365center-mcp 1.3.0 → 1.4.0

package/README.md

@@ -1,6 +1,6 @@
 # 365center-mcp
 
-**MCP server for Microsoft 365 / SharePoint — 36 tools for full read/write access**
+**MCP server for Microsoft 365 / SharePoint — 30+ tools for full read/write access**
 
 Available on [GitHub](https://github.com/Crscristi28/365center-mcp) · [npm](https://www.npmjs.com/package/365center-mcp) · [Docker Hub](https://hub.docker.com/r/crscristi28/365center-mcp) · [cristianb.cz](https://cristianb.cz)
 
@@ -56,7 +56,7 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 
 ## Features
 
-**36 tools** across 7 categories. All tools use Microsoft Graph API or SharePoint REST API — no middlemen.
+**30+ tools** across 7 categories. All tools use Microsoft Graph API or SharePoint REST API — no middlemen.
 
 ### Sites (4 tools)
 - `list_sites` — List all SharePoint sites in the tenant
@@ -65,7 +65,7 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 - `create_site` — Create a new Communication or Team site
 
 ### Documents (9 tools)
-- `list_document_libraries` — List document libraries (drives)
+- `list_document_libraries` — List document libraries. Returns `driveId` (for file operations) and `listId` (for metadata operations) — call this first when working with documents.
 - `list_documents` — List documents with both driveItemId and listItemId. Optional `fields: "minimal"` returns only id/name/isFolder/size (~74% token savings for exploration).
 - `upload_document` — Upload a file to SharePoint (auto session upload for files over 4 MB)
 - `upload_documents` — Upload multiple files with optional metadata in one call (max 30 per call)
@@ -75,10 +75,11 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 - `create_folder` — Create folders
 - `get_document_versions` — Version history (audit trail)
 
-### Metadata (5 tools)
+### Metadata (6 tools)
 - `list_columns` — List custom metadata columns
 - `create_choice_column` — Create choice/dropdown columns (single or multi-select)
 - `create_text_column` — Create text columns
+- `delete_column` — Permanently delete a column from a list or document library (irreversible)
 - `get_document_metadata` — Read document metadata
 - `set_document_metadata` — Set metadata on documents
 
@@ -103,7 +104,7 @@ Built for manufacturing companies managing factory documentation in SharePoint,
 - `delete_navigation_link` — Remove link from navigation
 
 ### Permissions (4 tools)
-- `get_permissions` — List SharePoint groups (Visitors, Members, Owners)
+- `get_permissions` — List SharePoint groups (Visitors, Members, Owners). Optional `includeMembers: true` returns members inside each group in a single call.
 - `get_group_members` — List members of a group
 - `add_user_to_group` — Add user to a group
 - `remove_user_from_group` — Remove user from a group

