365center-mcp 1.2.2 → 1.4.0

package/README.md

@@ -1,6 +1,6 @@
 # 365center-mcp
 
-**MCP server for Microsoft 365 / SharePoint — 35 tools for full read/write access**
+**MCP server for Microsoft 365 / SharePoint — 30+ tools for full read/write access**
 
 Available on [GitHub](https://github.com/Crscristi28/365center-mcp) · [npm](https://www.npmjs.com/package/365center-mcp) · [Docker Hub](https://hub.docker.com/r/crscristi28/365center-mcp) · [cristianb.cz](https://cristianb.cz)
 
@@ -42,7 +42,7 @@ Full visual walkthrough: **[Setup Guide PDF](https://github.com/Crscristi28/365c
 
 `365center-mcp` is a Model Context Protocol (MCP) server that gives Claude — and any other MCP-compatible AI client — full read/write access to Microsoft 365 SharePoint sites.
 
-It exposes **35 tools** covering SharePoint sites, document libraries, documents, pages, metadata columns, navigation, and permissions. Claude can list sites, upload and download files, tag documents, create and publish pages, build navigation menus, manage permissions, and more — all through a single MCP connection.
+It exposes **36 tools** covering SharePoint sites, document libraries, documents, pages, metadata columns, navigation, and permissions. Claude can list sites, upload and download files, tag documents, create and publish pages, build navigation menus, manage permissions, and more — all through a single MCP connection.
 
 Built for manufacturing companies managing factory documentation in SharePoint, but works with any Microsoft 365 tenant.
 
@@ -56,7 +56,7 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 
 ## Features
 
-**35 tools** across 7 categories. All tools use Microsoft Graph API or SharePoint REST API — no middlemen.
+**30+ tools** across 7 categories. All tools use Microsoft Graph API or SharePoint REST API — no middlemen.
 
 ### Sites (4 tools)
 - `list_sites` — List all SharePoint sites in the tenant
@@ -65,8 +65,8 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 - `create_site` — Create a new Communication or Team site
 
 ### Documents (9 tools)
-- `list_document_libraries` — List document libraries (drives)
-- `list_documents` — List documents with both driveItemId and listItemId
+- `list_document_libraries` — List document libraries. Returns `driveId` (for file operations) and `listId` (for metadata operations) — call this first when working with documents.
+- `list_documents` — List documents with both driveItemId and listItemId. Optional `fields: "minimal"` returns only id/name/isFolder/size (~74% token savings for exploration).
 - `upload_document` — Upload a file to SharePoint (auto session upload for files over 4 MB)
 - `upload_documents` — Upload multiple files with optional metadata in one call (max 30 per call)
 - `download_document` — Download files from SharePoint to a local path
@@ -75,25 +75,27 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 - `create_folder` — Create folders
 - `get_document_versions` — Version history (audit trail)
 
-### Metadata (5 tools)
+### Metadata (6 tools)
 - `list_columns` — List custom metadata columns
 - `create_choice_column` — Create choice/dropdown columns (single or multi-select)
 - `create_text_column` — Create text columns
+- `delete_column` — Permanently delete a column from a list or document library (irreversible)
 - `get_document_metadata` — Read document metadata
 - `set_document_metadata` — Set metadata on documents
 
 ### Pages — Graph API (6 tools)
-- `list_pages` — List all pages
+- `list_pages` — List all pages. Optional `includeItemId: true` also returns numeric item IDs needed by canvas tools (requires delegated auth and siteUrl).
 - `create_page` — Create empty page
 - `create_page_with_content` — Create page with sections and HTML content
 - `add_quick_links` — Add Quick Links web part
 - `publish_page` — Publish a draft page
 - `delete_page` — Delete a page
 
-### Pages — SharePoint REST API (4 tools)
-- `list_site_pages` — List pages with numeric IDs
-- `get_page_canvas_content` — Read raw page content (CanvasContent1)
-- `set_page_canvas_content` — Write raw page content (supports Highlighted Content and any web part)
+### Pages — SharePoint REST API (5 tools)
+- `get_page_canvas_summary` — Returns structured page overview (web part types, titles, filters, layout). ~400 B JSON vs ~15 KB raw HTML. Default tool for read-only canvas analysis.
+- `get_page_canvas_content` — Read raw CanvasContent1 HTML. Use only when you need full HTML for structural edits via set_page_canvas_content.
+- `set_page_canvas_content` — Write raw page content (structural edits: adding or removing web parts).
+- `patch_page_canvas_webpart` — Surgically update web part properties (title, filter, layout, maxItems) without Claude handling the full canvas. Saves ~6 000 tokens per update vs get/set canvas pattern.
 - `copy_page` — Copy a page as template
 
 ### Navigation (3 tools)
@@ -102,7 +104,7 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 - `delete_navigation_link` — Remove link from navigation
 
 ### Permissions (4 tools)
-- `get_permissions` — List SharePoint groups (Visitors, Members, Owners)
+- `get_permissions` — List SharePoint groups (Visitors, Members, Owners). Optional `includeMembers: true` returns members inside each group in a single call.
 - `get_group_members` — List members of a group
 - `add_user_to_group` — Add user to a group
 - `remove_user_from_group` — Remove user from a group
@@ -229,7 +231,7 @@ Replace the four `your-*` values with what you collected in Step 8 of the Azure
 
 On Windows, use `C:\\Users\\YOUR_USERNAME\\.365center-mcp:/home/mcp/.365center-mcp` as the volume mount.
 
-**4. Open Claude Desktop.** The server will appear in the MCP menu with all 35 tools loaded.
+**4. Open Claude Desktop.** The server will appear in the MCP menu with all 36 tools loaded.
 
 > **Why the volume mount?** The server caches delegated auth tokens in `~/.365center-mcp/token-cache.json`. Without the volume, you would need to re-authenticate every time Docker restarts.
 
@@ -474,7 +476,7 @@ The Graph API `create_page_with_content` tool supports these standard web parts:
 | Title Area | `cbe7b0a9-3504-44dd-a3a3-0e5cacd07788` |
 | YouTube Embed | `544dd15b-cf3c-441b-96da-004d5a8cea1d` |
 
-For **Highlighted Content** and any other web part not in this list, use the REST API tools (`get_page_canvas_content` and `set_page_canvas_content`) — they can read and write any web part including Highlighted Content.
+For **Highlighted Content** and any other web part not in this list, use `get_page_canvas_summary` to inspect, `patch_page_canvas_webpart` to update properties, and `get/set_page_canvas_content` for structural edits.
 
