How to set up the Dropbox MCP server

Dropbox stores and shares files, folders, and supported Dropbox Paper documents. Its hosted MCP server uses OAuth through dynamic client registration for supported clients; a custom OAuth app is only needed for another MCP client.

This guide covers the Dropbox side of an MCP connection. The agent template is the final deployment step, after the Dropbox authorization below is working.

Choose a connection method

Choose Dropbox's hosted OAuth flow when the MCP client is on the supported-client list. Otherwise register a scoped Dropbox OAuth app and provide its app key and secret to the MCP client. Dropbox's hosted MCP guide and OAuth guide cover the two paths.

Recommended: Hosted Dropbox MCP with OAuth

For supported MCP clients, use Dropbox's hosted server at https://mcp.dropbox.com/mcp. Dropbox uses OAuth with dynamic client registration for these clients, so do not create a custom app or manually issue a token first.

1. Confirm that your MCP client is in Dropbox's supported-client list.
2. Add the hosted endpoint https://mcp.dropbox.com/mcp in the client and choose OAuth when it asks for authentication.
3. Complete the Dropbox sign-in as a dedicated test identity that can access only the intended test files or shared folder.
4. Confirm that the client can read one known test file and cannot access a file that identity cannot open in Dropbox.

Dropbox's hosted MCP setup guide documents the supported clients, endpoint, and OAuth flow.

Alternative: Manual OAuth app for Dome or another MCP client

Dropbox's dynamic-registration flow works only for its supported MCP clients. Dome is not on that list, so connect it with a manually registered Dropbox app instead.

• In the Dropbox App Console, create an app with Scoped access and choose Full Dropbox.
• Under Permissions, enable only the individual scopes the server needs; begin with metadata and content reads before enabling write or sharing scopes. Do not enable files.permanent_delete for this connection: Dropbox automatically selects and locks the team-only team_data.member scope, which prevents a personal Dropbox account from authorizing the app. If that scope was selected, create a new app rather than trying to remove it.
• In the App Console's Settings page, add https://api.domesystems.ai/oauth/callback to OAuth 2 Redirect URIs and save the app. Dropbox compares this value exactly: do not add a trailing slash, use a different Dome URL, or substitute your own callback.
• Copy the app key and app secret from the app's Settings page. Enter them as the OAuth client ID and client secret in Dome's Dropbox MCP template; never put the secret in source control.
• Complete OAuth as the dedicated test identity. Review the permissions on Dropbox's consent screen and, where Dropbox offers it, reduce access to the intended account, team, or files.
• Reconnect after a scope change and verify the test identity cannot access content outside its intended boundary.

Dropbox's OAuth guide explains redirect URIs, refresh tokens, and scope changes.

Verify Dropbox MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that Dropbox MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved Dropbox boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

Use these checks when authorization or tool access does not work as expected.

• “Invalid redirect_uri” or “Error connecting app”: In the Dropbox App Console, open the app's Settings page and confirm that OAuth 2 Redirect URIs contains exactly https://api.domesystems.ai/oauth/callback. Save the change, then begin a fresh authorization from Dome; retrying the old browser page can preserve the failed request.
• Dropbox asks for a work account: The app has a team scope, usually team_data.member. Check whether files.permanent_delete was enabled: Dropbox selects and locks that team scope automatically. A personal Dropbox account cannot authorize it, so create a new app with only individual scopes, update the client ID and secret in Dome, and reconnect.
• Authorization succeeds but expected files are missing: Check whether the app uses app-folder access, whether the authorized identity owns or can access the files, and whether the relevant content scopes are enabled. This is normally an access-boundary issue rather than an OAuth failure.
• Permissions changed after connecting: Save the revised Dropbox permissions, disconnect or reconnect the Dome connection, and complete OAuth again so Dropbox issues a token with the new scopes.

Next steps

Deploy the Dropbox agent template to create a governed agent in Dome that can work with the approved files and folders, with the template's included model, tools, and rules.