Add Box Tools plugin (box_tools) v0.0.1

[kota-maeda0708]

Plugin Submission

Plugin information

• Author: kota-maeda0708
• Plugin name: Box (box_tools)
• Version: 0.0.1
• Source repository: https://github.com/kota-maeda0708/dify-plugin-box-tools
• Contact: kottyy2785@gmail.com

Submission type

• New plugin
• Version update

What changed

New tool plugin for Box cloud content management. It lets Dify
workflows and agents work with files and folders in Box through the Box REST API v2:

• list_files – list the contents of a folder
• search_files – search files/folders by keyword
• upload_file – upload a new file (accepts a Dify file input, or plain text / base64 content)
• download_file – download a file, returned as a Dify file usable by downstream nodes
• create_folder – create a folder
• delete_item – delete a file or folder
• move_rename_item – move and/or rename a file or folder

Two authentication methods are supported on the same provider:

• OAuth 2.0 (User Authentication, authorization code + refresh token)
• Secret Key (Client Credentials Grant / Server Authentication, no interactive redirect)

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

The plugin performs file operations (list/search/upload/download/create/delete/move/rename)
against a user's Box account and transmits file content between Dify and Box. All requests go
to fixed Box HTTPS endpoints (api.box.com, upload.box.com, account.box.com). Credentials
(OAuth tokens, or Client ID/Secret + Subject ID for CCG) are stored encrypted by the Dify
platform and only used to authenticate to Box. No data is sent to any third party other than
Box. See PRIVACY.md. No command execution, code execution, SQL, SSH/SFTP, browser automation,
arbitrary URL fetching, or handling of health/financial/biometric data.

Local validation

• dify plugin package . → packaged successfully (box_tools-0.0.1.difypkg, no .git/.venv/__pycache__/.env).
• Python syntax + import checks pass for box_client.py, provider/box_tools.py, and all 7 tools.
• All YAML files parse; plugin runtime boots and logs Installed tool: box_tools.
• Manually verified against a real Box Enterprise account: OAuth 2.0 authorization, credential
  validation, and file operations (list + download/upload of files) work end to end.

Reviewer notes

• Known limitations for this v0: uploads use Box's simple-upload endpoint (max ~50MB); download
  refuses files over 100MB to avoid excessive memory use. These are documented in the README.
• Source repository: https://github.com/kota-maeda0708/dify-plugin-box-tools

[crazywoola]

✅ LGTM

Decision: Approve

Local Check Results

Check	Status	Detail	Required action
PR content language	✅ Pass	PR title/body CJK ratio=0.0% (zh=0, en=2970, ignored_zh=0, allowed_zh<=0)	None.
Project structure	✅ Pass	All expected files present: manifest.yaml, README.md, PRIVACY.md. _assets/: yes.	None.
Manifest author	✅ Pass	author is valid.	None.
Icon validation	✅ Pass	icon exists: _assets/icon.svg	None.
Version check	✅ Pass	version 0.0.1 is available.	None.
README language	✅ Pass	README.md CJK ratio=0.0% (zh=0, en=2729, allowed_zh<=0)	None.
PRIVACY.md	✅ Pass	PRIVACY.md exists and is non-empty.	None.
Dependency install	✅ Pass	requirements installed successfully.	None.
dify_plugin version	✅ Pass	dify_plugin version 0.10.0 satisfies >= 0.9.0.	None.
Install test	✅ Pass	plugin install test passed.	None.
Packaging test	✅ Pass	packaging check passed.	None.