 ---
 

package/dist/auth.js

@@ -1,6 +1,7 @@
 import { ClientSecretCredential } from "@azure/identity";
 import { Client } from "@microsoft/microsoft-graph-client";
 import { TokenCredentialAuthenticationProvider } from "@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials/index.js";
+import { Entry } from "@napi-rs/keyring";
 import dotenv from "dotenv";
 import path from "path";
 import { fileURLToPath } from "url";
@@ -20,29 +21,70 @@ export const graphClient = Client.initWithMiddleware({
     authProvider,
 });
 // ============ DELEGATED AUTH (SharePoint REST API) ============
-// Store token in user's home directory — works for Node, Docker (with volume), and plugins
+// Refresh token storage: OS keyring (macOS Keychain / Windows Credential Manager / Linux libsecret)
+// with file fallback (chmod 600) for headless / Docker / keyring-less environments.
+// Access token is kept in-memory only — never written to disk.
+const KEYRING_SERVICE = "365center-mcp";
+const KEYRING_ACCOUNT = "refresh-token";
 const TOKEN_DIR = path.join(process.env.HOME || process.env.USERPROFILE || "/tmp", ".365center-mcp");
-if (!fs.existsSync(TOKEN_DIR))
-    fs.mkdirSync(TOKEN_DIR, { recursive: true });
-const TOKEN_CACHE_PATH = path.join(TOKEN_DIR, "token-cache.json");
+const TOKEN_FILE = path.join(TOKEN_DIR, "refresh-token");
 const SHAREPOINT_DOMAIN = process.env.SHAREPOINT_DOMAIN || "";
 const SP_SCOPES = `offline_access https://${SHAREPOINT_DOMAIN}/AllSites.FullControl`;
-function loadTokenCache() {
+let cachedAccessToken = null;
+function loadRefreshToken() {
     try {
-        if (fs.existsSync(TOKEN_CACHE_PATH)) {
-            return JSON.parse(fs.readFileSync(TOKEN_CACHE_PATH, "utf-8"));
+        const v = new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).getPassword();
+        if (v)
+            return v;
+    }
+    catch { }
+    try {
+        if (fs.existsSync(TOKEN_FILE)) {
+            return fs.readFileSync(TOKEN_FILE, "utf-8").trim() || null;
         }
     }
     catch { }
     return null;
 }
-function saveTokenCache(cache) {
-    fs.writeFileSync(TOKEN_CACHE_PATH, JSON.stringify(cache, null, 2));
+function saveRefreshToken(token) {
+    try {
+        new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).setPassword(token);
+        return;
+    }
+    catch { }
+    try {
+        if (!fs.existsSync(TOKEN_DIR)) {
+            fs.mkdirSync(TOKEN_DIR, { recursive: true });
+        }
+        try {
+            fs.chmodSync(TOKEN_DIR, 0o700);
+        }
+        catch { }
+        fs.writeFileSync(TOKEN_FILE, token);
+        try {
+            fs.chmodSync(TOKEN_FILE, 0o600);
+        }
+        catch { }
+    }
+    catch { }
+}
+function clearRefreshToken() {
+    try {
+        new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).deletePassword();
+    }
+    catch { }
+    try {
+        if (fs.existsSync(TOKEN_FILE))
+            fs.unlinkSync(TOKEN_FILE);
+    }
+    catch { }
+    cachedAccessToken = null;
 }
 async function refreshAccessToken(refreshToken) {
+    // Device code flow uses a public client — client_secret must NOT be sent
+    // (Microsoft returns AADSTS700025 if included).
     const body = new URLSearchParams({
         client_id: clientId,
-        client_secret: clientSecret,
         grant_type: "refresh_token",
         refresh_token: refreshToken,
         scope: SP_SCOPES,
@@ -53,13 +95,16 @@ async function refreshAccessToken(refreshToken) {
         throw new Error(`Token refresh failed: ${err}`);
     }
     const data = await response.json();
-    const cache = {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token || refreshToken,
+    const accessToken = data.access_token;
+    const newRefreshToken = data.refresh_token || refreshToken;
+    cachedAccessToken = {
+        token: accessToken,
         expiresAt: Date.now() + data.expires_in * 1000,
     };
-    saveTokenCache(cache);
-    return cache;
+    if (newRefreshToken !== refreshToken) {
+        saveRefreshToken(newRefreshToken);
+    }
+    return accessToken;
 }
 // Device code polling — runs in background after user gets instructions
 let deviceCodePollingPromise = null;
@@ -80,14 +125,15 @@ function pollForDeviceCodeToken(deviceCode, interval, expiresIn) {
             });
             const tokenData = await tokenResponse.json();
             if (tokenData.access_token) {
-                const cache = {
-                    accessToken: tokenData.access_token,
-                    refreshToken: tokenData.refresh_token,
+                cachedAccessToken = {
+                    token: tokenData.access_token,
                     expiresAt: Date.now() + tokenData.expires_in * 1000,
                 };
-                saveTokenCache(cache);
+                if (tokenData.refresh_token) {
+                    saveRefreshToken(tokenData.refresh_token);
+                }
                 deviceCodePollingPromise = null;
-                resolve(cache);
+                resolve(tokenData.access_token);
                 return;
             }
             if (tokenData.error === "authorization_pending")
@@ -123,7 +169,9 @@ async function startDeviceCodeFlow() {
     }
     const codeData = await codeResponse.json();
     const { device_code, user_code, verification_uri, expires_in, interval, message } = codeData;
-    // Start polling in background
+    // Start polling in background. Clear any stale refresh token so a stuck/invalid
+    // one from a previous run doesn't race the device code flow.
+    clearRefreshToken();
     deviceCodePollingPromise = pollForDeviceCodeToken(device_code, interval, expires_in);
     // Throw error with login instructions — Claude sees this and tells the user
     throw new Error(`LOGIN REQUIRED: ${message}\n\n` +
@@ -132,26 +180,25 @@ async function startDeviceCodeFlow() {
         `After logging in, try your request again.`);
 }
 export async function getDelegatedToken() {
-    // 1. Check cache
-    const cache = loadTokenCache();
-    if (cache) {
-        if (cache.expiresAt > Date.now() + 300000) {
-            return cache.accessToken;
-        }
+    // 1. In-memory access token still valid?
+    if (cachedAccessToken && cachedAccessToken.expiresAt > Date.now() + 300000) {
+        return cachedAccessToken.token;
+    }
+    // 2. Try refresh token from keyring/file
+    const refreshToken = loadRefreshToken();
+    if (refreshToken) {
         try {
-            const refreshed = await refreshAccessToken(cache.refreshToken);
-            return refreshed.accessToken;
+            return await refreshAccessToken(refreshToken);
         }
         catch {
-            // Refresh failed — need new login
+            // Refresh failed (expired/revoked) — fall through to device code flow
         }
     }
-    // 2. If polling is already running, wait for it
+    // 3. If polling is already running, wait for it
     if (deviceCodePollingPromise) {
-        const result = await deviceCodePollingPromise;
-        return result.accessToken;
+        return await deviceCodePollingPromise;
     }
-    // 3. No cache, no polling — start device code flow (throws with instructions)
+    // 4. No cache, no polling — start device code flow (throws with instructions)
     await startDeviceCodeFlow();
     throw new Error("unreachable"); // startDeviceCodeFlow always throws
 }

