@chrischall/office-outlook-mcp 0.1.1 → 0.1.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.1.1"
+    "version": "0.1.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — read mail, folders, calendar, contacts and tasks, and send mail with confirmation",
-      "version": "0.1.1",
+      "version": "0.1.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "outlook": {
+      "command": "node",
+      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"],
+      "env": {
+        "OUTLOOK_ACCESS_TOKEN": "${OUTLOOK_ACCESS_TOKEN}"
+      }
+    }
+  }
+}

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Outlook / Microsoft 365 for Claude — read mail, folders, calendar, contacts and tasks, and send mail with confirmation, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",
@@ -19,5 +19,5 @@
     "mcp"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcp": "./mcp.json"
 }

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "outlook": {
       "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"],
+      "args": ["dist/bundle.js"],
       "env": {
         "OUTLOOK_ACCESS_TOKEN": "${OUTLOOK_ACCESS_TOKEN}"
       }

package/README.md

@@ -37,6 +37,42 @@ npm i -g @fetchproxy/cli
 The first capture prints a 6-digit pair code to approve in the Transporter
 popup; the grant persists.
 
+### Install in opencode
+
+opencode reads MCP servers from `opencode.json` (project) or
+`~/.config/opencode/opencode.json` (global):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "outlook": {
+        "type": "local",
+        "command": ["npx", "-y", "@chrischall/office-outlook-mcp"]
+      }
+    }
+  }
+}
+```
+
+That one file serves **opencode 2 and current opencode 1** — verified live on
+2.0.11, 1.18.31 and 1.18.28, which all connect from it.
+
+Two things worth knowing, both measured rather than assumed:
+
+- **Never carry both config shapes in one file.** Older opencode 1 wants the
+  servers directly under `mcp` (`"mcp": { "outlook": { … } }`), and the
+  temptation is to write both so either version finds one. Do not: given a
+  sibling key beside `servers`, opencode 2 parses the file — it still shows up
+  in `opencode debug config` — and then reports *"No MCP servers configured"*.
+  No error, no warning, every server silently gone.
+- **An opencode 1 old enough to reject `servers` says so loudly**
+  (`Configuration is invalid at …`), so if you see that, switch that machine to
+  the flat shape rather than combining them.
+
+opencode 2 talks to a background service, so `opencode reload` before
+`opencode mcp list` after editing config.
+
 ### Configuration
 
 Everything is optional — with nothing set, the server captures from the browser.
@@ -47,7 +83,7 @@ Everything is optional — with nothing set, the server captures from the browse
 | `OUTLOOK_DISABLE_FETCHPROXY` | `1` to disable browser capture, requiring `OUTLOOK_ACCESS_TOKEN`. |
 | `OUTLOOK_API_BASE` | Override the REST base URL. Defaults to `https://outlook.office.com/api/v2.0`. |
 | `OUTLOOK_WS_PORT` | fetchproxy concentrator port. Defaults to `37149`, the fleet-wide shared port. |
-| `OUTLOOK_CAPTURE_TIMEOUT` | Seconds to wait for the tab to make a readable request. Defaults to `30`. |
+| `OUTLOOK_CAPTURE_TIMEOUT` | Seconds to wait for the tab to make a readable request. Bounds the WHOLE capture, both declared hosts included. Defaults to `30`. |
 | `OUTLOOK_TOKEN_CACHE` | `false` to stop caching the token between runs. |
 | `OUTLOOK_TOKEN_FILE` | Path to the cached token. Defaults to `~/.office-outlook-mcp/token.json`. |
 
@@ -66,8 +102,10 @@ Everything is optional — with nothing set, the server captures from the browse
 **Diagnostics** — `outlook_healthcheck`
 
 Every read tool takes `view: compact | full | raw`, defaulting to **compact**.
-Mutating tools make **no network call** without `confirm: true` — they return a
-dry-run preview of exactly what would be sent.
+Mutating tools **write nothing** without `confirm: true` — they return a
+dry-run preview of exactly what would be sent. (`outlook_create_event` first
+reads the mailbox time zone, so its preview can name the zone it would book
+in; that is the one read a dry run makes.)
 
