![\"Outlook\"](\".github/assets/icons/outlook.png\"){kind=icon}
![\"Calendar\"](\".github/assets/icons/calendar.png\"){kind=icon}
![\"OneDrive\"](\".github/assets/icons/onedrive.png\"){kind=icon}
![\"SharePoint\"](\".github/assets/icons/sharepoint.png\"){kind=icon}
![\"Contacts\"](\".github/assets/icons/contacts.png\"){kind=icon}
\n\nMicrosoft MCP
\n\n\n Model Context Protocol servers for Microsoft 365.
\n Calendar · Contacts · OneDrive · Outlook · SharePoint — on the official\n @modelcontextprotocol/sdk,\n over stdio or Streamable HTTP.\n
\n\n\n Model Context Protocol servers for Microsoft 365.
\n Calendar · Contacts · OneDrive · Outlook · SharePoint — on the official\n @modelcontextprotocol/sdk,\n over stdio or Streamable HTTP.\n
| Calendar | `ms-calendar-mcp` | 9 |\n| | Contacts | `ms-contacts-mcp` | 7 |\n| | OneDrive | `ms-onedrive-mcp` | 9 |\n| | Outlook | `microsoft-outlook-mcp` | 14 |\n| | SharePoint | `ms-sharepoint-mcp` | 23 |\n\nAll tools are thin wrappers over the [Microsoft Graph](https://learn.microsoft.com/graph/) `v1.0` API.\n\n## Layout\n\n```\nmicrosoft-mcp/\n├── apps/ # one MCP server per Microsoft 365 product\n│ ├── calendar/\n│ ├── contacts/\n│ ├── onedrive/\n│ ├── outlook/\n│ └── sharepoint/\n│ └── src/\n│ ├── tools.ts # declarative tool definitions (schema + handler)\n│ └── index.ts # run({ name, version }, tools)\n└── packages/ # shared building blocks\n ├── core/ # MCP server bootstrap + dual transport (stdio / HTTP)\n ├── graph/ # Microsoft Graph HTTP client\n ├── validation/ # id / path / query sanitizers\n └── logger/ # structured JSON logging (stderr-only — stdio-safe)\n```\n\nA server is just a list of tools handed to `run()`:\n\n```ts\n// apps/calendar/src/index.ts\nimport { run } from \"@microsoft-mcp/core\";\nimport { tools } from \"./tools.js\";\n\nvoid run({ name: \"microsoft-calendar\", version: \"1.0.0\", title: \"Microsoft Calendar\" }, tools);\n```\n\n```ts\n// a single tool\ndefineTool({\n name: \"get_event\",\n description: \"Get a single calendar event by ID.\",\n inputSchema: { event_id: z.string().describe(\"Event ID\") },\n confirmationPolicy: \"never\",\n handler: ({ graph }, { event_id }) => {\n validateId(event_id, \"event_id\");\n return graph.request(\"GET\", `/me/events/${event_id}`);\n },\n});\n```\n\n`confirmationPolicy` (`\"always\"` for mutating/destructive tools, `\"never\"` for read-only) is surfaced to clients as MCP `readOnlyHint` / `destructiveHint` annotations.\n\n## Requirements\n\n- Node.js >= 20\n- pnpm 10 (`corepack enable`)\n\n## Setup\n\n```bash\npnpm install\npnpm build # build all servers (turbo) -> apps/*/dist/index.js\npnpm check-types # typecheck everything\n```\n\n## Tests & CI\n\n```bash\npnpm test # run the vitest suite once\npnpm test:watch # watch mode\npnpm test:coverage # run with a v8 coverage report (-> coverage/)\n```\n\nTests live next to the code as `*.test.ts` and run on TypeScript source directly (no build step). The shared `packages/*` are covered by unit and integration tests — including a full Streamable-HTTP round-trip against a live server — and CI enforces a coverage floor on them. Each `apps/*` server ships an invariant suite that locks its tool surface (unique snake_case names, valid schemas and confirmation policies).\n\nEvery push and pull request to `master` runs [CI](.github/workflows/ci.yml): typecheck → build → tests with coverage. The coverage badge is regenerated from the run.\n\n## Authentication\n\nYou sign in **once** with your Microsoft account; the server then caches a refresh token and acquires access tokens silently from then on — no pasting, no 1-hour expiry. Sign-in uses your own [Microsoft Entra ID](https://learn.microsoft.com/entra/identity-platform/quickstart-register-app) app registration (free) so the servers act on your behalf.\n\n### 1. Register an Entra ID app (one time)\n\n1. [Azure Portal](https://portal.azure.com) → **Microsoft Entra ID** → **App registrations** → **New registration**. Name it anything; pick the **Supported account types** that fit (single-tenant, multi-tenant, and/or personal accounts).\n2. **Authentication** → **Add a platform** → **Mobile and desktop applications** → add redirect URI **`http://localhost`**, and set **Allow public client flows** to **Yes** (enables the `--device-code` fallback).\n3. **API permissions** → **Add a permission** → **Microsoft Graph** → **Delegated permissions** → add the scopes for the servers you use (then **Grant admin consent** if your tenant requires it):\n\n | Server | Delegated scopes |\n | --- | --- |\n | Calendar | `Calendars.ReadWrite` |\n | Contacts | `Contacts.ReadWrite` |\n | OneDrive | `Files.ReadWrite.All` |\n | Outlook | `Mail.ReadWrite`, `Mail.Send` |\n | SharePoint | `Sites.ReadWrite.All` |\n\n All servers also use `User.Read`. (`offline_access` is requested automatically for refresh.)\n4. Copy the **Application (client) ID**.\n\n### 2. Sign in (one time per machine)\n\nSet `MICROSOFT_CLIENT_ID`, then run the server's **`login`** command. A browser opens; after you consent, the token is cached under `~/.config/microsoft-mcp/`:\n\n```bash\nexport MICROSOFT_CLIENT_ID=