package/dist/auth.js

@@ -1,6 +1,7 @@
 import { ClientSecretCredential } from "@azure/identity";
 import { Client } from "@microsoft/microsoft-graph-client";
 import { TokenCredentialAuthenticationProvider } from "@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials/index.js";
+import { Entry } from "@napi-rs/keyring";
 import dotenv from "dotenv";
 import path from "path";
 import { fileURLToPath } from "url";
@@ -20,29 +21,70 @@ export const graphClient = Client.initWithMiddleware({
     authProvider,
 });
 // ============ DELEGATED AUTH (SharePoint REST API) ============
-// Store token in user's home directory — works for Node, Docker (with volume), and plugins
+// Refresh token storage: OS keyring (macOS Keychain / Windows Credential Manager / Linux libsecret)
+// with file fallback (chmod 600) for headless / Docker / keyring-less environments.
+// Access token is kept in-memory only — never written to disk.
+const KEYRING_SERVICE = "365center-mcp";
+const KEYRING_ACCOUNT = "refresh-token";
 const TOKEN_DIR = path.join(process.env.HOME || process.env.USERPROFILE || "/tmp", ".365center-mcp");
-if (!fs.existsSync(TOKEN_DIR))
-    fs.mkdirSync(TOKEN_DIR, { recursive: true });
-const TOKEN_CACHE_PATH = path.join(TOKEN_DIR, "token-cache.json");
+const TOKEN_FILE = path.join(TOKEN_DIR, "refresh-token");
 const SHAREPOINT_DOMAIN = process.env.SHAREPOINT_DOMAIN || "";
 const SP_SCOPES = `offline_access https://${SHAREPOINT_DOMAIN}/AllSites.FullControl`;
-function loadTokenCache() {
+let cachedAccessToken = null;
+function loadRefreshToken() {
     try {
-        if (fs.existsSync(TOKEN_CACHE_PATH)) {
-            return JSON.parse(fs.readFileSync(TOKEN_CACHE_PATH, "utf-8"));
+        const v = new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).getPassword();
+        if (v)
+            return v;
+    }
+    catch { }
+    try {
+        if (fs.existsSync(TOKEN_FILE)) {
+            return fs.readFileSync(TOKEN_FILE, "utf-8").trim() || null;
         }
     }
     catch { }
     return null;
 }
-function saveTokenCache(cache) {
-    fs.writeFileSync(TOKEN_CACHE_PATH, JSON.stringify(cache, null, 2));
+function saveRefreshToken(token) {
+    try {
+        new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).setPassword(token);
+        return;
+    }
+    catch { }
+    try {
+        if (!fs.existsSync(TOKEN_DIR)) {
+            fs.mkdirSync(TOKEN_DIR, { recursive: true });
+        }
+        try {
+            fs.chmodSync(TOKEN_DIR, 0o700);
+        }
+        catch { }
+        fs.writeFileSync(TOKEN_FILE, token);
+        try {
+            fs.chmodSync(TOKEN_FILE, 0o600);
+        }
+        catch { }
+    }
+    catch { }
+}
+function clearRefreshToken() {
+    try {
+        new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).deletePassword();
+    }
+    catch { }
+    try {
+        if (fs.existsSync(TOKEN_FILE))
+            fs.unlinkSync(TOKEN_FILE);
+    }
+    catch { }
+    cachedAccessToken = null;
 }
 async function refreshAccessToken(refreshToken) {
+    // Device code flow uses a public client — client_secret must NOT be sent
+    // (Microsoft returns AADSTS700025 if included).
     const body = new URLSearchParams({
         client_id: clientId,
-        client_secret: clientSecret,
         grant_type: "refresh_token",
         refresh_token: refreshToken,
         scope: SP_SCOPES,
@@ -53,13 +95,16 @@ async function refreshAccessToken(refreshToken) {
         throw new Error(`Token refresh failed: ${err}`);
     }
     const data = await response.json();
-    const cache = {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token || refreshToken,
+    const accessToken = data.access_token;
+    const newRefreshToken = data.refresh_token || refreshToken;
+    cachedAccessToken = {
+        token: accessToken,
         expiresAt: Date.now() + data.expires_in * 1000,
     };
-    saveTokenCache(cache);
-    return cache;
+    if (newRefreshToken !== refreshToken) {
+        saveRefreshToken(newRefreshToken);
+    }
+    return accessToken;
 }
 // Device code polling — runs in background after user gets instructions
 let deviceCodePollingPromise = null;
@@ -80,14 +125,15 @@ function pollForDeviceCodeToken(deviceCode, interval, expiresIn) {
             });
             const tokenData = await tokenResponse.json();
             if (tokenData.access_token) {
-                const cache = {
-                    accessToken: tokenData.access_token,
-                    refreshToken: tokenData.refresh_token,
+                cachedAccessToken = {
+                    token: tokenData.access_token,
                     expiresAt: Date.now() + tokenData.expires_in * 1000,
                 };
-                saveTokenCache(cache);
+                if (tokenData.refresh_token) {
+                    saveRefreshToken(tokenData.refresh_token);
+                }
                 deviceCodePollingPromise = null;
-                resolve(cache);
+                resolve(tokenData.access_token);
                 return;
             }
             if (tokenData.error === "authorization_pending")
@@ -123,7 +169,9 @@ async function startDeviceCodeFlow() {
     }
     const codeData = await codeResponse.json();
     const { device_code, user_code, verification_uri, expires_in, interval, message } = codeData;
-    // Start polling in background
+    // Start polling in background. Clear any stale refresh token so a stuck/invalid
+    // one from a previous run doesn't race the device code flow.
+    clearRefreshToken();
     deviceCodePollingPromise = pollForDeviceCodeToken(device_code, interval, expires_in);
     // Throw error with login instructions — Claude sees this and tells the user
     throw new Error(`LOGIN REQUIRED: ${message}\n\n` +
@@ -132,26 +180,25 @@ async function startDeviceCodeFlow() {
         `After logging in, try your request again.`);
 }
 export async function getDelegatedToken() {
-    // 1. Check cache
-    const cache = loadTokenCache();
-    if (cache) {
-        if (cache.expiresAt > Date.now() + 300000) {
-            return cache.accessToken;
-        }
+    // 1. In-memory access token still valid?
+    if (cachedAccessToken && cachedAccessToken.expiresAt > Date.now() + 300000) {
+        return cachedAccessToken.token;
+    }
+    // 2. Try refresh token from keyring/file
+    const refreshToken = loadRefreshToken();
+    if (refreshToken) {
         try {
-            const refreshed = await refreshAccessToken(cache.refreshToken);
-            return refreshed.accessToken;
+            return await refreshAccessToken(refreshToken);
         }
         catch {
-            // Refresh failed — need new login
+            // Refresh failed (expired/revoked) — fall through to device code flow
         }
     }
-    // 2. If polling is already running, wait for it
+    // 3. If polling is already running, wait for it
     if (deviceCodePollingPromise) {
-        const result = await deviceCodePollingPromise;
-        return result.accessToken;
+        return await deviceCodePollingPromise;
     }
-    // 3. No cache, no polling — start device code flow (throws with instructions)
+    // 4. No cache, no polling — start device code flow (throws with instructions)
     await startDeviceCodeFlow();
     throw new Error("unreachable"); // startDeviceCodeFlow always throws
 }

