mcp-microsoft-todo

🇫🇷 Version française : README.fr.md

MCP server to drive Microsoft To Do from Claude Code, Claude Desktop, or any MCP-compatible client.

Works with any Microsoft account: personal (outlook.com, hotmail.com, live.com), Office 365 personal or business, Microsoft 365. Zero Azure setup required on the user side — just sign in via device code flow.

🏗 Built and maintained by MAG&Cie

This MCP server is open-source and free to use. It's also a showcase of our Création de MCP offering at MAG&Cie — we build custom MCP connectors for businesses that want to plug AI into their internal tools (CRM, ERP, custom APIs, internal databases).

If you'd like the same kind of connector for your tools — drop us a line at www.mag-cie.com/creation-mcp.

🚀 End-user installation

Prerequisites (all clients)

• Node.js 20+ (nodejs.org)
• A Microsoft account (free or paid)

No Azure account required, no App Registration to create, nothing to compile.

🟦 Claude Code (CLI)

Install (one command):

claude mcp add --transport stdio microsoft-todo -- npx -y @mag-cie/mcp-microsoft-todo

If you have a personal Microsoft account (outlook.com, hotmail.com, live.com, msn.com, Office 365 personal), add MS_TENANT=consumers:

claude mcp add --transport stdio microsoft-todo --env MS_TENANT=consumers -- npx -y @mag-cie/mcp-microsoft-todo

Verify it's wired up:

claude mcp list

First use — recommended: pre-auth in a terminal first to avoid the "stuck on first MCP call" issue (where the device code is printed to MCP stderr but Claude Code doesn't surface it):

# macOS / Linux
MS_TENANT=consumers npx -y @mag-cie/mcp-microsoft-todo@latest --auth

# Windows PowerShell
$env:MS_TENANT="consumers"; npx -y @mag-cie/mcp-microsoft-todo@latest --auth

You'll see:

To sign in, use a web browser to open the page https://www.microsoft.com/link and enter the code XXXXXXXXX

Visit the URL, enter the code, sign in. The token is cached in ~/.mcp-microsoft-todo/token-cache.json and refreshed automatically — you'll never have to do this again. Now go to Claude Code and any prompt that calls a tool will work instantly.

Skip the pre-auth step if you're feeling lucky — the MCP will trigger the device code flow on first call too. The code goes to the Claude Code MCP log file (look in %USERPROFILE%\.claude\logs\ on Windows or ~/.claude/logs/ elsewhere).

Update to the latest version:

claude mcp remove microsoft-todo
claude mcp add --transport stdio microsoft-todo -- npx -y @mag-cie/mcp-microsoft-todo@latest

The -y flag of npx auto-accepts the download. Without @latest, npx may serve a stale cached version.

Uninstall:

claude mcp remove microsoft-todo
# Purge the token cache:
rm -rf ~/.mcp-microsoft-todo

🟪 Claude Desktop (app)

1. Locate the config file:

On Windows, you can open it directly with:

notepad $env:APPDATA\Claude\claude_desktop_config.json

If the file doesn't exist, create it with an empty JSON object {} then edit.

2. Add the config:

{
  "mcpServers": {
    "microsoft-todo": {
      "command": "npx",
      "args": ["-y", "@mag-cie/mcp-microsoft-todo"]
    }
  }
}

For a personal Microsoft account, add env:

{
  "mcpServers": {
    "microsoft-todo": {
      "command": "npx",
      "args": ["-y", "@mag-cie/mcp-microsoft-todo"],
      "env": { "MS_TENANT": "consumers" }
    }
  }
}

To localize the compact-format strings (optional, see Localization):

{
  "env": { "MS_TENANT": "consumers", "MCP_LOCALE": "fr" }
}

3. Restart Claude Desktop COMPLETELY (not just close the window):

• Windows: right-click systray icon → Quit, then relaunch
• macOS: ⌘+Q then relaunch

4. Verify it's wired up:

In Claude Desktop, look at the 🔌 plug or 🔧 tools icon at the bottom right of the input area — you should see microsoft-todo listed.

