@chrischall/office-outlook-mcp 0.3.4 → 0.4.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.3.4"
+    "version": "0.4.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — read mail, folders, calendar, contacts and tasks, and send mail with confirmation",
-      "version": "0.3.4",
+      "version": "0.4.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "description": "Outlook / Microsoft 365 for Claude — read mail, folders, calendar, contacts and tasks, and send mail with confirmation, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -108,13 +108,21 @@ Everything is optional — with nothing set, the server captures from the browse
 
 **Read** — `outlook_list_folders`, `outlook_list_messages`,
 `outlook_get_message`, `outlook_list_attachments`, `outlook_list_events`,
-`outlook_get_event`, `outlook_list_calendars`, `outlook_get_profile`,
+`outlook_get_event`, `outlook_list_calendars`, `outlook_find_meeting_times`,
+`outlook_get_schedule`, `outlook_get_profile`,
 `outlook_get_mailbox_settings`, `outlook_list_contacts`, `outlook_list_people`,
 `outlook_list_tasks`
 
 **Write** (all ask you to confirm first — see [Confirmations](#confirmations)) — `outlook_send_mail`,
 `outlook_create_draft`, `outlook_mark_read`, `outlook_move_message`,
-`outlook_create_event`
+`outlook_create_event`, `outlook_update_event`
+
+**Meetings** — `outlook_find_meeting_times` asks Outlook's Scheduling
+Assistant for slots when everyone is free, and `outlook_get_schedule` shows
+each person's busy blocks. `outlook_create_event` and `outlook_update_event`
+attach a Microsoft Teams meeting by default and return its join link; pass
+`teamsMeeting: false` to leave it off. Only the organizer can update a
+meeting.
 
 **Diagnostics** — `outlook_healthcheck`
 
@@ -148,7 +156,8 @@ a fresh preview.
 
 | variable | default | |
 |---|---|---|
-| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_ELICITATION` | `on` | `off` never shows a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` behaviour. Set it for a client that says it can show prompts but never does (the write hangs — opencode 2.0.x). Any other value is treated as `on`, with a warning on stderr. |
 | `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
 | `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. On mcp-host the host supplies a stable per-child key (`MCP_HOST_CONFIRM_SECRET`) and spent tokens are recorded under `MCP_DATA_DIR`, so an approval survives an idle restart. |
 

package/dist/bundle.js

@@ -23737,10 +23737,10 @@ function scanXMcpHeaderDeclarations(inputSchema) {
       if (!RFC9110_TOKEN.test(raw)) return `${pathName(path)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
       const type = typeof schema.type === "string" ? schema.type : void 0;
       if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
-      const lower = raw.toLowerCase();
-      const prior = seenLower.get(lower);
+      const lower2 = raw.toLowerCase();
+      const prior = seenLower.get(lower2);
       if (prior !== void 0) return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
-      seenLower.set(lower, raw);
+      seenLower.set(lower2, raw);
       declarations.push({
         path,
         headerName: raw,
@@ -35663,6 +35663,15 @@ ${JSON.stringify(preview, null, 2)}`,
   };
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (options.elicitation === false) {
+    return textResult({
+      confirmed: false,
+      dispatched: false,
+      action: options.action,
+      reason: "confirmation-unsupported",
+      note: options.unsupportedNote ? `${DISABLED_NOTE}. ${options.unsupportedNote}` : `${DISABLED_NOTE}.`
+    });
+  }
   if (response.kind === "missing") {
     if (callerAcceptsFormElicitation(ctx) === false) {
       return textResult({
@@ -35693,7 +35702,7 @@ ${JSON.stringify(preview, null, 2)}`,
     note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
   });
 }
-var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, STATE_PREFIX;
+var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, DISABLED_NOTE, STATE_PREFIX;
 var init_confirmation = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirmation.js"() {
     init_dist();
@@ -35704,6 +35713,7 @@ var init_confirmation = __esm({
     DEFAULT_REQUEST_KEY = "confirmation";
     DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
     UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+    DISABLED_NOTE = "Nothing was done because confirmation prompts are turned off for this server, and this action is never taken without one";
     STATE_PREFIX = "mcpu.confirm.v1.";
   }
 });
@@ -35857,7 +35867,7 @@ async function tokenConfirmation(action, fb) {
 }
 async function requireConfirmationWithFallback(ctx, options) {
   const { tokenFallback, ...confirmation } = options;
-  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+  if (tokenFallback && (options.elicitation === false || callerAcceptsFormElicitation(ctx) === false)) {
     return tokenConfirmation(options.action, tokenFallback);
   }
   return requireConfirmation(ctx, confirmation);
@@ -36068,6 +36078,20 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
+function readConfirmElicitation(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_ELICITATION", { env })?.trim().toLowerCase();
+  if (!raw || raw === "on")
+    return "on";
+  if (raw === "off")
+    return "off";
+  const key = `elicitation:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_ELICITATION="${raw}" is not one of on, off; treating it as on.
+`);
+  }
+  return "on";
+}
 function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
   if (!raw)
@@ -36120,10 +36144,13 @@ function confirmationFromEnv(options) {
   const spent = callerSpent ?? spentTokenStoreFromEnv(env);
   const mode = readConfirmMode(env);
   const ttlSeconds = readConfirmTtl(env);
+  const elicitationOff = readConfirmElicitation(env) === "off";
   const bound = args === void 0 ? void 0 : boundArgs(args);
-  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const bindingAdded = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
   if (mode === "refuse" || ttlSeconds === void 0) {
-    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const reason = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const hint = elicitationOff ? `${ELICITATION_OFF_HINT} ${reason}` : reason;
     return {
       ...confirmation,
       unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
@@ -36149,7 +36176,7 @@ function confirmationFromEnv(options) {
     }
   };
 }
-var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, BAD_TTL_HINT;
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, ELICITATION_OFF_HINT, BAD_TTL_HINT;
 var init_confirm_env = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
     init_config();
@@ -36161,6 +36188,7 @@ var init_confirm_env = __esm({
     fileStores = /* @__PURE__ */ new Map();
     CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
     REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+    ELICITATION_OFF_HINT = "MCP_CONFIRM_ELICITATION=off on the server turns confirmation prompts off.";
     BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
   }
 });
@@ -37120,7 +37148,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.3.4";
+    VERSION = "0.4.0";
   }
 });
 