package/dist/index.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 import path from "path";
 import { listSites, getSite, getSiteById } from "./tools/sites.js";
 import { listDocumentLibraries, listDocuments, uploadDocument, uploadDocuments, downloadDocument, searchDocuments, deleteDocument, createFolder, getDocumentVersions } from "./tools/documents.js";
-import { listColumns, createChoiceColumn, createTextColumn, setDocumentMetadata, getDocumentMetadata } from "./tools/metadata.js";
+import { listColumns, createChoiceColumn, createTextColumn, deleteColumn, setDocumentMetadata, getDocumentMetadata } from "./tools/metadata.js";
 import { listPages, createPage, createPageWithContent, addQuickLinksWebPart, publishPage, deletePage } from "./tools/pages.js";
 import { getNavigation, addNavigationLink, deleteNavigationLink } from "./tools/navigation.js";
 import { getPageCanvasContent, getPageCanvasSummary, setPageCanvasContent, copyPage, patchPageCanvasWebpart } from "./tools/pages-rest.js";
@@ -41,7 +41,7 @@ server.tool("create_site", "Create a new SharePoint site. Template: 'communicati
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 // ============ DOCUMENTS ============
-server.tool("list_document_libraries", "List all document libraries (drives) in a SharePoint site. Returns driveId and listId for each library. Use driveId for file operations (upload, download, delete, list, versions). Use listId for metadata operations (list_columns, get/set_document_metadata, create columns). Call this first when working with documents — you need both IDs.", { siteId: z.string().describe("SharePoint site ID") }, async ({ siteId }) => {
+server.tool("list_document_libraries", "List all document libraries in a SharePoint site. Returns driveId, listId, name, and URL for each library. Use driveId for file operations (upload, download, delete, list, versions). Use listId for metadata operations (list_columns, get/set_document_metadata, create columns). Call this first when working with documents — you need both IDs.", { siteId: z.string().describe("SharePoint site ID") }, async ({ siteId }) => {
     const libraries = await listDocumentLibraries(siteId);
     return { content: [{ type: "text", text: JSON.stringify(libraries, null, 2) }] };
 });
@@ -125,14 +125,14 @@ server.tool("get_document_versions", "Get version history of a document (audit t
 // ============ METADATA ============
 server.tool("list_columns", "List custom metadata columns in a SharePoint list/library. listId can be display name (e.g. 'Documents') or GUID. Returns internal name, display name, type, and choices. Call this before set_document_metadata — internal column names (used in API) often differ from display names (shown in UI). Using wrong name fails silently.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
 }, async ({ siteId, listId }) => {
     const columns = await listColumns(siteId, listId);
     return { content: [{ type: "text", text: JSON.stringify(columns, null, 2) }] };
 });
 server.tool("create_choice_column", "Create a choice/dropdown metadata column in a SharePoint list or document library. Use allowMultiple:true for multi-select checkboxes (e.g. document belongs to multiple areas). Column 'name' is the internal API name (no spaces/special chars), 'displayName' is what users see in SharePoint UI. The column must be created BEFORE setting metadata values on documents.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     name: z.string().describe("Internal column name"),
     displayName: z.string().describe("Display name shown in UI"),
     choices: z.array(z.string()).describe("List of choices"),
@@ -143,16 +143,24 @@ server.tool("create_choice_column", "Create a choice/dropdown metadata column in
 });
 server.tool("create_text_column", "Create a single-line text metadata column in a SharePoint list or document library. Column 'name' is the internal API name (no spaces/special chars), 'displayName' is what users see in SharePoint UI. The column must be created BEFORE setting metadata values on documents.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     name: z.string().describe("Internal column name"),
     displayName: z.string().describe("Display name shown in UI"),
 }, async ({ siteId, listId, name, displayName }) => {
     const result = await createTextColumn(siteId, listId, name, displayName);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
+server.tool("delete_column", "PERMANENTLY delete a column from a SharePoint list or document library. This action is irreversible — the column definition and all associated metadata values on items are removed. Always confirm with the user before deleting. Use list_columns to find the columnId.", {
+    siteId: z.string().describe("SharePoint site ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
+    columnId: z.string().describe("Column GUID (from list_columns)"),
+}, async ({ siteId, listId, columnId }) => {
+    const result = await deleteColumn(siteId, listId, columnId);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+});