package/dist/index.js

@@ -7,10 +7,10 @@ import { fileURLToPath } from "url";
 import path from "path";
 import { listSites, getSite, getSiteById } from "./tools/sites.js";
 import { listDocumentLibraries, listDocuments, uploadDocument, uploadDocuments, downloadDocument, searchDocuments, deleteDocument, createFolder, getDocumentVersions } from "./tools/documents.js";
-import { listColumns, createChoiceColumn, createTextColumn, setDocumentMetadata, getDocumentMetadata } from "./tools/metadata.js";
+import { listColumns, createChoiceColumn, createTextColumn, deleteColumn, setDocumentMetadata, getDocumentMetadata } from "./tools/metadata.js";
 import { listPages, createPage, createPageWithContent, addQuickLinksWebPart, publishPage, deletePage } from "./tools/pages.js";
 import { getNavigation, addNavigationLink, deleteNavigationLink } from "./tools/navigation.js";
-import { getPageCanvasContent, setPageCanvasContent, copyPage, listSitePages } from "./tools/pages-rest.js";
+import { getPageCanvasContent, getPageCanvasSummary, setPageCanvasContent, copyPage, patchPageCanvasWebpart } from "./tools/pages-rest.js";
 import { createSite } from "./tools/sites-rest.js";
 import { getSitePermissions, getGroupMembers, addUserToGroup, removeUserFromGroup } from "./tools/permissions.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -41,16 +41,17 @@ server.tool("create_site", "Create a new SharePoint site. Template: 'communicati
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 // ============ DOCUMENTS ============
-server.tool("list_document_libraries", "List all document libraries (drives) in a SharePoint site. Returns driveId and listId for each library. Use driveId for file operations (upload, download, delete, list, versions). Use listId for metadata operations (list_columns, get/set_document_metadata, create columns). Call this first when working with documents — you need both IDs.", { siteId: z.string().describe("SharePoint site ID") }, async ({ siteId }) => {
+server.tool("list_document_libraries", "List all document libraries in a SharePoint site. Returns driveId, listId, name, and URL for each library. Use driveId for file operations (upload, download, delete, list, versions). Use listId for metadata operations (list_columns, get/set_document_metadata, create columns). Call this first when working with documents — you need both IDs.", { siteId: z.string().describe("SharePoint site ID") }, async ({ siteId }) => {
     const libraries = await listDocumentLibraries(siteId);
     return { content: [{ type: "text", text: JSON.stringify(libraries, null, 2) }] };
 });
-server.tool("list_documents", "List documents in a document library folder. Returns both driveItemId and listItemId for each document. Use driveItemId (+ driveId) for file operations (download, delete, versions). Use listItemId (or driveItemId + driveId) for metadata operations (get/set_document_metadata). The listId parameter for metadata tools can be the list display name (e.g. 'Dokumenty') or the list GUID.", {
+server.tool("list_documents", "List documents in a document library folder. Returns both driveItemId and listItemId for each document. Use driveItemId (+ driveId) for file operations (download, delete, versions). Use listItemId (or driveItemId + driveId) for metadata operations (get/set_document_metadata). The listId parameter for metadata tools can be the list display name (e.g. 'Dokumenty') or the list GUID. For exploration or listing large folders, set fields: \"minimal\" (~74% token savings, returns id/name/isFolder/size only). Use fields: \"all\" (default) when you need URL, mimeType, dates, or metadata.", {
     siteId: z.string().describe("SharePoint site ID"),
     driveId: z.string().describe("Document library (drive) ID"),
     folderId: z.string().optional().describe("Folder ID (default: root)"),
-}, async ({ siteId, driveId, folderId }) => {
-    const docs = await listDocuments(siteId, driveId, folderId || "root");
+    fields: z.enum(["all", "minimal"]).optional().describe("Field set: 'all' (default, full metadata) or 'minimal' (id, name, isFolder, size only — saves ~74% tokens for exploration)"),
+}, async ({ siteId, driveId, folderId, fields }) => {
+    const docs = await listDocuments(siteId, driveId, folderId || "root", fields || "all");
     return { content: [{ type: "text", text: JSON.stringify(docs, null, 2) }] };
 });
 server.tool("upload_document", "Upload a single local file to a SharePoint document library. Root folder by default, or specific folder via folderId. After upload, use set_document_metadata to tag it. Supports up to 250 GB (auto session upload for >4 MB). For multiple files, prefer upload_documents — up to 30 files per call with inline metadata and built-in rate limit protection. NOTE: If using Highlighted Content web parts, filename prefix determines filtering. The 'Title includes the words' filter is SUBSTRING-based — e.g. 'Report' will also match 'ReportQ1' or 'ReportAnnual'. Use non-overlapping prefixes.", {
@@ -124,14 +125,14 @@ server.tool("get_document_versions", "Get version history of a document (audit t
 // ============ METADATA ============
 server.tool("list_columns", "List custom metadata columns in a SharePoint list/library. listId can be display name (e.g. 'Documents') or GUID. Returns internal name, display name, type, and choices. Call this before set_document_metadata — internal column names (used in API) often differ from display names (shown in UI). Using wrong name fails silently.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
 }, async ({ siteId, listId }) => {
     const columns = await listColumns(siteId, listId);
     return { content: [{ type: "text", text: JSON.stringify(columns, null, 2) }] };
 });
 server.tool("create_choice_column", "Create a choice/dropdown metadata column in a SharePoint list or document library. Use allowMultiple:true for multi-select checkboxes (e.g. document belongs to multiple areas). Column 'name' is the internal API name (no spaces/special chars), 'displayName' is what users see in SharePoint UI. The column must be created BEFORE setting metadata values on documents.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     name: z.string().describe("Internal column name"),
     displayName: z.string().describe("Display name shown in UI"),
     choices: z.array(z.string()).describe("List of choices"),
@@ -142,16 +143,24 @@ server.tool("create_choice_column", "Create a choice/dropdown metadata column in
 });
 server.tool("create_text_column", "Create a single-line text metadata column in a SharePoint list or document library. Column 'name' is the internal API name (no spaces/special chars), 'displayName' is what users see in SharePoint UI. The column must be created BEFORE setting metadata values on documents.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     name: z.string().describe("Internal column name"),
     displayName: z.string().describe("Display name shown in UI"),
 }, async ({ siteId, listId, name, displayName }) => {
     const result = await createTextColumn(siteId, listId, name, displayName);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
+server.tool("delete_column", "PERMANENTLY delete a column from a SharePoint list or document library. This action is irreversible — the column definition and all associated metadata values on items are removed. Always confirm with the user before deleting. Use list_columns to find the columnId.", {
+    siteId: z.string().describe("SharePoint site ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
+    columnId: z.string().describe("Column GUID (from list_columns)"),
+}, async ({ siteId, listId, columnId }) => {
+    const result = await deleteColumn(siteId, listId, columnId);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+});
 server.tool("set_document_metadata", "Set metadata fields on a document. 'fields' is a JSON string of key-value pairs using column internal names. Choice values must match predefined choices exactly (case-sensitive). Multi-select: use array of strings. Columns must exist first — check with list_columns. Accepts drive item ID (requires driveId) or numeric list item ID. Only change fields the user asked for — leave others untouched. TIP: Changing a Status field (e.g. to 'Pending Approval') can trigger Power Automate flows with 'When item modified' trigger — no HTTP webhooks or extra tools needed.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     itemId: z.string().describe("Document ID — either numeric list item ID or drive item ID"),
     fields: z.string().describe("JSON string of key-value pairs, e.g. {\"Oblast\":\"Linka 1\",\"Status\":\"Platný\"}"),
     driveId: z.string().optional().describe("Drive ID — required when itemId is a drive item ID (non-numeric)"),
@@ -162,7 +171,7 @@ server.tool("set_document_metadata", "Set metadata fields on a document. 'fields
 });
 server.tool("get_document_metadata", "Get all metadata fields of a document including custom columns. Accepts both drive item ID and numeric list item ID — if using drive item ID, provide driveId. Returns all field values including system fields and custom metadata.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     itemId: z.string().describe("Document ID — either numeric list item ID or drive item ID"),
     driveId: z.string().optional().describe("Drive ID — required when itemId is a drive item ID (non-numeric)"),
 }, async ({ siteId, listId, itemId, driveId }) => {
@@ -170,16 +179,21 @@ server.tool("get_document_metadata", "Get all metadata fields of a document incl
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 // ============ PAGES ============
-server.tool("list_pages", "List all pages via Graph API. Returns page GUID, name, title, URL, and state. Use page GUID for publish_page, delete_page, add_quick_links. NOTE: Canvas tools (get/set_page_canvas_content) need NUMERIC item IDs from list_site_pages instead — GUIDs from this tool won't work there.", { siteId: z.string().describe("SharePoint site ID") }, async ({ siteId }) => {
-    const pages = await listPages(siteId);
+server.tool("list_pages", "List all pages via Graph API (app-only auth). Returns page GUID (id), name, title, URL, and publishing state. Use page GUID for publish_page, delete_page, add_quick_links. To include numeric itemId (needed for canvas tools: get_page_canvas_content, set_page_canvas_content, get_page_canvas_summary, patch_page_canvas_webpart), set includeItemId: true — requires delegated auth (one-time device code login) and siteUrl. Without includeItemId, this tool works app-only with no login flow.", {
+    siteId: z.string().describe("SharePoint site ID"),
+    siteUrl: z.string().optional().describe("Full SharePoint site URL (required when includeItemId is true)"),
+    includeItemId: z.boolean().optional().describe("If true, also fetch numeric itemId for each page (requires delegated auth and siteUrl)"),
+}, async ({ siteId, siteUrl, includeItemId }) => {
+    const pages = await listPages(siteId, siteUrl, includeItemId || false);
     return { content: [{ type: "text", text: JSON.stringify(pages, null, 2) }] };
 });
