m365-graph-mcp

Model Context Protocol server for Microsoft 365.

Provides delegated, scope-gated access to mail, calendar, files (OneDrive + whitelisted SharePoint sites), Teams, Tasks, OneNote, and Contacts via the Microsoft Graph API. Every Graph call is bound to a real signed-in user's token — the server can never see more than the user could see by signing into Outlook/SharePoint themselves.

Install

npm install -g m365-graph-mcp
# or
npx m365-graph-mcp --help

Quick start (stdio, for Claude Desktop / Cursor)

npx m365-graph-mcp --transport stdio --auth interactive

This opens a browser, signs you in, caches the token, and starts an MCP server on stdio. Configure your MCP client (e.g. Claude Desktop) to launch this command.

Hosted mode (HTTP, for shared deployments)

npx m365-graph-mcp --transport http --port 8001 --auth oauth-proxy

Runs a Streamable HTTP MCP server with an embedded OAuth proxy. Each user signs in through their browser; the server uses the On-Behalf-Of flow to call Graph as that user. Designed to be deployed to a customer-controlled environment (Azure Container Apps, AKS, etc.) — see the project ARCHITECTURE.md for the deploy contract.

SharePoint access modes

M365_GRAPH_MCP_SHAREPOINT_SITES selects one of three modes:

| Value | Mode | Behavior | | ------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | unset / empty | disabled | No SharePoint sites accessible. /sites/* calls rejected before reaching Graph. (Default.) | | siteId1,siteId2,… | allowlist | Tenant-wide allowlist. A user can reach a site only if it is on this list AND they have SharePoint permission to it. The allowlist is an upper bound, never an expansion. Combine with set_active_sites for per-session narrowing. | | * | open | No admin gate. A user can reach any site they have SharePoint permission to via their delegated token. Microsoft's ACLs are the only filter. |

OneDrive (/me/drive/*) is unaffected by the mode.

CLI flags

| Flag | Default | Description | | ------------- | ------------------------------------------- | -------------------------------------------- | | --transport | stdio | stdio or http | | --auth | interactive (stdio), oauth-proxy (http) | interactive, azcli, env, oauth-proxy | | --port | 8001 | HTTP port (only with --transport http) | | --tenant | — | Azure tenant ID (interactive/azcli only) | | --client-id | bundled multi-tenant app | Public-client app reg ID (interactive only) | | --version | — | Print version and exit | | --help | — | Show help |

License

MIT