 ## Things worth knowing
 
@@ -81,6 +119,11 @@ dry-run preview of exactly what would be sent.
 - `search` and `unreadOnly` cannot be combined; the API rejects `$search`
   alongside `$filter`, so the tool refuses before making a doomed request.
 - Moving a message assigns it a **new id**.
+- `outlook_list_events` returns times in the **mailbox's own time zone** unless
+  `timeZone` overrides it. The API itself defaults to UTC, which silently reads
+  as a four-hour error on an Eastern mailbox.
+- Contact phone fields are `MobilePhone1`, not Graph's `MobilePhone`. The v2.0
+  Contact type rejects the Graph name with a 400.
 
 ## The lightweight alternative
 

package/dist/auth-fetchproxy.js

@@ -16,7 +16,7 @@
  *   - that token authenticates plain server-side requests to
  *     `outlook.office.com/api/v2.0` with no bridge involved;
  *   - older tenants still serve the app from `outlook.office.com`, so both
- *     hosts are declared and captured concurrently.
+ *     hosts are declared and captured, under ONE overall window.
  *
  * We do NOT try to mint a token by calling an endpoint ourselves. There is no
  * such endpoint reachable from the page's origin — the token comes from MSAL's
@@ -56,6 +56,27 @@ const CAPTURE_DECL_OFFICE = {
     path: '/*',
     headerName: 'authorization',
 };
+/**
+ * The hosts a token may be captured from — the two Outlook Web origins.
+ *
+ * Exported so the trust boundary below can be derived from them rather than
+ * restated.
+ */
+export const CAPTURE_HOSTS = [CAPTURE_DECL_CLOUD.host, CAPTURE_DECL_OFFICE.host];
+/**
+ * The extension's trust boundary: exactly the hosts we capture from.
+ *
+ * These were the apex domains `cloud.microsoft` and `office.com`, which the
+ * extension reads as "any subdomain of either" — the whole of Microsoft 365
+ * granted to read one header off two known hosts. It is also what sent the
+ * pairing flow to `m365.cloud.microsoft/chat`, a tab nothing here needs.
+ *
+ * Narrowing costs nothing: the capture declarations were always these two
+ * hosts, and every API call the server makes afterwards is a plain server-side
+ * `fetch` that the bridge never sees. Verified live 2026-09-20 — capture still
+ * succeeded, and an already-paired extension did not ask to re-pair.
+ */
+export const TRUST_DOMAINS = [...CAPTURE_HOSTS];
 /**
  * How long to wait for the page to make a request we can read.
  *
@@ -97,6 +118,45 @@ function withFetch(opts) {
             : [...derived, 'fetch'],
     };
 }
+/**
+ * Settle a set of per-host capture attempts under ONE overall deadline.
+ *
+ * `Promise.any` alone is not enough. The two declared hosts are documented as
+ * raced, but the bridge serializes them behind its single connection, so the
+ * wait was the sum rather than the max — measured live at 14.4s for a 5s window
+ * and 36s for a 20s one. At the 30s default that lands past the 60s request
+ * timeout an MCP client uses by default, so the host gave up before this code
+ * could report the real reason. The window is a promise about total wait, and
+ * this is what keeps it.
+ *
+ * Exported for the test that pins that bound.
+ */
+export async function raceCaptures(attempts, windowMs) {
+    // A rejection that loses the race must not surface as an unhandled rejection
+    // once the winner has already settled the caller.
+    for (const a of attempts)
+        a.catch(() => { });
+    let timer;
+    const expiry = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${Math.round(windowMs / 1000)}s waiting for the page to ` +
+            'make a request we could read')), windowMs);
+    });
+    try {
+        // `any` resolves on the first SUCCESS rather than the first settle, so the
+        // host the user is not on failing does not sink the one they are on.
+        return await Promise.race([
+            Promise.any(attempts).catch((e) => {
+                throw new Error(e instanceof AggregateError
+                    ? e.errors.map((x) => x.message).join('; ')
+                    : e.message);
+            }),
+            expiry,
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /** Normalise a captured header to a bare token, dropping any `Bearer ` prefix. */
 export function stripBearer(raw) {
     const m = /^\s*Bearer\s+(.+)$/i.exec(raw);
@@ -105,13 +165,15 @@ export function stripBearer(raw) {
 /**
  * Capture an Outlook access token from the user's signed-in browser tab.
  *
- * Both hosts are raced: whichever the tab is actually on answers first, and the
- * other simply never resolves. Returns the bare token (no `Bearer ` prefix).
+ * Both hosts are attempted: whichever the tab is actually on answers first, and
+ * the other simply never resolves. The bridge serializes them, so the pair is
+ * held to one deadline by `raceCaptures` rather than to one deadline each.
+ * Returns the bare token (no `Bearer ` prefix).
  */
 export async function captureTokenViaFetchproxy() {
     const transport = createFetchproxyTransport({
         ...withFetch(createBootstrapOpts({
-            domains: ['cloud.microsoft', 'office.com'],
+            domains: [...TRUST_DOMAINS],
             bootstrap: {
                 captureHeaders: [{ ...CAPTURE_DECL_CLOUD }, { ...CAPTURE_DECL_OFFICE }],
             },
@@ -140,15 +202,11 @@ export async function captureTokenViaFetchproxy() {
             }
             return token;
         }));
-        // `any` resolves on the first SUCCESS rather than the first settle, so the
-        // host the user is not on failing does not sink the one they are on.
         try {
-            return await Promise.any(attempts);
+            return await raceCaptures(attempts, CAPTURE_TIMEOUT_MS);
         }
         catch (e) {
-            const detail = e instanceof AggregateError
-                ? e.errors.map((x) => x.message).join('; ')
-                : e.message;
+            const detail = e.message;
             throw new Error(`could not capture an Outlook token from the browser (${detail}). ` +
                 'Open a signed-in Outlook tab (outlook.cloud.microsoft or ' +
                 'outlook.office.com), leave it in the foreground for a moment so the ' +