 server.tool("create_page", "Create a new empty page in checkout/draft state. MUST call publish_page after to make it visible. 'name' becomes URL slug (e.g. 'my-page' → my-page.aspx). For pages with text sections, use create_page_with_content. For pages with web parts (Highlighted Content etc.), create empty page first, then set_page_canvas_content, then publish_page.", {
     siteId: z.string().describe("SharePoint site ID"),
     title: z.string().describe("Page title"),
     name: z.string().describe("Page file name (without .aspx)"),
-}, async ({ siteId, title, name }) => {
-    const result = await createPage(siteId, title, name);
+    pageLayout: z.enum(["article", "home"]).optional().describe("Page layout. 'article' (default) — standard content page with title banner (image, title, author, date) above the canvas. Use for 99% of pages. 'home' — dashboard-style layout without title banner, canvas goes full-width from the top. Use only when you explicitly want a landing-page feel. Note: 'home' does NOT set the page as the site's actual home page — that's a separate site setting."),
+}, async ({ siteId, title, name, pageLayout }) => {
+    const result = await createPage(siteId, title, name, pageLayout);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 server.tool("create_page_with_content", "Create a page with HTML text sections. Draft state — MUST call publish_page after. Sections is a JSON string array. Layouts: oneColumn (12), twoColumns (6+6), threeColumns (4+4+4), oneThirdLeftColumn (4+8), oneThirdRightColumn (8+4), fullWidth (12). Example: [{\"layout\":\"twoColumns\",\"columns\":[{\"width\":6,\"html\":\"<h2>Left</h2>\"},{\"width\":6,\"html\":\"<h2>Right</h2>\"}]}]. NOTE: Only supports text/HTML. For web parts like Highlighted Content, use create_page + set_page_canvas_content instead.", {
@@ -240,8 +254,11 @@ server.tool("delete_navigation_link", "Remove a link from the top navigation men
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 // ============ PERMISSIONS ============
-server.tool("get_permissions", "Get all SharePoint groups (Visitors, Members, Owners, custom) for a site. Returns group ID, title, and description. Use group ID with get_group_members to see who is in each group, or with add_user_to_group/remove_user_from_group to manage membership. Uses SharePoint REST API with delegated auth.", { siteUrl: z.string().describe("Full SharePoint site URL (e.g. https://contoso.sharepoint.com/sites/MySite)") }, async ({ siteUrl }) => {
-    const result = await getSitePermissions(siteUrl);
+server.tool("get_permissions", "Get all SharePoint groups (Visitors, Members, Owners, custom) for a site. Returns group ID, title, description, and owner title. With includeMembers: true, also returns all users in each group in a single call (id, title, email, loginName) — avoids calling get_group_members separately for each group. Uses SharePoint REST API with delegated auth.", {
+    siteUrl: z.string().describe("Full SharePoint site URL (e.g. https://contoso.sharepoint.com/sites/MySite)"),
+    includeMembers: z.boolean().optional().describe("If true, include member list (id, title, email, loginName) inside each group — single call for full permission overview. If false/omitted, returns groups only."),
+}, async ({ siteUrl, includeMembers }) => {
+    const result = await getSitePermissions(siteUrl, includeMembers);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 server.tool("get_group_members", "Get all members of a SharePoint group. Use get_permissions first to find the groupId. Returns user ID, name, email, and login name for each member.", {
@@ -268,21 +285,43 @@ server.tool("remove_user_from_group", "Remove a user from a SharePoint group. Us
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 // ============ REST API — CANVAS CONTENT ============
-server.tool("get_page_canvas_content", "Read raw CanvasContent1 of a page via REST API. Returns full HTML including all web parts. Use to inspect existing page structure before modifying. pageItemId = numeric ID from list_site_pages (NOT GUID from list_pages). Uses delegated auth. ALWAYS read before calling set_page_canvas_content — understand what's there before replacing it.", {
+server.tool("get_page_canvas_content", "Read RAW CanvasContent1 HTML (~3 000 tokens per 5-WS page, 97.5% boilerplate). ⚠️ ONLY use when you need full HTML string to pass to set_page_canvas_content (structural edits: adding or removing web parts). For read-only questions (\"what's on this page\", audit, exploration), ALWAYS use get_page_canvas_summary instead — it returns structured JSON ~30× smaller. pageItemId = numeric ID from list_pages (call with includeItemId: true). Uses delegated auth.", {
     siteUrl: z.string().describe("Full SharePoint site URL (e.g. https://contoso.sharepoint.com/sites/MySite)"),
-    pageItemId: z.number().describe("Numeric item ID from Site Pages list (use list_site_pages to find it)"),
+    pageItemId: z.number().describe("Numeric item ID from list_pages (call with includeItemId: true to get it)"),
 }, async ({ siteUrl, pageItemId }) => {
     const result = await getPageCanvasContent(siteUrl, pageItemId);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
-server.tool("set_page_canvas_content", "Replace entire page canvas via REST API. Overwrites ALL existing content. Uses delegated auth. pageItemId = numeric ID from list_site_pages. MUST call publish_page after — page reverts to draft and appears EMPTY without it. Canvas HTML rules: use pre-encoded entities directly (&#123; &#125; &#58; &quot;) — never JSON.stringify then replace (double-escaping on file round-trips). Omit titleHTML property (causes escaping corruption) — titles render from searchablePlainTexts. Read current canvas with get_page_canvas_content first.", {
+server.tool("get_page_canvas_summary", "Returns structured page overview: web part types, titles, filter values, section layout. ~400 B JSON vs ~15 KB raw HTML for get_page_canvas_content. ✅ USE THIS for: exploration, audit, \"what's on this page\", planning edits, reading web part titles/filters. Recognizes HighlightedContent and QuickLinks web parts; unknown web part types return as type \"Unknown\" with webPartId. ❌ Do NOT use get_page_canvas_content unless you need the full HTML for set_page_canvas_content (structural edits). pageItemId = numeric ID from list_pages (call with includeItemId: true). Uses delegated auth.", {
+    siteUrl: z.string().describe("Full SharePoint site URL (e.g. https://contoso.sharepoint.com/sites/MySite)"),
+    pageItemId: z.number().describe("Numeric item ID from list_pages (call with includeItemId: true to get it)"),
+}, async ({ siteUrl, pageItemId }) => {
+    const result = await getPageCanvasSummary(siteUrl, pageItemId);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+});
+server.tool("set_page_canvas_content", "Replace entire page canvas via REST API. Overwrites ALL existing content. Uses delegated auth. pageItemId = numeric ID from list_pages (call with includeItemId: true). MUST call publish_page after — page reverts to draft and appears EMPTY without it. Canvas HTML rules: use pre-encoded entities directly (&#123; &#125; &#58; &quot;) — never JSON.stringify then replace (double-escaping on file round-trips). Omit titleHTML property (causes escaping corruption) — titles render from searchablePlainTexts. Read current canvas with get_page_canvas_content first.", {
     siteUrl: z.string().describe("Full SharePoint site URL"),
-    pageItemId: z.number().describe("Numeric item ID from Site Pages list"),
+    pageItemId: z.number().describe("Numeric item ID from list_pages (call with includeItemId: true to get it)"),
     canvasContent: z.string().describe("Raw HTML/JSON canvas content string — get format from get_page_canvas_content on an existing page"),
 }, async ({ siteUrl, pageItemId, canvasContent }) => {
     const result = await setPageCanvasContent(siteUrl, pageItemId, canvasContent);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
+server.tool("patch_page_canvas_webpart", "Surgically update web part properties (title, filter, layout, maxItems) on a page without Claude handling the full canvas. MCP handles read-modify-write internally — Claude never sees the full canvas HTML. ✅ USE THIS for any title/filter/layout change on existing web parts. Saves ~6 000 tokens vs get_page_canvas_content + set_page_canvas_content pattern. Use set_page_canvas_content only for structural changes (adding/removing web parts). After patching, call publish_page to make changes visible.", {
+    siteUrl: z.string().describe("Full SharePoint site URL"),
+    pageItemId: z.number().describe("Numeric item ID from list_pages (call with includeItemId: true to get it)"),
+    patches: z.array(z.object({
+        instanceId: z.string().describe("Web part instanceId from get_page_canvas_summary (e.g. 'ws1-l1-inst')"),
+        title: z.string().optional().describe("New title — updates searchablePlainTexts.title in webpartdata AND the data-sp-htmlproperties div"),
+        filter: z.string().optional().describe("New filter value — HighlightedContent only (query.filters[0].value)"),
+        maxItems: z.number().optional().describe("New maxItemsPerPage — HighlightedContent only"),
+        layout: z.string().optional().describe("New layoutId (e.g. 'CompactGrid', 'FilmStrip')"),
+    })).describe("Array of patches. Each patch targets one web part by instanceId and changes one or more properties."),
+    verify: z.boolean().optional().describe("After write, read back and verify new values are present (default: true). Set false to skip verification for speed."),
+}, async ({ siteUrl, pageItemId, patches, verify }) => {
+    const result = await patchPageCanvasWebpart(siteUrl, pageItemId, patches, verify !== false);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+});
 server.tool("copy_page", "Copy an existing SharePoint page to create a new one. Useful for using template pages — create one page with the desired layout in SharePoint editor, then copy it programmatically. Both source and target are file names in SitePages folder (e.g. 'template.aspx', 'new-page.aspx'). Uses delegated auth.", {
     siteUrl: z.string().describe("Full SharePoint site URL"),
     sourceFileName: z.string().describe("Source page file name (e.g. 'template.aspx')"),
@@ -291,12 +330,6 @@ server.tool("copy_page", "Copy an existing SharePoint page to create a new one.
     const result = await copyPage(siteUrl, sourceFileName, targetFileName);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
-server.tool("list_site_pages", "List pages via REST API. Returns NUMERIC item IDs needed for canvas tools (get/set_page_canvas_content). Also returns title and file name. Uses delegated auth. NOTE: This gives numeric IDs for canvas operations. For page GUIDs (needed by publish_page, delete_page), use list_pages instead.", {
-    siteUrl: z.string().describe("Full SharePoint site URL"),
-}, async ({ siteUrl }) => {
-    const result = await listSitePages(siteUrl);
-    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-});
 // ============ START SERVER ============
 async function main() {
     const transport = new StdioServerTransport();