@@ -37372,7 +37400,7 @@ async function transcriptHash(mcpNonce, extNonce, mcpSessionPub, extSessionPub)
 function frameAad(mcpId, seq, direction) {
   return enc.encode(`fetchproxy/4/frame\0${mcpId}\0${seq}\0${direction}`);
 }
-var PROTOCOL_VERSION, HKDF_SESSION_INFO, enc, ANSWERS_NO_EXT_SESSION, KNOWN_CAPABILITIES, ACCOUNT_KEY_FRAME, ACCOUNT_ATTEST_FRAME;
+var PROTOCOL_VERSION, HKDF_SESSION_INFO, enc, ANSWERS_NO_EXT_SESSION, KNOWN_CAPABILITIES, ACCOUNT_KEY_FRAME, ACCOUNT_ATTEST_FRAME, BRIDGE_ROLE_FRAME, BRIDGE_SERVE_FRAME, ROOM_PING_FRAME, ROOM_PONG_FRAME, BRIDGE_ROLE_LABEL_MAX, ROOM_FRAME_ACCEPTS;
 var init_frames = __esm({
   "node_modules/@fetchproxy/protocol/dist/frames.js"() {
     init_crypto();
@@ -37398,6 +37426,17 @@ var init_frames = __esm({
     ]);
     ACCOUNT_KEY_FRAME = "account-key";
     ACCOUNT_ATTEST_FRAME = "account-attest";
+    BRIDGE_ROLE_FRAME = "bridge-role";
+    BRIDGE_SERVE_FRAME = "bridge-serve";
+    ROOM_PING_FRAME = "room-ping";
+    ROOM_PONG_FRAME = "room-pong";
+    BRIDGE_ROLE_LABEL_MAX = 64;
+    ROOM_FRAME_ACCEPTS = Object.freeze({
+      [BRIDGE_ROLE_FRAME]: BRIDGE_ROLE_FRAME,
+      [BRIDGE_SERVE_FRAME]: BRIDGE_SERVE_FRAME,
+      [ROOM_PING_FRAME]: ROOM_PING_FRAME,
+      [ROOM_PONG_FRAME]: ROOM_PING_FRAME
+    });
   }
 });
 