package/dist/bundle.js

@@ -35843,7 +35843,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.1.1";
+    VERSION = "0.1.3";
   }
 });
 
@@ -44889,8 +44889,11 @@ var init_fetchproxy = __esm({
 // src/auth-fetchproxy.ts
 var auth_fetchproxy_exports = {};
 __export(auth_fetchproxy_exports, {
+  CAPTURE_HOSTS: () => CAPTURE_HOSTS,
+  TRUST_DOMAINS: () => TRUST_DOMAINS,
   captureTokenViaFetchproxy: () => captureTokenViaFetchproxy,
   getWsPort: () => getWsPort,
+  raceCaptures: () => raceCaptures,
   stripBearer: () => stripBearer
 });
 function getWsPort() {
@@ -44903,6 +44906,33 @@ function withFetch(opts) {
     capabilities: derived2.includes("fetch") ? derived2 : [...derived2, "fetch"]
   };
 }
+async function raceCaptures(attempts, windowMs) {
+  for (const a of attempts) a.catch(() => {
+  });
+  let timer;
+  const expiry = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(
+        new Error(
+          `timed out after ${Math.round(windowMs / 1e3)}s waiting for the page to make a request we could read`
+        )
+      ),
+      windowMs
+    );
+  });
+  try {
+    return await Promise.race([
+      Promise.any(attempts).catch((e) => {
+        throw new Error(
+          e instanceof AggregateError ? e.errors.map((x) => x.message).join("; ") : e.message
+        );
+      }),
+      expiry
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function stripBearer(raw) {
   const m = /^\s*Bearer\s+(.+)$/i.exec(raw);
   return (m ? m[1] : raw).trim();
@@ -44911,7 +44941,7 @@ async function captureTokenViaFetchproxy() {
   const transport = createFetchproxyTransport({
     ...withFetch(
       createBootstrapOpts({
-        domains: ["cloud.microsoft", "office.com"],
+        domains: [...TRUST_DOMAINS],
         bootstrap: {
           captureHeaders: [{ ...CAPTURE_DECL_CLOUD }, { ...CAPTURE_DECL_OFFICE }]
         }
@@ -44939,9 +44969,9 @@ async function captureTokenViaFetchproxy() {
       })
     );
     try {
-      return await Promise.any(attempts);
+      return await raceCaptures(attempts, CAPTURE_TIMEOUT_MS);
     } catch (e) {
-      const detail = e instanceof AggregateError ? e.errors.map((x) => x.message).join("; ") : e.message;
+      const detail = e.message;
       throw new Error(
         `could not capture an Outlook token from the browser (${detail}). Open a signed-in Outlook tab (outlook.cloud.microsoft or outlook.office.com), leave it in the foreground for a moment so the page makes a request, and retry.`
       );
@@ -44953,7 +44983,7 @@ async function captureTokenViaFetchproxy() {
     }
   }
 }
-var DEFAULT_WS_PORT, CAPTURE_DECL_CLOUD, CAPTURE_DECL_OFFICE, CAPTURE_TIMEOUT_MS, BRIDGE_DEADLINE_MS, MIN_TOKEN_LENGTH;
+var DEFAULT_WS_PORT, CAPTURE_DECL_CLOUD, CAPTURE_DECL_OFFICE, CAPTURE_HOSTS, TRUST_DOMAINS, CAPTURE_TIMEOUT_MS, BRIDGE_DEADLINE_MS, MIN_TOKEN_LENGTH;
 var init_auth_fetchproxy = __esm({
   "src/auth-fetchproxy.ts"() {
     "use strict";
@@ -44971,6 +45001,8 @@ var init_auth_fetchproxy = __esm({
       path: "/*",
       headerName: "authorization"
     };
+    CAPTURE_HOSTS = [CAPTURE_DECL_CLOUD.host, CAPTURE_DECL_OFFICE.host];
+    TRUST_DOMAINS = [...CAPTURE_HOSTS];
     CAPTURE_TIMEOUT_MS = readTtlMsEnv("OUTLOOK_CAPTURE_TIMEOUT", 3e4);
