Dropbox MCP | OAuth 2.0 Dropbox connector for AI agents

Tools your document agent reaches for on Dropbox, scoped per user.

CALL ANY TOOL

List and search files, download or upload content, create shared links, and inspect folder structure.

dropbox_file_requests_create

Create file requests

Create a Dropbox file request that allows others to upload files to a designated Dropbox folder.

Parameters

Name

Type

Required

Description

destination

string

Required

The Dropbox folder path where uploaded files will be saved.

title

string

Required

The title of the file request, shown to contributors.

deadline_allow_late_uploads

string

Optional

Whether to allow uploads after the deadline has passed.

deadline_deadline

string

Optional

Deadline date for submissions in ISO 8601 format (e.g., '2024-12-31T23:59:59Z').

description

string

Optional

A description of the file request, shown to contributors.

open

boolean

Optional

Whether the file request is open for submissions. Defaults to true.

dropbox_file_requests_delete

Delete file requests

dropbox_file_requests_get

Get file requests

dropbox_file_requests_list

List file requests

dropbox_file_requests_update

Update file requests

dropbox_files_copy

Copy files

dropbox_files_copy_batch

Batch files copy

dropbox_files_create_folder

Files create folder

dropbox_files_delete

Delete files

dropbox_files_delete_batch_check

Check files delete batch

dropbox_files_download

Download files

dropbox_files_get_metadata

Files get metadata

dropbox_files_get_temporary_upload_link

Files get temporary upload link

dropbox_files_list_folder

Files list folder

dropbox_files_list_revisions

Files list revisions

dropbox_files_move_batch

Batch files move

dropbox_files_restore

Restore files

dropbox_files_save_url_check_job_status

Files save url check job status

dropbox_files_search

Search files

dropbox_sharing_add_file_member

Sharing add file member

dropbox_sharing_check_share_job_status

Sharing check share job status

dropbox_sharing_get_folder_metadata

Sharing get folder metadata

dropbox_sharing_get_shared_link_metadata

Sharing get shared link metadata

dropbox_sharing_list_folder_members

Sharing list folder members

dropbox_sharing_list_received_files

Sharing list received files

dropbox_sharing_mount_folder

Sharing mount folder

dropbox_sharing_remove_file_member

Sharing remove file member

dropbox_sharing_share_folder

Sharing share folder

dropbox_sharing_unshare_file

Sharing unshare file

dropbox_users_get_current_account

Users get current account

For more tools, view docs.

Build your Agent

Drop the toolkit in, point it at the user, and your document agent can use Dropbox from the first run.

import { ScalekitClient } from "@scalekit-sdk/node";
import { DynamicStructuredTool } from "@langchain/core/tools";
import { createReactAgent } from "@langchain/langgraph/prebuilt";
import { z } from "zod";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["dropbox"], toolNames: ["dropbox_files_list", "dropbox_file_get", "dropbox_file_download"] },
  pageSize: 100,
});

const lcTools = tools.map((t) => new DynamicStructuredTool({
  name: t.tool.definition.name,
  description: t.tool.definition.description,
  schema: z.object({}).passthrough(),
  func: async (args) => {
    const { data } = await sk.tools.executeTool({
      toolName: t.tool.definition.name,
      identifier: "user_123",
      params: args,
    });
    return JSON.stringify(data);
  },
}));

const agent = createReactAgent({ llm, tools: lcTools });

import { ScalekitClient } from "@scalekit-sdk/node";
import OpenAI from "openai";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["dropbox"], toolNames: ["dropbox_files_list", "dropbox_file_get", "dropbox_file_download"] },
  pageSize: 100,
});

const llmTools = tools.map((t) => ({
  type: "function",
  function: {
    name: t.tool.definition.name,
    description: t.tool.definition.description,
    parameters: t.tool.definition.input_schema,
  },
}));

const resp = await openai.responses.create({
  model: "gpt-4o", input: prompt, tools: llmTools,
});

import { ScalekitClient } from "@scalekit-sdk/node";
import Anthropic from "@anthropic-ai/sdk";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["dropbox"], toolNames: ["dropbox_files_list", "dropbox_file_get", "dropbox_file_download"] },
  pageSize: 100,
});

