Dropbox — can an agent use it?
Dropbox runs two official MCP servers and a mature REST API with full file CRUD, but the MCP path is interactive-consent-only with no headless refresh tokens, and no agent payment protocol exists. The cheapest grade-moving fix: publish a .well-known/mcp.json card and add an M2M OAuth grant so background agents can hold long-lived sessions.
FIND & RETRIEVE · 7.7
ACT & TRANSACT · 6.6
TRUST & DURABILITY · 8.0
FIND & RETRIEVE7.7/10Can an agent get correct information?
Machine-readable surface8/10
Comprehensive llms.txt (~60 indexed pages), sitemap referenced in robots.txt (sitemapindex.xml), JSON-LD with Organization/Offer/BreadcrumbList/ContactPoint. AI crawlers (GPTBot, ClaudeBot) not blocked. No markdown content negotiation or .well-known/mcp.json card despite running an official MCP server. source
Information retrieval quality7.5/10
Storage pricing clearly published: Plus EUR 9.99/mo (2 TB), Standard EUR 12/user/mo, Advanced EUR 18/user/mo, Basic free 2 GB. Feature comparison table renders in HTML. Dropbox Sign API tiers less discoverable from the main surface. 700M registered users stated on homepage. source
Documentation for machines7.5/10
Developer portal at dropbox.com/developers with SDKs in 6 languages (Swift, .NET, Java, JavaScript, Objective-C, Python), HTTP API reference, interactive API explorer (50B API calls/month across the platform), OAuth guide, performance guide, and webhooks documentation. Error handling returns HTTP 429 with Retry-After for rate limits. Could not verify a dated changelog or error taxonomy from the fetched evidence. source
ACT & TRANSACT6.6/10Can an agent do the job?
Action coverage9/10
Full CRUD on files and folders (create, read, edit, move, delete), sharing and shared links, file requests, webhooks for change detection, team administration, audit logs, team folders, file properties/metadata, and a separate eSignature API (Dropbox Sign). Nearly every meaningful UI action has an endpoint. source
Agent protocol support8/10
Two official MCP servers: (1) mcp.dropbox.com/mcp (open beta since March 2026, 23 tools covering file listing/search/content extraction/create/copy/move/delete/shared links/revisions) and (2) Dash MCP server for AI-powered cross-tool search. Status page monitors 'MCP Server' as a distinct component. Dynamic Client Registration for trusted clients (Claude Code, ChatGPT, Cursor). Loses benchmark grade because MCP is interactive-consent-only with no refresh token for background agents, file creation capped at 5 MB, no batch operations, and no team administration tools via MCP. source
Access & auth friction7/10
Self-serve OAuth 2.0 app creation at dropbox.com/developers/apps with PKCE support, scoped permissions, and user/team token types. MCP uses Dynamic Client Registration for a trusted client set. No M2M (Client Credentials) grant exists, so headless agents must use the offline refresh-token pattern. Manual app registration required for MCP clients outside the trusted set. source
Agent payment capability2/10
Dropbox sells paid subscriptions but has no agent payment protocol. No evidence of ACP, AP2, MPP, or x402 support. Subscription purchases and upgrades are human-initiated through hosted checkout pages. The API can manage some billing-adjacent operations but cannot programmatically purchase or upgrade a plan on an agent's behalf. source
Cost & rate fairness7/10
No separate API access fee; rate limits applied per-authorization (per-user for user links, per-team for team links via Business endpoints). HTTP 429 with Retry-After header. Limits described as 'not designed to inhibit normal applications' but exact thresholds are not publicly documented. Data transport call limits on Business plans are monthly and per-team. No agent-vs-human price discrimination. Free tier (2 GB) includes API access. source
TRUST & DURABILITY8.0/10Will it still work next quarter?
Permission & ToS stance7.5/10
The AUP bans 'scraping' and access via non-publicly-supported interfaces, but the API and MCP server are the publicly-supported interfaces, making programmatic use the intended path. robots.txt does not block AI crawlers. Official MCP server and homepage AI integrations (OpenAI, Anthropic partnerships) signal a pro-automation stance. No hostile enforcement history against legitimate API users. Minor deduction for the AUP's broadly-worded scraping clause. source
Reliability & continuity8.5/10
Atlassian Statuspage with 12 individually-monitored components including MCP Server, API, and Desktop/Mobile apps. 100% uptime over the last 90 days per independent monitors (OutageDeck, Aug 2026). Only 5 minor incidents in the recent window, average resolution 24h 51m. API has been stable since v2 launch (~2016), no major pricing overhauls or surprise deprecations. MCP still in 'open beta' introduces minor durability uncertainty. source
Sources
Point-in-time assessment — services change terms, prices and APIs often. That volatility is itself scored under Reliability & continuity. Re-verified at least quarterly.
- dropbox.com — Homepage: 700M registered users, AI integrations with OpenAI and Anthropic, product suite overview (accessed 2026-08-31)
- dropbox.com/plans — Pricing: Plus EUR 9.99/mo 2TB, Standard EUR 12/user/mo, Advanced EUR 18/user/mo, Basic free 2GB (accessed 2026-08-31)
- dropbox.com/terms — Terms of Service effective January 7, 2025 — standard cloud service terms, no explicit anti-automation clause for API users (accessed 2026-08-31)
- dropbox.com/acceptable_use — AUP: bans scraping and access via non-publicly-supported interfaces; API and MCP are the supported interfaces (accessed 2026-08-31)
- dropbox.com/robots.txt — Permits AI crawlers (no GPTBot/ClaudeBot blocks), explicitly allows /llms.txt, references sitemapindex.xml (accessed 2026-08-31)
- dropbox.com/llms.txt — Comprehensive llms.txt with ~60 indexed pages covering products, legal, pricing, developers, and integrations (accessed 2026-08-31)
- dropbox.com/developers — Developer platform: SDKs in 6 languages, REST API, API explorer, 50B API calls/month, OAuth guide, webhooks, Files/Sharing/Business/Events/Team Folders/File Properties APIs (accessed 2026-08-31)
- status.dropbox.com — Atlassian Statuspage: 12 components including MCP Server, 100% uptime last 90 days, all systems operational 31/08/2026 (accessed 2026-08-31)
- help.dropbox.com/integrations/connect-dropbox-mcp-s… — Official MCP server docs: mcp.dropbox.com/mcp, open beta since March 2026, DCR for trusted clients, 23 tools (accessed 2026-08-31)
- scalekit.com/blog/dropbox-mcp-vs-api — MCP vs API comparison: MCP 23 tools (interactive-consent-only, 5MB cap, no batch/webhooks/team admin); API covers large uploads (350GB), batch (1000 entries), webhooks, team management (accessed 2026-08-31)