     BRIDGE_DEADLINE_MS = Math.max(CAPTURE_TIMEOUT_MS + 15e3, 3e4);
     MIN_TOKEN_LENGTH = 100;
@@ -45625,6 +45657,13 @@ function compactFolder(f) {
     Total: f.TotalItemCount
   });
 }
+function stripOData(o) {
+  const out = {};
+  for (const [k, v] of Object.entries(o)) {
+    if (!k.startsWith("@odata.")) out[k] = v;
+  }
+  return out;
+}
 function pruned(o) {
   const out = {};
   for (const [k, v] of Object.entries(o)) {
@@ -45763,7 +45802,7 @@ function registerMailTools(server, client2) {
       );
       return minifiedResult({
         count: data.value?.length ?? 0,
-        items: data.value ?? []
+        items: (data.value ?? []).map(stripOData)
       });
     }
   );
@@ -45772,6 +45811,23 @@ function registerMailTools(server, client2) {
 // src/tools/calendar.ts
 init_zod();
 init_dist2();
+
+// src/timezone.ts
+var zoneByClient = /* @__PURE__ */ new WeakMap();
+async function mailboxTimeZone(client2) {
+  const cached2 = zoneByClient.get(client2);
+  if (cached2) return cached2;
+  try {
+    const settings = await client2.get("/me/MailboxSettings");
+    const zone = settings?.TimeZone?.trim() || void 0;
+    if (zone) zoneByClient.set(client2, zone);
+    return zone;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/tools/calendar.ts
 var EVENT_SELECT = "Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,BodyPreview";
 function qs2(params) {
   const parts = [];
@@ -45798,6 +45854,7 @@ function registerCalendarTools(server, client2) {
       })
     },
     async ({ view, start, end, timeZone, limit }) => {
+      const zone = timeZone ?? await mailboxTimeZone(client2);
       const data = await client2.get(
         `/me/calendarview${qs2({
           startDateTime: start,
@@ -45806,7 +45863,7 @@ function registerCalendarTools(server, client2) {
           $orderby: "Start/DateTime",
           $top: limit ?? 50
         })}`,
-        timeZone ? { prefer: `outlook.timezone="${timeZone}"` } : {}
+        zone ? { prefer: `outlook.timezone="${zone}"` } : {}
       );
       const v = resolveView(view, VIEWS2);
       if (v === "raw") return minifiedResult(data);
@@ -45827,9 +45884,10 @@ function registerCalendarTools(server, client2) {
       })
     },
     async ({ view, id, timeZone }) => {
+      const zone = timeZone ?? await mailboxTimeZone(client2);
       const data = await client2.get(
         `/me/events/${encodeURIComponent(id)}`,
-        timeZone ? { prefer: `outlook.timezone="${timeZone}"` } : {}
+        zone ? { prefer: `outlook.timezone="${zone}"` } : {}
       );
       const v = resolveView(view, VIEWS2);
       if (v === "raw") return minifiedResult(data);
@@ -45850,7 +45908,10 @@ function registerCalendarTools(server, client2) {
         `/me/calendars${qs2({ $select: "Id,Name,Color,CanEdit,Owner" })}`
       );
       if (resolveView(view, VIEWS2) === "raw") return minifiedResult(data);
-      return minifiedResult({ count: data.value?.length ?? 0, items: data.value ?? [] });
+      return minifiedResult({
+        count: data.value?.length ?? 0,
+        items: (data.value ?? []).map(stripOData)
+      });
     }
   );
 }
@@ -45868,7 +45929,7 @@ function qs3(params) {
 }
 function collection(data, raw) {
   if (raw) return data;