package/dist/tools/documents.d.ts

@@ -1,5 +1,5 @@
 export declare function listDocumentLibraries(siteId: string): Promise<any>;
-export declare function listDocuments(siteId: string, driveId: string, folderId?: string): Promise<any>;
+export declare function listDocuments(siteId: string, driveId: string, folderId?: string, fields?: "all" | "minimal"): Promise<any>;
 export declare function uploadDocument(siteId: string, driveId: string, fileName: string, filePath: string, folderId?: string): Promise<{
     id: any;
     name: any;

package/dist/tools/documents.js

@@ -4,20 +4,30 @@ import fs from "fs";
 import path from "path";
 import { Readable } from "stream";
 export async function listDocumentLibraries(siteId) {
+    // Single call with $expand=list($select=id) gives us both driveId (for file ops)
+    // and listId (for metadata ops) — drive.list is the associated SharePoint list.
     const result = await graphClient
-        .api(`/sites/${siteId}/drives`)
+        .api(`/sites/${siteId}/drives?$expand=list($select=id)`)
         .get();
     return result.value.map((drive) => ({
-        id: drive.id,
+        driveId: drive.id,
+        listId: drive.list?.id,
         name: drive.name,
         url: drive.webUrl,
-        itemCount: drive.quota?.used,
     }));
 }
-export async function listDocuments(siteId, driveId, folderId = "root") {
+export async function listDocuments(siteId, driveId, folderId = "root", fields = "all") {
     const result = await graphClient
         .api(`/sites/${siteId}/drives/${driveId}/items/${folderId}/children?$expand=listItem`)
         .get();
+    if (fields === "minimal") {
+        return result.value.map((item) => ({
+            id: item.id,
+            name: item.name,
+            isFolder: !!item.folder,
+            size: item.size,
+        }));
+    }
     return result.value.map((item) => ({
         id: item.id,
         listItemId: item.listItem?.id,
@@ -173,7 +183,8 @@ export async function getDocumentVersions(siteId, driveId, itemId) {
 }
 export async function uploadDocuments(siteId, driveId, listId, files, folderId = "root") {
     const results = [];
-    for (const file of files) {
+    for (let i = 0; i < files.length; i++) {
+        const file = files[i];
         const entry = { fileName: file.fileName, status: "ok" };
         try {
             const uploaded = await uploadDocument(siteId, driveId, file.fileName, file.filePath, folderId);
@@ -199,7 +210,9 @@ export async function uploadDocuments(siteId, driveId, listId, files, folderId =
             entry.metadataStatus = "skipped";
         }
         results.push(entry);
-        await new Promise((r) => setTimeout(r, 500));
+        if (i < files.length - 1) {
+            await new Promise((r) => setTimeout(r, 500));
+        }
     }
     return results;
 }

package/dist/tools/metadata.d.ts

@@ -5,6 +5,10 @@ export declare function createChoiceColumn(siteId: string, listId: string, name:
     displayName: any;
     allowMultiple: boolean;
 }>;
+export declare function deleteColumn(siteId: string, listId: string, columnId: string): Promise<{
+    success: boolean;
+    columnId: string;
+}>;
 export declare function createTextColumn(siteId: string, listId: string, name: string, displayName: string): Promise<{
     id: any;
     name: any;

package/dist/tools/metadata.js

@@ -61,7 +61,10 @@ export async function createChoiceColumn(siteId, listId, name, displayName, choi
     }
     const site = await graphClient.api(`/sites/${siteId}`).select("webUrl").get();
     const siteUrl = site.webUrl;
-    const result = await callSharePointRest(siteUrl, `/_api/web/lists/getByTitle('${listId}')/fields`, "POST", {
+    const listIdentifier = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(listId)
+        ? `lists(guid'${listId}')`
+        : `lists/getByTitle('${listId}')`;
+    const result = await callSharePointRest(siteUrl, `/_api/web/${listIdentifier}/fields`, "POST", {
         __metadata: { type: "SP.FieldMultiChoice" },
         FieldTypeKind: 15,
         Title: displayName,
@@ -76,6 +79,12 @@ export async function createChoiceColumn(siteId, listId, name, displayName, choi
         allowMultiple: true,
     };
 }
+export async function deleteColumn(siteId, listId, columnId) {
+    await graphClient
+        .api(`/sites/${siteId}/lists/${listId}/columns/${columnId}`)
+        .delete();
+    return { success: true, columnId };
+}
 export async function createTextColumn(siteId, listId, name, displayName) {
     const result = await graphClient
         .api(`/sites/${siteId}/lists/${listId}/columns`)

