According to Professor Willow, the Mystery Box was made by people who worshipped Melmetal to keep it safe. When the Pokémon splits itself into Meltan, they are stored in the box until it opened again in order for Melmetal to appear. The box will open when exposed to open air in a natural environment.
After receiving the Mystery Box, the player can access it from their Bag in Pokémon GO and choose to open the box. Once opened, a 60-minute timer will begin, during which wild Meltan will be appearing around the player. Meltan will be appearing only if the player has automatic time on in their device settings. The Meltan will stop appearing after the box's timer has expired.
The Mystery Box will then remain shut on a three-day countdown timer. Once the countdown reaches zero, the player can unlock the box again by transferring Pokémon from GO to Pokémon: Let's Go, Pikachu!, Let's Go, Eevee! via GO Park, or to Pokémon HOME via GO Transporter. Originally, players had to wait seven days to open the Mystery Box; the wait time has been permanently lowered to three to mark the second Shiny Meltan event that took place from April 24 to May 5, 2019. (Meltan that appear outside of these specific event windows cannot be shiny.)
The Mystery Box and Incense are mutually exclusive: if one is active, the other cannot be. Opening the Mystery Box also fulfills any requirements that involve using an Incense, such as with Field Research or evolving Spritzee.
Due to the COVID-19 pandemic, the Mystery Box, like with Incenses, had its effect duration doubled from 30 to 60 minutes, with the spawn rate increased. The spawn rate has since been reverted, but the increased duration became permanent.