-  return { count: data.value?.length ?? 0, items: data.value ?? [] };
+  return { count: data.value?.length ?? 0, items: (data.value ?? []).map(stripOData) };
 }
 function registerDirectoryTools(server, client2) {
   server.registerTool(
@@ -45878,7 +45939,7 @@ function registerDirectoryTools(server, client2) {
       annotations: { readOnlyHint: true },
       inputSchema: external_exports.object({})
     },
-    async () => minifiedResult(await client2.get("/me"))
+    async () => minifiedResult(stripOData(await client2.get("/me")))
   );
   server.registerTool(
     "outlook_get_mailbox_settings",
@@ -45887,7 +45948,7 @@ function registerDirectoryTools(server, client2) {
       annotations: { readOnlyHint: true },
       inputSchema: external_exports.object({})
     },
-    async () => minifiedResult(await client2.get("/me/MailboxSettings"))
+    async () => minifiedResult(stripOData(await client2.get("/me/MailboxSettings")))
   );
   server.registerTool(
     "outlook_list_contacts",
@@ -45905,7 +45966,9 @@ function registerDirectoryTools(server, client2) {
         `/me/contacts${qs3({
           $top: limit ?? 50,
           $skip: skip,
-          $select: "Id,DisplayName,EmailAddresses,CompanyName,JobTitle,MobilePhone"
+          // `MobilePhone1`, not `MobilePhone`: the latter is the Graph name and
+          // the v2.0 Contact type rejects it outright with a 400.
+          $select: "Id,DisplayName,EmailAddresses,CompanyName,JobTitle,MobilePhone1"
         })}`
       );
       return minifiedResult(collection(data, resolveView(view, VIEWS2) === "raw"));
@@ -45987,7 +46050,7 @@ function registerWriteTools(server, client2) {
     "outlook_send_mail",
     {
       description: "Send an email from the signed-in mailbox. Requires confirm:true \u2014 without it this makes no network call and returns a preview of exactly what would be sent.",
-      annotations: { readOnlyHint: false, destructiveHint: false },
+      annotations: { readOnlyHint: false, destructiveHint: true },
       inputSchema: external_exports.object({
         to: recipientList,
         cc: recipientList,
@@ -46133,7 +46196,7 @@ function registerWriteTools(server, client2) {
         subject: external_exports.string().describe("Event title"),
         start: external_exports.string().min(1).describe("Start, ISO 8601 local time e.g. 2026-09-22T15:00:00"),
         end: external_exports.string().min(1).describe("End, ISO 8601 local time"),
-        timeZone: external_exports.string().optional().describe('Windows time-zone name (default "UTC")'),
+        timeZone: external_exports.string().optional().describe("Windows time-zone name. Defaults to the MAILBOX time zone."),
         location: external_exports.string().optional().describe("Location display name"),
         body: external_exports.string().optional().describe("Event description"),
         attendees: recipientList,
@@ -46141,7 +46204,7 @@ function registerWriteTools(server, client2) {
       })
     },
     async ({ subject, start, end, timeZone, location, body, attendees, confirm }) => {
-      const tz = timeZone ?? "UTC";
+      const tz = timeZone ?? await mailboxTimeZone(client2) ?? "UTC";
       const payload = {
         Subject: subject,
         Start: { DateTime: start, TimeZone: tz },