package/dist/tools/pages-rest.d.ts

@@ -4,6 +4,51 @@ export declare function getPageCanvasContent(siteUrl: string, pageItemId: number
     fileName: any;
     canvasContent: any;
 }>;
+type HighlightedContentSummary = {
+    instanceId: string;
+    type: "HighlightedContent";
+    zoneIndex: number;
+    sectionIndex: number;
+    title: string;
+    filter: string;
+    layout: string;
+    maxItems: number;
+};
+type QuickLinksSummary = {
+    instanceId: string;
+    type: "QuickLinks";
+    zoneIndex: number;
+    sectionIndex: number;
+    layout: string;
+    links: Array<{
+        title: string;
+        description: string;
+        url: string;
+    }>;
+};
+type UnknownWebPartSummary = {
+    instanceId: string;
+    type: "Unknown";
+    webPartId: string;
+    zoneIndex: number;
+    sectionIndex: number;
+};
+type WebPartSummary = HighlightedContentSummary | QuickLinksSummary | UnknownWebPartSummary;
+type TextSection = {
+    zoneIndex: number;
+    sectionIndex: number;
+    sectionFactor?: number;
+    zoneEmphasis?: number;
+    heading: string | null;
+    content: string;
+};
+export declare function getPageCanvasSummary(siteUrl: string, pageItemId: number): Promise<{
+    id: any;
+    title: any;
+    fileName: any;
+    webParts: WebPartSummary[];
+    textSections: TextSection[];
+}>;
 export declare function setPageCanvasContent(siteUrl: string, pageItemId: number, canvasContent: string): Promise<{
     success: boolean;
     pageItemId: number;
@@ -13,8 +58,20 @@ export declare function copyPage(siteUrl: string, sourceFileName: string, target
     source: string;
     target: string;
 }>;
-export declare function listSitePages(siteUrl: string): Promise<{
-    itemId: any;
-    title: any;
-    fileName: any;
-}[]>;
+export type WebPartPatch = {
+    instanceId: string;
+    title?: string;
+    filter?: string;
+    maxItems?: number;
+    layout?: string;
+};
+export type PatchWebPartResult = {
+    success: boolean;
+    pageItemId: number;
+    patched: string[];
+    notFound: string[];
+    verifyFailed?: string[];
+};
+export declare function patchPageCanvasWebpart(siteUrl: string, pageItemId: number, patches: WebPartPatch[], verify?: boolean): Promise<PatchWebPartResult>;
+export declare function fetchSitePageItemIdMap(siteUrl: string): Promise<Map<string, number>>;
+export {};