const llmTools = tools.map((t) => ({
  name: t.tool.definition.name,
  description: t.tool.definition.description,
  input_schema: t.tool.definition.input_schema,
}));

const msg = await anthropic.messages.create({
  model: "claude-sonnet-4-6", max_tokens: 1024,
  tools: llmTools,
  messages: [{ role: "user", content: prompt }],
});

import { Agent } from "@google/adk/agents";
import {
  MCPToolset, StreamableHTTPConnectionParams,
} from "@google/adk/tools/mcp";

const toolset = new MCPToolset({
  connectionParams: new StreamableHTTPConnectionParams({
    url: "https://mcp.scalekit.com/dropbox",
    headers: { Authorization: `Bearer ${userScopedToken}` },
  }),
});

const agent = new Agent({
  name: "agent", model: "gemini-2.0-flash",
  tools: await toolset.getTools(),
});

Try these prompts

Paste any prompt into your agent to start using Dropbox.

Search & recall

Copy the prompt

Copied

Find all files matching [keyword].

Copy the prompt

Copied

List files in [folder path].

Copy the prompt

Copied

Get metadata for [file name].

Copy the prompt

Copied

Show all shared links in [folder].

Action & sharing

Copy the prompt

Copied

Upload [filename] to [folder path].

Copy the prompt

Copied

Create a shared link for [file] (view-only).

Copy the prompt

Copied

Download [file path].

Copy the prompt

Copied

Move [file] to [folder].

Folders & audits

Copy the prompt

Copied

List subfolders of [path].

Copy the prompt

Copied

Which files were edited this week?

Copy the prompt

Copied

Find files larger than 100MB in [folder].

Copy the prompt

Copied

List all files shared externally this month.

SEE HOW AUTH WORKS

Users authorize Dropbox once. Their credentials stay vaulted, every call is checked, and every action is logged.

Authorize

Your user connects

Dropbox

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Dropbox

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Dropbox

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Dropbox

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

Same per-user auth pattern across other document agents and MCP connectors. Working code, live demos, fork what fits.

GTM and RevOps Teams

Deal room sync

Pulls opportunity context from Salesforce, captures key decisions from Slack, and syncs a running summary to the deal room doc in Google Drive, but only when the deal actually changed.

People Ops and HR teams

Performance review collector

Collects review feedback from Airtable and Google Forms scoped to each manager's direct reports, writes per-employee summaries to Notion, and DMs the manager a Slack digest.

People Ops and HR teams

Offer letter routing agent

Drafts the offer in PandaDoc, blocks on the hiring manager's approval in Slack, then emails the candidate their e-signature link. Every call runs as the recruiter who triggered it, never a shared HR bot.

Support and Ops Teams

Support ticket automation agent

Fetches new Zendesk tickets, drafts a reply from Notion knowledge base articles, digests what it cannot answer to Slack, and archives the rest, acting as the support agent rather than a shared API key.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Files accessed from the wrong user identity

A shared Dropbox OAuth token looks fine in a demo. In production, every file download and shared link creation is attributed to the service account. Folder ACLs collapse. Scalekit resolves the actual user's token so file access runs under the right identity.

// shared OAuth token
token = "sl_dropbox_shared_xxx"
audit → bot_service_account
acl_filter → broken

// scalekit · per-user
token = resolve(user_id)
audit → user_abc
scope → enforced ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Dropbox today. Others tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Dropbox as the user or as a shared key?

As the user. Each workspace member authorizes once and Scalekit resolves their credential at request time. Audit logs attribute every action to that user, not a shared service account.

Where is the Dropbox oauth 2.0 stored?

In Scalekit's managed AES-256 token vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Tokens never appear in prompts, logs, or LLM context.

Can I limit what the agent is allowed to do in Dropbox?

Yes. Pass a tool name filter to listScopedTools so the document agent only sees the subset you authorize. Pre-API-call scope checks block out-of-policy actions before the request reaches Dropbox.

What happens when a user revokes Dropbox access?

The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.

Can the agent access team folders the user has since left or been removed from?

No. Access resolves the authorizing user's current Dropbox permissions at request time. Folders the user has left, had access revoked from, or was never shared with are not returned.

On this page

Tool and actions Framework Compatibility Starter Prompt Auth Lifecycle Try Other Agents Why Scalekit