@@ -38081,6 +38120,12 @@ function validateFrame(raw) {
     return validateAccountKey(raw);
   if (t === ACCOUNT_ATTEST_FRAME)
     return validateAccountAttest(raw);
+  if (t === BRIDGE_ROLE_FRAME)
+    return validateBridgeRole(raw);
+  if (t === BRIDGE_SERVE_FRAME || t === ROOM_PING_FRAME || t === ROOM_PONG_FRAME) {
+    assertExactFields(raw, TYPE_ONLY_FIELDS, t);
+    return { type: t };
+  }
   throw new ProtocolError3(`unknown frame type: ${String(t)}`);
 }
 function validateHello(raw) {
@@ -38376,6 +38421,40 @@ function validateAccountAttest(raw) {
     sig: raw.sig
   };
 }
+function validateBridgeRole(raw) {
+  const L = BRIDGE_ROLE_FRAME;
+  const role = raw.role;
+  if (role !== "serving" && role !== "standby") {
+    throw new ProtocolError3(`${L}.role: must be one of serving, standby`);
+  }
+  const canServe = raw.canServe;
+  assertBoolean(canServe, `${L}.canServe`);
+  assertExactFields(raw, BRIDGE_ROLE_FIELDS, L);
+  const serving = raw.serving;
+  if (role === "serving") {
+    if (serving !== void 0) {
+      throw new ProtocolError3(`${L}.serving: must be absent when role is serving`);
+    }
+    return { type: BRIDGE_ROLE_FRAME, role, canServe };
+  }
+  if (serving === void 0) {
+    throw new ProtocolError3(`${L}.serving: required when role is standby`);
+  }
+  assertObject(serving, `${L}.serving`);
+  const label = serving.label;
+  assertDisplayString(label, `${L}.serving.label`, 1, BRIDGE_ROLE_LABEL_MAX);
+  const since = serving.since;
+  if (typeof since !== "number" || !Number.isSafeInteger(since) || since < 0) {
+    throw new ProtocolError3(`${L}.serving.since: expected non-negative safe integer (Unix ms)`);
+  }
+  assertExactFields(serving, BRIDGE_ROLE_SERVING_FIELDS, `${L}.serving`);
+  return {
+    type: BRIDGE_ROLE_FRAME,
+    role,
+    canServe,
+    serving: { label, since }
+  };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -38837,7 +38916,7 @@ function validateInnerResponse(raw) {
   }
   throw new ProtocolError3(`inner.ok: must be boolean, got ${typeof raw.ok}`);
 }
-var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE, HEADER_NAME_RE, HOSTNAME_RE, CAPTURE_PATH_RE, DOM_SELECTOR_RE, DOM_ATTRIBUTE_RE, GRAPHQL_OP_NAME_RE, PAIR_CODE_RE, DISPLAY_FORBIDDEN_RE, ACCOUNT_KEY_FIELDS, ACCOUNT_ATTEST_FIELDS, KNOWN_RESPONSE_OPS;
+var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE, HEADER_NAME_RE, HOSTNAME_RE, CAPTURE_PATH_RE, DOM_SELECTOR_RE, DOM_ATTRIBUTE_RE, GRAPHQL_OP_NAME_RE, PAIR_CODE_RE, DISPLAY_FORBIDDEN_RE, ACCOUNT_KEY_FIELDS, ACCOUNT_ATTEST_FIELDS, TYPE_ONLY_FIELDS, BRIDGE_ROLE_FIELDS, BRIDGE_ROLE_SERVING_FIELDS, KNOWN_RESPONSE_OPS;
 var init_validate = __esm({
   "node_modules/@fetchproxy/protocol/dist/validate.js"() {
     init_frames();
@@ -38892,6 +38971,9 @@ var init_validate = __esm({
       "notAfter",
       "sig"
     ];
+    TYPE_ONLY_FIELDS = ["type"];
+    BRIDGE_ROLE_FIELDS = ["type", "role", "canServe", "serving"];
+    BRIDGE_ROLE_SERVING_FIELDS = ["label", "since"];
     KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
       ...KNOWN_CAPABILITIES,
       "graphql_query"
@@ -38899,6 +38981,14 @@ var init_validate = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/room-frames.js
+var init_room_frames = __esm({
+  "node_modules/@fetchproxy/protocol/dist/room-frames.js"() {
+    init_frames();
+    init_validate();
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/pair-code.js
 async function pairTranscript(mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub) {
   const label = enc3.encode(PAIR_LABEL);
@@ -39007,6 +39097,7 @@ var init_dist3 = __esm({
     init_awaiting_approval();
     init_capability_availability();
     init_validate();
+    init_room_frames();
     init_crypto();
     init_mcp_id();
     init_pair_code();
@@ -41405,11 +41496,23 @@ var require_websocket = __commonJS({
           this._isServer = false;
           this._redirects = 0;
           if (protocols === void 0) {
-            protocols = [];
+            if (!options || options.protocols === void 0) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else if (!Array.isArray(protocols)) {
             if (typeof protocols === "object" && protocols !== null) {
               options = protocols;
-              protocols = [];
+              if (options.protocols === void 0) {
+                protocols = [];
+              } else if (Array.isArray(options.protocols)) {
+                protocols = options.protocols;
+              } else {
+                protocols = [options.protocols];
+              }
             } else {
               protocols = [protocols];
             }
@@ -41606,7 +41709,6 @@ var require_websocket = __commonJS({
           }
           return;
         }
-        this._readyState = _WebSocket.CLOSING;
         this._sender.close(code2, data, !this._isServer, (err) => {
           if (err) return;
           this._closeFrameSent = true;
@@ -41614,6 +41716,7 @@ var require_websocket = __commonJS({
             this._socket.end();
           }
         });
+        this._readyState = _WebSocket.CLOSING;
         setCloseTimer(this);
       }
       /**
@@ -41838,6 +41941,7 @@ var require_websocket = __commonJS({
         socketPath: void 0,
         hostname: void 0,
         protocol: void 0,
+        protocols: void 0,
         timeout: void 0,
         method: "GET",
         host: void 0,
@@ -48283,6 +48387,19 @@ var OutlookClient = class {
     }
     return this.get(target.pathname.slice(prefix.length) + target.search, opts);
   }
+  /**
+   * POST a read-only query — `findmeetingtimes`, `getschedule` — that changes
+   * nothing in the mailbox. Kept apart from `write` so a reader can tell the
+   * two apart at the call site, and because these take `Prefer` (notably
+   * `outlook.timezone`, without which every returned slot is UTC).
+   */
+  async post(path, body, opts = {}) {
+    this.#requireConfigured();
+    return this.#client().fetchJson("POST", path, {
+      body,
+      headers: opts.prefer ? { Prefer: opts.prefer } : void 0
+    });
+  }
   /**
    * The single write path. Everything mutating goes through here so auth and
    * error shaping stay in one place.
@@ -48383,7 +48500,11 @@ function fullEvent(e) {
     Attendees: e.Attendees?.map(
       (a) => pruned({ Who: addr(a), Response: a.Status?.Response })
     ),
-    OnlineMeetingUrl: e.OnlineMeetingUrl,
+    // The Teams link lives under OnlineMeeting; OnlineMeetingUrl is empty on
+    // every live Teams meeting checked.
+    JoinUrl: e.OnlineMeeting?.JoinUrl || e.OnlineMeetingUrl || void 0,
+    // Kept beside JoinUrl so a consumer of the old field still finds it.
+    OnlineMeetingUrl: e.OnlineMeetingUrl || void 0,
     Preview: e.BodyPreview?.trim() || void 0,
     WebLink: e.WebLink
   });
@@ -48599,7 +48720,7 @@ async function mailboxTimeZone(client2) {
 }
 