 server.tool("set_document_metadata", "Set metadata fields on a document. 'fields' is a JSON string of key-value pairs using column internal names. Choice values must match predefined choices exactly (case-sensitive). Multi-select: use array of strings. Columns must exist first — check with list_columns. Accepts drive item ID (requires driveId) or numeric list item ID. Only change fields the user asked for — leave others untouched. TIP: Changing a Status field (e.g. to 'Pending Approval') can trigger Power Automate flows with 'When item modified' trigger — no HTTP webhooks or extra tools needed.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     itemId: z.string().describe("Document ID — either numeric list item ID or drive item ID"),
     fields: z.string().describe("JSON string of key-value pairs, e.g. {\"Oblast\":\"Linka 1\",\"Status\":\"Platný\"}"),
     driveId: z.string().optional().describe("Drive ID — required when itemId is a drive item ID (non-numeric)"),
@@ -163,7 +171,7 @@ server.tool("set_document_metadata", "Set metadata fields on a document. 'fields
 });
 server.tool("get_document_metadata", "Get all metadata fields of a document including custom columns. Accepts both drive item ID and numeric list item ID — if using drive item ID, provide driveId. Returns all field values including system fields and custom metadata.", {
     siteId: z.string().describe("SharePoint site ID"),
-    listId: z.string().describe("List or document library list ID"),
+    listId: z.string().describe("List ID (GUID) or display name (e.g. 'Documents')"),
     itemId: z.string().describe("Document ID — either numeric list item ID or drive item ID"),
     driveId: z.string().optional().describe("Drive ID — required when itemId is a drive item ID (non-numeric)"),
 }, async ({ siteId, listId, itemId, driveId }) => {
@@ -183,8 +191,9 @@ server.tool("create_page", "Create a new empty page in checkout/draft state. MUS
     siteId: z.string().describe("SharePoint site ID"),
     title: z.string().describe("Page title"),
     name: z.string().describe("Page file name (without .aspx)"),
-}, async ({ siteId, title, name }) => {
-    const result = await createPage(siteId, title, name);
+    pageLayout: z.enum(["article", "home"]).optional().describe("Page layout. 'article' (default) — standard content page with title banner (image, title, author, date) above the canvas. Use for 99% of pages. 'home' — dashboard-style layout without title banner, canvas goes full-width from the top. Use only when you explicitly want a landing-page feel. Note: 'home' does NOT set the page as the site's actual home page — that's a separate site setting."),
+}, async ({ siteId, title, name, pageLayout }) => {
+    const result = await createPage(siteId, title, name, pageLayout);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 server.tool("create_page_with_content", "Create a page with HTML text sections. Draft state — MUST call publish_page after. Sections is a JSON string array. Layouts: oneColumn (12), twoColumns (6+6), threeColumns (4+4+4), oneThirdLeftColumn (4+8), oneThirdRightColumn (8+4), fullWidth (12). Example: [{\"layout\":\"twoColumns\",\"columns\":[{\"width\":6,\"html\":\"<h2>Left</h2>\"},{\"width\":6,\"html\":\"<h2>Right</h2>\"}]}]. NOTE: Only supports text/HTML. For web parts like Highlighted Content, use create_page + set_page_canvas_content instead.", {
@@ -245,8 +254,11 @@ server.tool("delete_navigation_link", "Remove a link from the top navigation men
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 // ============ PERMISSIONS ============
-server.tool("get_permissions", "Get all SharePoint groups (Visitors, Members, Owners, custom) for a site. Returns group ID, title, and description. Use group ID with get_group_members to see who is in each group, or with add_user_to_group/remove_user_from_group to manage membership. Uses SharePoint REST API with delegated auth.", { siteUrl: z.string().describe("Full SharePoint site URL (e.g. https://contoso.sharepoint.com/sites/MySite)") }, async ({ siteUrl }) => {
-    const result = await getSitePermissions(siteUrl);
+server.tool("get_permissions", "Get all SharePoint groups (Visitors, Members, Owners, custom) for a site. Returns group ID, title, description, and owner title. With includeMembers: true, also returns all users in each group in a single call (id, title, email, loginName) — avoids calling get_group_members separately for each group. Uses SharePoint REST API with delegated auth.", {
+    siteUrl: z.string().describe("Full SharePoint site URL (e.g. https://contoso.sharepoint.com/sites/MySite)"),
+    includeMembers: z.boolean().optional().describe("If true, include member list (id, title, email, loginName) inside each group — single call for full permission overview. If false/omitted, returns groups only."),
+}, async ({ siteUrl, includeMembers }) => {
+    const result = await getSitePermissions(siteUrl, includeMembers);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
 server.tool("get_group_members", "Get all members of a SharePoint group. Use get_permissions first to find the groupId. Returns user ID, name, email, and login name for each member.", {