5. First auth — recommended pre-auth in a terminal:

# macOS / Linux
MS_TENANT=consumers npx -y @mag-cie/mcp-microsoft-todo@latest --auth

# Windows PowerShell
$env:MS_TENANT="consumers"; npx -y @mag-cie/mcp-microsoft-todo@latest --auth

You'll see the device code immediately in the terminal. Visit the URL, enter the code, sign in. Token cached. Now Claude Desktop will reuse this cache — no need to fish in the logs.

Without --auth, the device code goes to the Claude Desktop MCP log file:

• Windows: %APPDATA%\Claude\logs\mcp-server-microsoft-todo.log
• macOS: ~/Library/Logs/Claude/mcp-server-microsoft-todo.log

Update: edit the version in args (@mag-cie/mcp-microsoft-todo@latest), restart Claude Desktop. Or let npx do its thing (npx cache ~24h).

🟧 Cursor / Continue / other stdio MCP clients

Any MCP client that supports the stdio transport works the same way. Generic format:

command: npx
args: -y @mag-cie/mcp-microsoft-todo
env: MS_TENANT=consumers (if personal account)

Adapt to the client's config format (often JSON or TOML similar to Claude Desktop).

💡 Example prompts

Once installed, just ask Claude in natural language. Sample prompts that exercise the main tools:

🆘 Auth troubleshooting

🛠 Available tools (28)

Safety column legend: read = read-only, write = mutates state (non-idempotent create), update = idempotent mutation (safe to retry), delete = destructive (data loss). See Safety annotations below for details.

Lists & tasks

Batch operations (saves API calls)

Sub-tasks (checklist items)

Linked resources (external URLs attached to a task)

Open extensions (custom JSON metadata)

Cross-list helpers

Export

Output format

By default, tools return a compact text format (one line per item) to save LLM tokens. Legend:

• [!] high importance, [?] low (nothing if normal)
• [v] completed, [>] in progress, [w] waiting, [d] deferred (nothing if not started)
• due:, rem:, rec:, cat:, body: fields shown only when populated

To get the full Graph JSON, pass verbose: true to any read tool.

🔐 Safety annotations

Every tool exposed by this server carries the MCP tool annotations defined by the Model Context Protocol spec (2025-06-18):

These hints are advisory — the server itself enforces nothing — but MCP clients (Claude Code, Claude Desktop, Cursor, …) can use them to:

• Auto-approve readOnlyHint: true calls without prompting (faster UX for read-heavy workflows)
• Show a confirmation dialog before destructiveHint: true calls (e.g. delete_task, batch_delete_tasks, move_task)
• Retry on transient failures only when idempotentHint: true
• Display the friendly title instead of the snake_case name

The full mapping is in src/index.ts (ANNOTATIONS constant). Summary by safety class (see also the per-tool Safety column above):

• read (15 tools): all list_*, get_*, search_*, summarize_*, export_* — readOnlyHint: true
• write (4 tools): create_*, batch_create_tasks — destructiveHint: false, idempotentHint: false
• update (5 tools): update_*, complete_*, set_extension, bulk_update_categories, batch_complete_tasks — destructiveHint: false, idempotentHint: true
• delete (5 tools): delete_*, batch_delete_tasks, move_task — destructiveHint: true, idempotentHint: true

move_task is classified as delete because it deletes the source task (a new task is created in the target list with a different id).

🌍 Localization

The MCP works in any language out of the box — Claude reads the data the server returns and replies to the user in whatever language they prompted in. Try "List my tasks", "Liste mes tâches", "Zeig meine Aufgaben", "我的任务" — all work.

