Foodman SharePoint MCP

MCP server for SharePoint/OneDrive access via Microsoft Graph. Supports site whitelisting and delegated user permissions.

Features

• SharePoint & OneDrive access: List, upload, download files
• Excel integration: Read/write ranges, append to tables
• Site whitelisting: Restrict access to specific SharePoint sites
• Delegated permissions: User's own M365 permissions apply
• Multiple auth modes: Interactive browser, Azure CLI, or token-based

Installation

npm install -g @foodman/sharepoint-mcp

Or clone and build locally:

git clone https://github.com/advania-consultingwest/foodman.git
cd foodman
npm install
npm run build

Configuration

VS Code

Add to .vscode/mcp.json in your workspace:

{
  "servers": {
    "foodman-sharepoint": {
      "command": "npx",
      "args": ["-y", "@foodman/sharepoint-mcp", "--auth", "azcli"],
      "env": {
        "FOODMAN_SHAREPOINT_SITES": "https://contoso.sharepoint.com/sites/MySite"
      }
    }
  }
}

Or if cloned locally:

{
  "servers": {
    "foodman-sharepoint": {
      "command": "node",
      "args": ["${workspaceFolder}/dist/index.js", "--auth", "azcli"],
      "env": {
        "FOODMAN_SHAREPOINT_SITES": "https://contoso.sharepoint.com/sites/MySite"
      }
    }
  }
}

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "foodman-sharepoint": {
      "command": "npx",
      "args": ["-y", "@foodman/sharepoint-mcp", "--auth", "interactive", "--tenant", "<your-tenant-id>", "--client-id", "<your-app-id>"],
      "env": {
        "FOODMAN_SHAREPOINT_SITES": "https://contoso.sharepoint.com/sites/MySite"
      }
    }
  }
}

Auth Modes

| Mode | Flag | Requirements | Description | |------|------|-------------|-------------| | interactive | --auth interactive | --client-id, --tenant | Browser sign-in via MSAL (default) | | azcli | --auth azcli | az login session | Delegates to Azure CLI credentials | | env | --auth env | FOODMAN_SHAREPOINT_MCP_TOKEN | Pre-supplied bearer token |

Interactive Mode

Requires an Azure app registration (see Prerequisites). Opens a browser for sign-in and consent on first use.

Azure CLI Mode

Uses your existing az login session. Optionally pass --tenant <id> to target a specific tenant. No app registration needed.

Env Mode

Reads a delegated Graph access token from the FOODMAN_SHAREPOINT_MCP_TOKEN environment variable. Re-reads on every call, so the parent process can rotate the token.

Prerequisites

Azure App Registration (interactive mode only)

1. Go to Azure Portal → Entra ID → App registrations
2. Create a new public client app registration
3. Add redirect URI: http://localhost (Mobile and desktop applications)
4. Under API permissions, add Microsoft Graph delegated permissions:
   • Files.ReadWrite
   • Sites.Read.All
5. Grant admin consent if required

SharePoint Access Modes

Control via FOODMAN_SHAREPOINT_SITES environment variable:

| Value | Mode | Behavior | |-------|------|----------| | (unset) | disabled | No SharePoint access | | * | open | User's M365 permissions apply directly | | url1;url2 | allowlist | Only listed sites accessible |

Use semicolons to separate multiple entries (Graph site IDs contain commas):

FOODMAN_SHAREPOINT_SITES="https://contoso.sharepoint.com/sites/HR;https://contoso.sharepoint.com/sites/Finance"

You can also use raw Graph site IDs: contoso.sharepoint.com,guid1,guid2

Allowlist Mode

In allowlist mode, users must activate sites before accessing them:

1. Call list_my_sharepoint_sites to see available sites
2. Call set_active_sites with site IDs to activate
3. Now file operations work on those sites

This provides an extra layer of control beyond M365 permissions.

Available Tools

Scope Management

• list_my_sharepoint_sites — List available SharePoint sites
• get_active_sites — Get currently active sites
• set_active_sites — Activate sites for this session

File Operations

• list_files — List files in a folder
• upload_small_file — Upload file ≤4 MB
• upload_large_file — Chunked upload for larger files
• download_file — Download file (base64)
• create_folder — Create a folder
• move_or_rename — Move or rename item
• create_sharing_link — Create sharing link

Excel

• excel_read_range — Read cells from a range
• excel_update_range — Write cells to a range
• excel_add_table_row — Append rows to a table

Environment Variables

| Variable | Description | |----------|-------------| | FOODMAN_SHAREPOINT_SITES | Site access mode (see above) | | FOODMAN_SITE_SCOPE | Graph permission: read-all (default, Sites.Read.All) or selected (Sites.Selected) | | FOODMAN_LOG_LEVEL | Log level: debug, info, warn, error | | FOODMAN_SHAREPOINT_MCP_TOKEN | Bearer token (--auth env only) |

Development

npm install
npm run build
npm test

License

MIT