package/dist/tools/pages-rest.js

@@ -17,6 +17,156 @@ export async function getPageCanvasContent(siteUrl, pageItemId) {
         canvasContent: result.d.CanvasContent1,
     };
 }
+// Known SharePoint web part IDs
+const KNOWN_WEB_PARTS = {
+    "daf0b71c-6de8-4ef7-b511-faae7c388708": "HighlightedContent",
+    "c70391ea-0b10-4ee9-b2b4-006d3fcad0cd": "QuickLinks",
+};
+function decodeHtmlEntities(str) {
+    return str
+        .replace(/"/g, '"')
+        .replace(/{/g, "{")
+        .replace(/}/g, "}")
+        .replace(/:/g, ":")
+        .replace(/[/g, "[")
+        .replace(/]/g, "]")
+        .replace(/&/g, "&")
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&#(\d+);/g, (_, n) => String.fromCharCode(parseInt(n, 10)))
+        .replace(/&#x([0-9a-fA-F]+);/g, (_, n) => String.fromCharCode(parseInt(n, 16)));
+}
+function stripHtmlTags(html) {
+    return html.replace(/<[^>]+>/g, "").trim();
+}
+export async function getPageCanvasSummary(siteUrl, pageItemId) {
+    const listId = await getSitePagesListId(siteUrl);
+    const result = await callSharePointRest(siteUrl, `/_api/web/lists(guid'${listId}')/items(${pageItemId})?$select=Id,Title,FileLeafRef,CanvasContent1`, "GET");
+    const rawCanvas = result.d.CanvasContent1 || "";
+    // Extract all data-sp-controldata attribute values (encoded JSON)
+    const controlMatches = Array.from(rawCanvas.matchAll(/data-sp-controldata="([^"]*)"/g));
+    // Extract all data-sp-webpartdata attribute values (encoded JSON) in order
+    const webpartMatches = Array.from(rawCanvas.matchAll(/data-sp-webpartdata="([^"]*)"/g));
+    // Extract all RTE blocks (raw HTML inside data-sp-rte divs) in order
+    const rteMatches = Array.from(rawCanvas.matchAll(/data-sp-rte="">([\s\S]*?)<\/div>/g));
+    const webParts = [];
+    const textSections = [];
+    let wpIdx = 0;
+    let rteIdx = 0;
+    for (const ctrlMatch of controlMatches) {
+        const encodedControl = ctrlMatch[1];
+        if (!encodedControl)
+            continue;
+        let ctrl;
+        try {
+            ctrl = JSON.parse(decodeHtmlEntities(encodedControl));
+        }
+        catch {
+            continue;
+        }
+        const controlType = ctrl.controlType;
+        const position = ctrl.position || {};
+        const zoneIndex = position.zoneIndex ?? 0;
+        const sectionIndex = position.sectionIndex ?? 1;
+        const sectionFactor = position.sectionFactor;
+        const emphasis = ctrl.emphasis || {};
+        const zoneEmphasis = emphasis.zoneEmphasis;
+        // Skip system controls: 0=pageSettingsSlice, 1=empty section, 14=background
+        if (controlType === 0 || controlType === 1 || controlType === 14) {
+            continue;
+        }
+        if (controlType === 4) {
+            // RTE text block
+            const rteMatch = rteMatches[rteIdx++];
+            if (!rteMatch)
+                continue;
+            const rteHtml = rteMatch[1];
+            const headingMatch = rteHtml.match(/<h\d[^>]*>([\s\S]*?)<\/h\d>/);
+            const paragraphMatch = rteHtml.match(/<p[^>]*>([\s\S]*?)<\/p>/);
+            const section = {
+                zoneIndex,
+                sectionIndex,
+                heading: headingMatch ? stripHtmlTags(headingMatch[1]) : null,
+                content: paragraphMatch ? stripHtmlTags(paragraphMatch[1]) : "",
+            };
+            if (sectionFactor !== undefined)
+                section.sectionFactor = sectionFactor;
+            if (zoneEmphasis !== undefined)
+                section.zoneEmphasis = zoneEmphasis;
+            textSections.push(section);
+        }
+        else if (controlType === 3) {
+            // Web part
+            const wpMatch = webpartMatches[wpIdx++];
+            if (!wpMatch)
+                continue;
+            const encodedWp = wpMatch[1];
+            let wp;
+            try {
+                wp = JSON.parse(decodeHtmlEntities(encodedWp));
+            }
+            catch {
+                continue;
+            }
+            const webPartId = wp.id || "";
+            const type = KNOWN_WEB_PARTS[webPartId] || "Unknown";
+            const instanceId = wp.instanceId || "";
+            const serverContent = wp.serverProcessedContent || {};
+            const searchablePlainTexts = serverContent.searchablePlainTexts || {};
+            const properties = wp.properties || {};
+            if (type === "HighlightedContent") {
+                const filters = properties.query?.filters || [];
+                webParts.push({
+                    instanceId,
+                    type: "HighlightedContent",
+                    zoneIndex,
+                    sectionIndex,
+                    title: searchablePlainTexts.title || "",
+                    filter: filters[0]?.value || "",
+                    layout: properties.layoutId || "",
+                    maxItems: properties.maxItemsPerPage ?? 8,
+                });
+            }
+            else if (type === "QuickLinks") {
+                const linksMap = serverContent.links || {};
+                const links = [];
+                let i = 0;
+                while (searchablePlainTexts[`items[${i}].title`] !== undefined) {
+                    links.push({
+                        title: searchablePlainTexts[`items[${i}].title`] || "",
+                        description: searchablePlainTexts[`items[${i}].description`] || "",
+                        url: linksMap[`items[${i}].sourceItem.url`] || "",
+                    });
+                    i++;
+                }
+                webParts.push({
+                    instanceId,
+                    type: "QuickLinks",
+                    zoneIndex,
+                    sectionIndex,
+                    layout: properties.layoutId || "",
+                    links,
+                });
+            }
+            else {
+                webParts.push({
+                    instanceId,
+                    type: "Unknown",
+                    webPartId,
+                    zoneIndex,
+                    sectionIndex,
+                });
+            }
+        }
+    }
+    return {
+        id: result.d.Id,
+        title: result.d.Title,
+        fileName: result.d.FileLeafRef,
+        webParts,
+        textSections,
+    };
+}
 export async function setPageCanvasContent(siteUrl, pageItemId, canvasContent) {
     const listId = await getSitePagesListId(siteUrl);
     // Update CanvasContent1 field using MERGE
@@ -36,10 +186,200 @@ export async function copyPage(siteUrl, sourceFileName, targetFileName) {
         target: targetFileName,
     };
 }
-export async function listSitePages(siteUrl) {
+// ============ PATCH WEB PART (string-replace, never JSON round-trip) ============
+// HTML entity encoding for values going INTO data-sp-webpartdata attribute.
+// SharePoint uses ASCII-special entities but leaves Unicode as literal UTF-8.
+// Order matters: & must be first to avoid double-encoding.
+function encodeForWebpartData(str) {
+    return str
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/\{/g, "&#123;")
+        .replace(/\}/g, "&#125;")
+        .replace(/:/g, "&#58;")
+        .replace(/\[/g, "&#91;")
+        .replace(/\]/g, "&#93;");
+}
+// HTML escape for plain text going INTO a html div (data-sp-htmlproperties block).
+// Only escape characters that would break HTML parsing. Everything else stays literal.
+function escapeForHtmlText(str) {
+    return str
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+// Locate the data-sp-webpartdata="..." attribute value containing a given instanceId.
+// Returns { attrStart, attrEnd } as indices into the canvas string, delimiting the
+// value between the opening `data-sp-webpartdata="` and the closing `"`.
+// Returns null if not found.
+function locateWebpartDataAttr(canvas, instanceId) {
+    const encodedInstanceIdPattern = `&quot;instanceId&quot;&#58;&quot;${instanceId}&quot;`;
+    const instanceIdPos = canvas.indexOf(encodedInstanceIdPattern);
+    if (instanceIdPos === -1)
+        return null;
+    const attrOpenMarker = 'data-sp-webpartdata="';
+    const attrOpenPos = canvas.lastIndexOf(attrOpenMarker, instanceIdPos);
+    if (attrOpenPos === -1)
+        return null;
+    const attrStart = attrOpenPos + attrOpenMarker.length;
+    const attrEnd = canvas.indexOf('"', attrStart);
+    if (attrEnd === -1)
+        return null;
+    if (instanceIdPos >= attrEnd)
+        return null;
+    return { attrStart, attrEnd };
+}
+// Locate the <div data-sp-prop-name="title" ...>TEXT</div> element for a specific
+// web part. The htmlproperties div comes AFTER webpartdata attribute within the
+// same <div data-sp-webpart=""> block. We scan forward from the end of webpartdata
+// and stop before any next data-sp-webpart= (which would belong to a different web part).
+function locateHtmlPropertiesTitle(canvas, webpartAttrEnd) {
+    const nextWebpartPos = canvas.indexOf('data-sp-webpart="', webpartAttrEnd);
+    const searchLimit = nextWebpartPos === -1 ? canvas.length : nextWebpartPos;
+    const openMarker = '<div data-sp-prop-name="title" data-sp-searchableplaintext="true">';
+    const openPos = canvas.indexOf(openMarker, webpartAttrEnd);
+    if (openPos === -1 || openPos >= searchLimit)
+        return null;
+    const titleStart = openPos + openMarker.length;
+    const closeMarker = '</div>';
+    const closePos = canvas.indexOf(closeMarker, titleStart);
+    if (closePos === -1 || closePos >= searchLimit)
+        return null;
+    return { titleStart, titleEnd: closePos };
+}
+export async function patchPageCanvasWebpart(siteUrl, pageItemId, patches, verify = true) {
+    // 1. Read current canvas
+    const { canvasContent: originalCanvas } = await getPageCanvasContent(siteUrl, pageItemId);
+    if (!originalCanvas) {
+        throw new Error(`Page ${pageItemId} has empty canvasContent — nothing to patch`);
+    }
+    // 2. Use summary to get authoritative current values per instanceId
+    // (string-replace needs old values to search for)
+    const summary = await getPageCanvasSummary(siteUrl, pageItemId);
+    const summaryByInstanceId = new Map();
+    for (const wp of summary.webParts) {
+        summaryByInstanceId.set(wp.instanceId, wp);
+    }
+    let canvas = originalCanvas;
+    const patched = [];
+    const notFound = [];
+    for (const patch of patches) {
+        const currentWp = summaryByInstanceId.get(patch.instanceId);
+        if (!currentWp) {
+            notFound.push(patch.instanceId);
+            continue;
+        }
+        const webpartAttr = locateWebpartDataAttr(canvas, patch.instanceId);
+        if (!webpartAttr) {
+            notFound.push(patch.instanceId);
+            continue;
+        }
+        let webpartValue = canvas.slice(webpartAttr.attrStart, webpartAttr.attrEnd);
+        const beforeAttr = canvas.slice(0, webpartAttr.attrStart);
+        const afterAttr = canvas.slice(webpartAttr.attrEnd);
+        if (patch.title !== undefined) {
+            const oldTitle = currentWp.title || "";
+            const encodedOld = encodeForWebpartData(oldTitle);
+            const encodedNew = encodeForWebpartData(patch.title);
+            // Match inside searchablePlainTexts only — don't touch the generic wp.title "Highlighted content"
+            const oldPattern = `&quot;searchablePlainTexts&quot;&#58;&#123;&quot;title&quot;&#58;&quot;${encodedOld}&quot;`;
+            const newPattern = `&quot;searchablePlainTexts&quot;&#58;&#123;&quot;title&quot;&#58;&quot;${encodedNew}&quot;`;
+            webpartValue = webpartValue.replace(oldPattern, newPattern);
+        }
+        if (patch.filter !== undefined && currentWp.type === "HighlightedContent") {
+            const oldFilter = currentWp.filter || "";
+            const encodedOld = encodeForWebpartData(oldFilter);
+            const encodedNew = encodeForWebpartData(patch.filter);
+            const oldPattern = `&quot;filters&quot;&#58;[&#123;&quot;filterType&quot;&#58;1,&quot;value&quot;&#58;&quot;${encodedOld}&quot;`;
+            const newPattern = `&quot;filters&quot;&#58;[&#123;&quot;filterType&quot;&#58;1,&quot;value&quot;&#58;&quot;${encodedNew}&quot;`;
+            webpartValue = webpartValue.replace(oldPattern, newPattern);
+        }
+        if (patch.maxItems !== undefined && currentWp.type === "HighlightedContent") {
+            const oldMax = currentWp.maxItems;
+            const oldPattern = `&quot;maxItemsPerPage&quot;&#58;${oldMax},`;
+            const newPattern = `&quot;maxItemsPerPage&quot;&#58;${patch.maxItems},`;
+            webpartValue = webpartValue.replace(oldPattern, newPattern);
+        }
+        if (patch.layout !== undefined) {
+            const oldLayout = currentWp.layout || "";
+            const encodedOld = encodeForWebpartData(oldLayout);
+            const encodedNew = encodeForWebpartData(patch.layout);
+            const oldPattern = `&quot;layoutId&quot;&#58;&quot;${encodedOld}&quot;`;
+            const newPattern = `&quot;layoutId&quot;&#58;&quot;${encodedNew}&quot;`;
+            webpartValue = webpartValue.replace(oldPattern, newPattern);
+        }
+        canvas = beforeAttr + webpartValue + afterAttr;
+        // Title also lives in data-sp-htmlproperties div (plain HTML, not entity-encoded).
+        // Re-locate after the earlier string replace to get up-to-date indices.
+        if (patch.title !== undefined) {
+            const relocated = locateWebpartDataAttr(canvas, patch.instanceId);
+            if (relocated) {
+                const titleLoc = locateHtmlPropertiesTitle(canvas, relocated.attrEnd);
+                if (titleLoc) {
+                    const escapedNewTitle = escapeForHtmlText(patch.title);
+                    canvas =
+                        canvas.slice(0, titleLoc.titleStart) +
+                            escapedNewTitle +
+                            canvas.slice(titleLoc.titleEnd);
+                }
+            }
+        }
+        patched.push(patch.instanceId);
+    }
+    // 3. Write the modified canvas back
+    await setPageCanvasContent(siteUrl, pageItemId, canvas);
+    // 4. Optional verification: read back and confirm new values are present
+    let verifyFailed;
+    if (verify && patched.length > 0) {
+        const verifySummary = await getPageCanvasSummary(siteUrl, pageItemId);
+        const verifyByInstanceId = new Map();
+        for (const wp of verifySummary.webParts) {
+            verifyByInstanceId.set(wp.instanceId, wp);
+        }
+        const failed = [];
+        for (const patch of patches) {
+            if (!patched.includes(patch.instanceId))
+                continue;
+            const wp = verifyByInstanceId.get(patch.instanceId);
+            if (!wp) {
+                failed.push(patch.instanceId);
+                continue;
+            }
+            if (patch.title !== undefined && wp.title !== patch.title) {
+                failed.push(patch.instanceId);
+                continue;
+            }
+            if (patch.filter !== undefined && wp.filter !== patch.filter) {
+                failed.push(patch.instanceId);
+                continue;
+            }
+            if (patch.maxItems !== undefined && wp.maxItems !== patch.maxItems) {
+                failed.push(patch.instanceId);
+                continue;
+            }
+            if (patch.layout !== undefined && wp.layout !== patch.layout) {
+                failed.push(patch.instanceId);
+                continue;
+            }
+        }
+        if (failed.length > 0) {
+            verifyFailed = failed;
+        }
+    }
+    return {
+        success: notFound.length === 0 && (!verifyFailed || verifyFailed.length === 0),
+        pageItemId,
+        patched,
+        notFound,
+        ...(verifyFailed ? { verifyFailed } : {}),
+    };
+}
+export async function fetchSitePageItemIdMap(siteUrl) {
     const listId = await getSitePagesListId(siteUrl);
     const allPages = [];
-    let nextPath = `/_api/web/lists(guid'${listId}')/items?$select=Id,Title,FileLeafRef&$top=100`;
+    let nextPath = `/_api/web/lists(guid'${listId}')/items?$select=Id,FileLeafRef&$top=100`;
     while (nextPath) {
         const result = await callSharePointRest(siteUrl, nextPath, "GET");
         allPages.push(...result.d.results);
@@ -51,9 +391,5 @@ export async function listSitePages(siteUrl) {
             nextPath = null;
         }
     }
-    return allPages.map((page) => ({
-        itemId: page.Id,
-        title: page.Title,
-        fileName: page.FileLeafRef,
-    }));
+    return new Map(allPages.map((page) => [page.FileLeafRef, page.Id]));
 }

