According to Professor Willow, the Mystery Box was made by people who worshipped Melmetal to keep it safe. When the Pokémon splits itself into Meltan, they are stored in the box until it opened again in order for Melmetal to appear. The box will opened when exposed to open air in an natural environment.
After receiving the Mystery Box, the player can access it from their Bag in Pokémon GO and choose to open the box. Once opened, a 30-minute timer will begin, during which wild Meltan will be appearing around the player. The Meltan will stop appearing after the box's timer has expired. The Mystery Box will then remain shut on a seven-day countdown timer. Once the countdown reaches zero, the player can unlock the box by transferring Pokémon from GO to Pokémon: Let's Go, Pikachu! and Let's Go, Eevee!.
The Mystery Box and Incense are mutually exclusive: if one is active, the other cannot be.