package/dist/tools/documents.js

@@ -4,14 +4,16 @@ import fs from "fs";
 import path from "path";
 import { Readable } from "stream";
 export async function listDocumentLibraries(siteId) {
+    // Single call with $expand=list($select=id) gives us both driveId (for file ops)
+    // and listId (for metadata ops) — drive.list is the associated SharePoint list.
     const result = await graphClient
-        .api(`/sites/${siteId}/drives`)
+        .api(`/sites/${siteId}/drives?$expand=list($select=id)`)
         .get();
     return result.value.map((drive) => ({
-        id: drive.id,
+        driveId: drive.id,
+        listId: drive.list?.id,
         name: drive.name,
         url: drive.webUrl,
-        itemCount: drive.quota?.used,
     }));
 }
 export async function listDocuments(siteId, driveId, folderId = "root", fields = "all") {
@@ -181,7 +183,8 @@ export async function getDocumentVersions(siteId, driveId, itemId) {
 }
 export async function uploadDocuments(siteId, driveId, listId, files, folderId = "root") {
     const results = [];
-    for (const file of files) {
+    for (let i = 0; i < files.length; i++) {
+        const file = files[i];
         const entry = { fileName: file.fileName, status: "ok" };
         try {
             const uploaded = await uploadDocument(siteId, driveId, file.fileName, file.filePath, folderId);
@@ -207,7 +210,9 @@ export async function uploadDocuments(siteId, driveId, listId, files, folderId =
             entry.metadataStatus = "skipped";
         }
         results.push(entry);
-        await new Promise((r) => setTimeout(r, 500));
+        if (i < files.length - 1) {
+            await new Promise((r) => setTimeout(r, 500));
+        }
     }
     return results;
 }

package/dist/tools/metadata.d.ts

@@ -5,6 +5,10 @@ export declare function createChoiceColumn(siteId: string, listId: string, name:
     displayName: any;
     allowMultiple: boolean;
 }>;
+export declare function deleteColumn(siteId: string, listId: string, columnId: string): Promise<{
+    success: boolean;
+    columnId: string;
+}>;
 export declare function createTextColumn(siteId: string, listId: string, name: string, displayName: string): Promise<{
     id: any;
     name: any;

package/dist/tools/metadata.js

@@ -61,7 +61,10 @@ export async function createChoiceColumn(siteId, listId, name, displayName, choi
     }
     const site = await graphClient.api(`/sites/${siteId}`).select("webUrl").get();
     const siteUrl = site.webUrl;
-    const result = await callSharePointRest(siteUrl, `/_api/web/lists/getByTitle('${listId}')/fields`, "POST", {
+    const listIdentifier = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(listId)
+        ? `lists(guid'${listId}')`
+        : `lists/getByTitle('${listId}')`;
+    const result = await callSharePointRest(siteUrl, `/_api/web/${listIdentifier}/fields`, "POST", {
         __metadata: { type: "SP.FieldMultiChoice" },
         FieldTypeKind: 15,
         Title: displayName,
@@ -76,6 +79,12 @@ export async function createChoiceColumn(siteId, listId, name, displayName, choi
         allowMultiple: true,
     };
 }
+export async function deleteColumn(siteId, listId, columnId) {
+    await graphClient
+        .api(`/sites/${siteId}/lists/${listId}/columns/${columnId}`)
+        .delete();
+    return { success: true, columnId };
+}
 export async function createTextColumn(siteId, listId, name, displayName) {
     const result = await graphClient
         .api(`/sites/${siteId}/lists/${listId}/columns`)