package/dist/tools/pages.d.ts

@@ -1,5 +1,5 @@
-export declare function listPages(siteId: string): Promise<any>;
-export declare function createPage(siteId: string, title: string, name: string, layoutType?: string): Promise<{
+export declare function listPages(siteId: string, siteUrl?: string, includeItemId?: boolean): Promise<any>;
+export declare function createPage(siteId: string, title: string, name: string, pageLayout?: "article" | "home"): Promise<{
     id: any;
     name: any;
     title: any;

package/dist/tools/pages.js

@@ -1,24 +1,39 @@
 import { graphClient } from "../auth.js";
-export async function listPages(siteId) {
-    const result = await graphClient
+import { fetchSitePageItemIdMap } from "./pages-rest.js";
+export async function listPages(siteId, siteUrl, includeItemId = false) {
+    const graphResult = await graphClient
         .api(`/sites/${siteId}/pages`)
         .get();
-    return result.value.map((page) => ({
+    if (!includeItemId) {
+        return graphResult.value.map((page) => ({
+            id: page.id,
+            name: page.name,
+            title: page.title,
+            url: page.webUrl,
+            publishingState: page.publishingState?.level,
+        }));
+    }
+    if (!siteUrl) {
+        throw new Error("siteUrl is required when includeItemId is true");
+    }
+    const fileNameToItemId = await fetchSitePageItemIdMap(siteUrl);
+    return graphResult.value.map((page) => ({
         id: page.id,
+        itemId: fileNameToItemId.get(page.name),
         name: page.name,
         title: page.title,
         url: page.webUrl,
         publishingState: page.publishingState?.level,
     }));
 }
-export async function createPage(siteId, title, name, layoutType = "article") {
+export async function createPage(siteId, title, name, pageLayout = "article") {
     const result = await graphClient
         .api(`/sites/${siteId}/pages`)
         .post({
         "@odata.type": "#microsoft.graph.sitePage",
         name: name.endsWith(".aspx") ? name : `${name}.aspx`,
         title,
-        pageLayout: layoutType,
+        pageLayout,
         showComments: false,
         showRecommendedPages: false,
         titleArea: {

package/dist/tools/permissions.d.ts

@@ -1,4 +1,4 @@
-export declare function getSitePermissions(siteUrl: string): Promise<any>;
+export declare function getSitePermissions(siteUrl: string, includeMembers?: boolean): Promise<any>;
 export declare function getGroupMembers(siteUrl: string, groupId: number): Promise<any>;
 export declare function addUserToGroup(siteUrl: string, groupId: number, userEmail: string): Promise<{
     id: any;

package/dist/tools/permissions.js

@@ -1,14 +1,30 @@
 import { callSharePointRest } from "../auth.js";
-export async function getSitePermissions(siteUrl) {
-    // Get all SharePoint groups for this site
-    const result = await callSharePointRest(siteUrl, "/_api/web/sitegroups", "GET");
-    return result.d.results.map((group) => ({
-        id: group.Id,
-        title: group.Title,
-        description: group.Description,
-        ownerTitle: group.OwnerTitle,
-        userCount: group.Users ? group.Users.results?.length : undefined,
-    }));
+export async function getSitePermissions(siteUrl, includeMembers = false) {
+    // Default: groups only. With includeMembers: expand Users and select minimal fields
+    // to avoid the N+1 pattern (get_permissions + N × get_group_members).
+    const apiPath = includeMembers
+        ? "/_api/web/sitegroups?$expand=Users&$select=Id,Title,Description,OwnerTitle,Users/Id,Users/Title,Users/Email,Users/LoginName"
+        : "/_api/web/sitegroups";
+    const result = await callSharePointRest(siteUrl, apiPath, "GET");
+    return result.d.results.map((group) => {
+        const base = {
+            id: group.Id,
+            title: group.Title,
+            description: group.Description,
+            ownerTitle: group.OwnerTitle,
+        };
+        if (!includeMembers)
+            return base;
+        return {
+            ...base,
+            members: (group.Users?.results || []).map((u) => ({
+                id: u.Id,
+                title: u.Title,
+                email: u.Email,
+                loginName: u.LoginName,
+            })),
+        };
+    });
 }
 export async function getGroupMembers(siteUrl, groupId) {
     const result = await callSharePointRest(siteUrl, `/_api/web/sitegroups/getbyid(${groupId})/users`, "GET");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "365center-mcp",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "MCP server for Microsoft 365 / Office 365 SharePoint — full read-write access to sites, documents, pages, metadata, navigation, and permissions",
   "type": "module",
   "main": "dist/index.js",
@@ -39,9 +39,10 @@
   },
   "homepage": "https://github.com/Crscristi28/365center-mcp#readme",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
     "@azure/identity": "^4.9.1",
     "@microsoft/microsoft-graph-client": "^3.0.7",
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@napi-rs/keyring": "^1.2.0",
     "dotenv": "^16.5.0"
   },
   "devDependencies": {