Microsoft MCP
Model Context Protocol servers for Microsoft 365.
Calendar ยท Contacts ยท OneDrive ยท Outlook ยท SharePoint โ on the official
@modelcontextprotocol/sdk,
over stdio or Streamable HTTP.
Model Context Protocol servers for Microsoft 365.
Calendar ยท Contacts ยท OneDrive ยท Outlook ยท SharePoint โ on the official
@modelcontextprotocol/sdk,
over stdio or Streamable HTTP.
| Calendar | `ms-calendar-mcp` | 9 |
| | Contacts | `ms-contacts-mcp` | 7 |
| | OneDrive | `ms-onedrive-mcp` | 9 |
| | Outlook | `microsoft-outlook-mcp` | 14 |
| | SharePoint | `ms-sharepoint-mcp` | 23 |
All tools are thin wrappers over the [Microsoft Graph](https://learn.microsoft.com/graph/) `v1.0` API.
## Layout
```
microsoft-mcp/
โโโ apps/ # one MCP server per Microsoft 365 product
โ โโโ calendar/
โ โโโ contacts/
โ โโโ onedrive/
โ โโโ outlook/
โ โโโ sharepoint/
โ โโโ src/
โ โโโ tools.ts # declarative tool definitions (schema + handler)
โ โโโ index.ts # run({ name, version }, tools)
โโโ packages/ # shared building blocks
โโโ core/ # MCP server bootstrap + dual transport (stdio / HTTP)
โโโ graph/ # Microsoft Graph HTTP client
โโโ validation/ # id / path / query sanitizers
โโโ logger/ # structured JSON logging (stderr-only โ stdio-safe)
```
A server is just a list of tools handed to `run()`:
```ts
// apps/calendar/src/index.ts
import { run } from "@microsoft-mcp/core";
import { tools } from "./tools.js";
void run({ name: "microsoft-calendar", version: "1.0.0", title: "Microsoft Calendar" }, tools);
```
```ts
// a single tool
defineTool({
name: "get_event",
description: "Get a single calendar event by ID.",
inputSchema: { event_id: z.string().describe("Event ID") },
confirmationPolicy: "never",
handler: ({ graph }, { event_id }) => {
validateId(event_id, "event_id");
return graph.request("GET", `/me/events/${event_id}`);
},
});
```
`confirmationPolicy` (`"always"` for mutating/destructive tools, `"never"` for read-only) is surfaced to clients as MCP `readOnlyHint` / `destructiveHint` annotations.
## Requirements
- Node.js >= 20
- pnpm 10 (`corepack enable`)
## Setup
```bash
pnpm install
pnpm build # build all servers (turbo) -> apps/*/dist/index.js
pnpm check-types # typecheck everything
```
## Tests & CI
```bash
pnpm test # run the vitest suite once
pnpm test:watch # watch mode
pnpm test:coverage # run with a v8 coverage report (-> coverage/)
```
Tests live next to the code as `*.test.ts` and run on TypeScript source directly (no build step). The shared `packages/*` are covered by unit and integration tests โ including a full Streamable-HTTP round-trip against a live server โ and CI enforces a coverage floor on them. Each `apps/*` server ships an invariant suite that locks its tool surface (unique snake_case names, valid schemas and confirmation policies).
Every push and pull request to `master` runs [CI](.github/workflows/ci.yml): typecheck โ build โ tests with coverage. The coverage badge is regenerated from the run.
## Authentication
You sign in **once** with your Microsoft account; the server then caches a refresh token and acquires access tokens silently from then on โ no pasting, no 1-hour expiry. Sign-in uses your own [Microsoft Entra ID](https://learn.microsoft.com/entra/identity-platform/quickstart-register-app) app registration (free) so the servers act on your behalf.
### 1. Register an Entra ID app (one time)
1. [Azure Portal](https://portal.azure.com) โ **Microsoft Entra ID** โ **App registrations** โ **New registration**. Name it anything; pick the **Supported account types** that fit (single-tenant, multi-tenant, and/or personal accounts).
2. **Authentication** โ **Add a platform** โ **Mobile and desktop applications** โ add redirect URI **`http://localhost`**, and set **Allow public client flows** to **Yes** (enables the `--device-code` fallback).
3. **API permissions** โ **Add a permission** โ **Microsoft Graph** โ **Delegated permissions** โ add the scopes for the servers you use (then **Grant admin consent** if your tenant requires it):
| Server | Delegated scopes |
| --- | --- |
| Calendar | `Calendars.ReadWrite` |
| Contacts | `Contacts.ReadWrite` |
| OneDrive | `Files.ReadWrite.All` |
| Outlook | `Mail.ReadWrite`, `Mail.Send` |
| SharePoint | `Sites.ReadWrite.All` |
All servers also use `User.Read`. (`offline_access` is requested automatically for refresh.)
4. Copy the **Application (client) ID**.
### 2. Sign in (one time per machine)
Set `MICROSOFT_CLIENT_ID`, then run the server's **`login`** command. A browser opens; after you consent, the token is cached under `~/.config/microsoft-mcp/`:
```bash
export MICROSOFT_CLIENT_ID=