package/dist/tools/pages.d.ts

@@ -1,5 +1,5 @@
 export declare function listPages(siteId: string, siteUrl?: string, includeItemId?: boolean): Promise<any>;
-export declare function createPage(siteId: string, title: string, name: string, layoutType?: string): Promise<{
+export declare function createPage(siteId: string, title: string, name: string, pageLayout?: "article" | "home"): Promise<{
     id: any;
     name: any;
     title: any;

package/dist/tools/pages.js

@@ -26,14 +26,14 @@ export async function listPages(siteId, siteUrl, includeItemId = false) {
         publishingState: page.publishingState?.level,
     }));
 }
-export async function createPage(siteId, title, name, layoutType = "article") {
+export async function createPage(siteId, title, name, pageLayout = "article") {
     const result = await graphClient
         .api(`/sites/${siteId}/pages`)
         .post({
         "@odata.type": "#microsoft.graph.sitePage",
         name: name.endsWith(".aspx") ? name : `${name}.aspx`,
         title,
-        pageLayout: layoutType,
+        pageLayout,
         showComments: false,
         showRecommendedPages: false,
         titleArea: {

package/dist/tools/permissions.d.ts

@@ -1,4 +1,4 @@
-export declare function getSitePermissions(siteUrl: string): Promise<any>;
+export declare function getSitePermissions(siteUrl: string, includeMembers?: boolean): Promise<any>;
 export declare function getGroupMembers(siteUrl: string, groupId: number): Promise<any>;
 export declare function addUserToGroup(siteUrl: string, groupId: number, userEmail: string): Promise<{
     id: any;

package/dist/tools/permissions.js

@@ -1,14 +1,30 @@
 import { callSharePointRest } from "../auth.js";
-export async function getSitePermissions(siteUrl) {
-    // Get all SharePoint groups for this site
-    const result = await callSharePointRest(siteUrl, "/_api/web/sitegroups", "GET");
-    return result.d.results.map((group) => ({
-        id: group.Id,
-        title: group.Title,
-        description: group.Description,
-        ownerTitle: group.OwnerTitle,
-        userCount: group.Users ? group.Users.results?.length : undefined,
-    }));
+export async function getSitePermissions(siteUrl, includeMembers = false) {
+    // Default: groups only. With includeMembers: expand Users and select minimal fields
+    // to avoid the N+1 pattern (get_permissions + N × get_group_members).
+    const apiPath = includeMembers
+        ? "/_api/web/sitegroups?$expand=Users&$select=Id,Title,Description,OwnerTitle,Users/Id,Users/Title,Users/Email,Users/LoginName"
+        : "/_api/web/sitegroups";
+    const result = await callSharePointRest(siteUrl, apiPath, "GET");
+    return result.d.results.map((group) => {
+        const base = {
+            id: group.Id,
+            title: group.Title,
+            description: group.Description,
+            ownerTitle: group.OwnerTitle,
+        };
+        if (!includeMembers)
+            return base;
+        return {
+            ...base,
+            members: (group.Users?.results || []).map((u) => ({
+                id: u.Id,
+                title: u.Title,
+                email: u.Email,
+                loginName: u.LoginName,
+            })),
+        };
+    });
 }
 export async function getGroupMembers(siteUrl, groupId) {
     const result = await callSharePointRest(siteUrl, `/_api/web/sitegroups/getbyid(${groupId})/users`, "GET");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "365center-mcp",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "MCP server for Microsoft 365 / Office 365 SharePoint — full read-write access to sites, documents, pages, metadata, navigation, and permissions",
   "type": "module",
   "main": "dist/index.js",
@@ -39,9 +39,10 @@
   },
   "homepage": "https://github.com/Crscristi28/365center-mcp#readme",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
     "@azure/identity": "^4.9.1",
     "@microsoft/microsoft-graph-client": "^3.0.7",
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@napi-rs/keyring": "^1.2.0",
     "dotenv": "^16.5.0"
   },
   "devDependencies": {