clone and build, is not published to npm, and was not the package verified on this page.
[11]
The claude_desktop_config.json shape and where the file lives.
[12]
The claude mcp add syntax for local stdio servers, including the -e flag for environment variables.
[13]
The mcp.json shape, the env block and the file locations.
[14]
How Routines runs one-click OAuth connectors and any MCP server.
This page describes Dropbox as it behaved in one dated run on one Mac. Versions move: if something here no longer matches what you see, the capture date at the top says how old the reading is.
Behind this directory
Routines, the app behind this directory, runs MCP servers like this one without a terminal: see how connectors work. Your notes stay markdown files on your Mac, there is no cloud bill, and it works offline. Download Routines