package/dist/timezone.js

@@ -0,0 +1,16 @@
+const zoneByClient = new WeakMap();
+export async function mailboxTimeZone(client) {
+    const cached = zoneByClient.get(client);
+    if (cached)
+        return cached;
+    try {
+        const settings = await client.get('/me/MailboxSettings');
+        const zone = settings?.TimeZone?.trim() || undefined;
+        if (zone)
+            zoneByClient.set(client, zone);
+        return zone;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/tools/calendar.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 import { minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
-import { compactEvent, fullEvent, projectCollection } from '../view.js';
+import { compactEvent, fullEvent, projectCollection, stripOData, } from '../view.js';
 import { VIEWS } from './mail.js';
+import { mailboxTimeZone } from '../timezone.js';
 const EVENT_SELECT = 'Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,BodyPreview';
 function qs(params) {
     const parts = [];
@@ -30,13 +31,14 @@ export function registerCalendarTools(server, client) {
             limit: z.number().int().min(1).max(200).optional().describe('Max events (default 50)'),
         }),
     }, async ({ view, start, end, timeZone, limit }) => {
+        const zone = timeZone ?? (await mailboxTimeZone(client));
         const data = await client.get(`/me/calendarview${qs({
             startDateTime: start,
             endDateTime: end,
             $select: EVENT_SELECT,
             $orderby: 'Start/DateTime',
             $top: limit ?? 50,
-        })}`, timeZone ? { prefer: `outlook.timezone="${timeZone}"` } : {});
+        })}`, zone ? { prefer: `outlook.timezone="${zone}"` } : {});
         const v = resolveView(view, VIEWS);
         if (v === 'raw')
             return minifiedResult(data);
@@ -51,7 +53,8 @@ export function registerCalendarTools(server, client) {
             timeZone: z.string().optional().describe('Windows time-zone name for returned times'),
         }),
     }, async ({ view, id, timeZone }) => {
-        const data = await client.get(`/me/events/${encodeURIComponent(id)}`, timeZone ? { prefer: `outlook.timezone="${timeZone}"` } : {});
+        const zone = timeZone ?? (await mailboxTimeZone(client));
+        const data = await client.get(`/me/events/${encodeURIComponent(id)}`, zone ? { prefer: `outlook.timezone="${zone}"` } : {});
         const v = resolveView(view, VIEWS);
         if (v === 'raw')
             return minifiedResult(data);
@@ -67,6 +70,9 @@ export function registerCalendarTools(server, client) {
         const data = await client.get(`/me/calendars${qs({ $select: 'Id,Name,Color,CanEdit,Owner' })}`);
         if (resolveView(view, VIEWS) === 'raw')
             return minifiedResult(data);
-        return minifiedResult({ count: data.value?.length ?? 0, items: data.value ?? [] });
+        return minifiedResult({
+            count: data.value?.length ?? 0,
+            items: (data.value ?? []).map(stripOData),
+        });
     });
 }

package/dist/tools/directory.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
+import { stripOData } from '../view.js';
 import { VIEWS } from './mail.js';
 function qs(params) {
     const parts = [];
@@ -13,19 +14,19 @@ function qs(params) {
 function collection(data, raw) {
     if (raw)
         return data;
-    return { count: data.value?.length ?? 0, items: data.value ?? [] };
+    return { count: data.value?.length ?? 0, items: (data.value ?? []).map(stripOData) };
 }
 export function registerDirectoryTools(server, client) {
     server.registerTool('outlook_get_profile', {
         description: "Get the signed-in mailbox's identity (email address, display name, alias). The cheapest call that proves the credential works.",
         annotations: { readOnlyHint: true },
         inputSchema: z.object({}),
-    }, async () => minifiedResult(await client.get('/me')));
+    }, async () => minifiedResult(stripOData(await client.get('/me'))));
     server.registerTool('outlook_get_mailbox_settings', {
         description: 'Get mailbox settings: time zone, working hours, language, and automatic-replies (out-of-office) configuration.',
         annotations: { readOnlyHint: true },
         inputSchema: z.object({}),
-    }, async () => minifiedResult(await client.get('/me/MailboxSettings')));
+    }, async () => minifiedResult(stripOData(await client.get('/me/MailboxSettings'))));
     server.registerTool('outlook_list_contacts', {
         description: 'List saved contacts from the mailbox address book.',
         annotations: { readOnlyHint: true },
@@ -38,7 +39,9 @@ export function registerDirectoryTools(server, client) {
         const data = await client.get(`/me/contacts${qs({
             $top: limit ?? 50,
             $skip: skip,
-            $select: 'Id,DisplayName,EmailAddresses,CompanyName,JobTitle,MobilePhone',
+            // `MobilePhone1`, not `MobilePhone`: the latter is the Graph name and
+            // the v2.0 Contact type rejects it outright with a 400.
+            $select: 'Id,DisplayName,EmailAddresses,CompanyName,JobTitle,MobilePhone1',
         })}`);
         return minifiedResult(collection(data, resolveView(view, VIEWS) === 'raw'));
     });