Optionally, you can localize the compact-format short labels returned by the server itself (No tasks., Due today:, Overdue:, Task X deleted., etc.) — this is a marginal improvement (saves a few tokens, slightly cleaner LLM context). Set MCP_LOCALE in your env:

Resolution order: MCP_LOCALE → LC_ALL → LANG → fallback en. Only the first 2 chars are inspected (so fr_FR.UTF-8 works). Unsupported locale → falls back to en.

{
  "mcpServers": {
    "microsoft-todo": {
      "command": "npx",
      "args": ["-y", "@mag-cie/mcp-microsoft-todo"],
      "env": { "MCP_LOCALE": "fr" }
    }
  }
}

🔒 Security & privacy

• The Microsoft token is stored only on your machine in ~/.mcp-microsoft-todo/token-cache.json
• No data transits through MAG&Cie servers
• Revoke access at any time at https://account.live.com/consent/Manage
• To purge the local token: rm -rf ~/.mcp-microsoft-todo

Graph permissions requested: Tasks.ReadWrite, Tasks.ReadWrite.Shared, offline_access.

🧑‍💻 Developer setup (fork / contribution)

If you fork or want to develop locally with your own Azure AD App Registration:

1. Azure AD App Registration (maintainer/fork side only)

1. https://portal.azure.com → Microsoft Entra ID → App registrations → New registration
2. Name: mcp-microsoft-todo (free choice)
3. Supported account types: Accounts in any organizational directory and personal Microsoft accounts
4. Redirect URI: leave empty
5. Register
6. Note the Application (client) ID
7. Authentication tab → Allow public client flows: Yes
8. Authentication tab → Add a platform → Mobile and desktop applications → check https://login.microsoftonline.com/common/oauth2/nativeclient
9. API permissions tab → Add a permission → Microsoft Graph → Delegated → add Tasks.ReadWrite, Tasks.ReadWrite.Shared, and offline_access. Grant admin consent if on a corporate tenant.

2. Build and local auth

git clone https://github.com/MAG-Cie/mcp-microsoft-todo
cd mcp-microsoft-todo
npm install
npm run build
export MS_CLIENT_ID="<your-client-id>"   # PowerShell: $env:MS_CLIENT_ID="..."
export MS_TENANT="common"
npm run auth

The token cache will be written to ~/.mcp-microsoft-todo/token-cache.json.

3. Wire up Claude Code (local build)

# Windows PowerShell
$env:MS_CLIENT_ID="<your-client-id>"
claude mcp add --transport stdio microsoft-todo -- node "C:\path\to\mcp-microsoft-todo\dist\index.js"

# macOS / Linux
export MS_CLIENT_ID="<your-client-id>"
claude mcp add --transport stdio microsoft-todo -- node /path/to/mcp-microsoft-todo/dist/index.js

⚠️ Env vars must be visible at spawn time. On Windows with fnm, verify the PowerShell session that launches claude has MS_CLIENT_ID exported.

4. Run tests

npm test           # one-shot
npm run test:watch # watch mode

⬆️ Upgrading from earlier versions

🗺 Roadmap

• v0.1 — stdio + 6 CRUD tools
• v0.2 — distributable npm package, baked-in client ID
• v0.3 — recurrence + reminders + checklists + linkedResources + search + move + summarize_today + retry/error robustness + vitest tests + compact format (verbose opt-in)
• v0.4 — auto pagination + $batch operations + Tasks.ReadWrite.Shared scope (read shared lists)
• v0.5 — open extensions + cross-list helpers (overdue, by category, bulk update) + iCalendar export
• v1.0 — stable milestone: GitHub Actions CI + extended tests + snapshot tests + README polish

Possible future versions:

• v1.1 — file attachments (Graph beta)
• v1.2 — auto-pagination follow-on for summarize_today / search_tasks / list_overdue_tasks
• v2.0 — remote HTTP/SSE transport for Claude.ai custom connectors (multi-user OAuth)

📄 License

MIT — © MAG&Cie