package/dist/tools/mail.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { minifiedResult, resolveView, viewParam, McpToolError } from '@chrischall/mcp-utils';
-import { compactFolder, compactMessage, fullMessage, projectCollection, } from '../view.js';
+import { compactFolder, compactMessage, fullMessage, projectCollection, stripOData, } from '../view.js';
 export const VIEWS = ['compact', 'full', 'raw'];
 /**
  * Well-known folder names the API accepts wherever a folder id is taken.
@@ -124,7 +124,7 @@ export function registerMailTools(server, client) {
         })}`);
         return minifiedResult({
             count: data.value?.length ?? 0,
-            items: data.value ?? [],
+            items: (data.value ?? []).map(stripOData),
         });
     });
 }

package/dist/tools/writes.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { minifiedResult } from '@chrischall/mcp-utils';
 import { previewUnlessConfirmed, schemaConfirm } from './_confirm.js';
+import { mailboxTimeZone } from '../timezone.js';
 const recipientList = z
     .array(z.string().min(3))
     .optional()
@@ -21,7 +22,7 @@ function messageBody(subject, body, html) {
 export function registerWriteTools(server, client) {
     server.registerTool('outlook_send_mail', {
         description: 'Send an email from the signed-in mailbox. Requires confirm:true — without it this makes no network call and returns a preview of exactly what would be sent.',
-        annotations: { readOnlyHint: false, destructiveHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true },
         inputSchema: z.object({
             to: recipientList,
             cc: recipientList,
@@ -133,14 +134,15 @@ export function registerWriteTools(server, client) {
             timeZone: z
                 .string()
                 .optional()
-                .describe('Windows time-zone name (default "UTC")'),
+                .describe('Windows time-zone name. Defaults to the MAILBOX time zone.'),
             location: z.string().optional().describe('Location display name'),
             body: z.string().optional().describe('Event description'),
             attendees: recipientList,
             confirm: schemaConfirm,
         }),
     }, async ({ subject, start, end, timeZone, location, body, attendees, confirm }) => {
-        const tz = timeZone ?? 'UTC';
+        // Falls back to UTC only when the mailbox itself declares no zone.
+        const tz = timeZone ?? (await mailboxTimeZone(client)) ?? 'UTC';
         const payload = {
             Subject: subject,
             Start: { DateTime: start, TimeZone: tz },

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.1.1'; // x-release-please-version
+export const VERSION = '0.1.3'; // x-release-please-version

package/dist/view.js

@@ -83,6 +83,27 @@ export function compactFolder(f) {
         Total: f.TotalItemCount,
     });
 }
+/**
+ * Drop OData's envelope keys (`@odata.id`, `@odata.etag`, `@odata.context`, …)
+ * from a record.
+ *
+ * `$select` does not suppress them: a contact selected down to six fields still
+ * arrives with a ~200-char `@odata.id` self-URL repeating the mailbox GUID and
+ * the item Id, which on a 50-item listing is most of the payload. The typed
+ * projections never had this problem because they name their fields; the tools
+ * that pass records through untouched did.
+ *
+ * Everything that is not an annotation survives, so this stays a projection of
+ * the envelope rather than of the record.
+ */
+export function stripOData(o) {
+    const out = {};
+    for (const [k, v] of Object.entries(o)) {
+        if (!k.startsWith('@odata.'))
+            out[k] = v;
+    }
+    return out;
+}
 /** Drop `undefined` so a compact record does not carry empty keys. */
 function pruned(o) {
     const out = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.1.1",
+  "version": "0.1.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.1.1",
+      "version": "0.1.3",
       "transport": {
         "type": "stdio"
       },