 // src/tools/calendar.ts
-var EVENT_SELECT = "Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,BodyPreview";
+var EVENT_SELECT = "Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,OnlineMeeting,BodyPreview";
 function qs2(params) {
   const parts = [];
   for (const [k, v] of Object.entries(params)) {
@@ -48608,6 +48729,28 @@ function qs2(params) {
   }
   return parts.length ? `?${parts.join("&")}` : "";
 }
+function dateTimeTimeZone(value, zone) {
+  if (/(Z|[+-]\d{2}:?\d{2})$/i.test(value)) {
+    const d = new Date(value);
+    if (!Number.isNaN(d.getTime())) {
+      return { DateTime: d.toISOString().replace(/\.\d{3}Z$/, ""), TimeZone: "UTC" };
+    }
+  }
+  return { DateTime: value, TimeZone: zone };
+}
+function assertWindow(start, end) {
+  const a = Date.parse(start);
+  const b = Date.parse(end);
+  if (!Number.isNaN(a) && !Number.isNaN(b) && b <= a) {
+    throw new McpToolError(`The window ends (${end}) before it starts (${start}).`, {
+      hint: "`end` must be later than `start`."
+    });
+  }
+}
+function trimTime(dt) {
+  return dt?.replace(/\.0+$/, "");
+}
+var attendeeList = (what) => external_exports.array(external_exports.string().min(3)).describe(`Email addresses of ${what}`);
 function registerCalendarTools(server, client2) {
   server.registerTool(
     "outlook_list_events",
@@ -48684,6 +48827,119 @@ function registerCalendarTools(server, client2) {
       return minifiedResult(plainCollection(data));
     }
   );
+  server.registerTool(
+    "outlook_find_meeting_times",
+    {
+      description: "Find times when people can meet \u2014 Outlook's Scheduling Assistant. Give the attendees, a search window and a duration; Outlook checks everyone's free/busy (and the signed-in user's, as organizer) and returns ranked candidate slots with each attendee's availability. By default only working hours are searched. Use this to answer \"when can X and Y meet?\"; then book with outlook_create_event. `start`/`end` are local wall-clock times in `timeZone` (default: the mailbox zone), and returned slots are in that zone too. " + UNTRUSTED_DESCRIPTION_SUFFIX,
+      annotations: { readOnlyHint: true },
+      inputSchema: external_exports.object({
+        view: viewParam(VIEWS2),
+        attendees: attendeeList("required attendees").min(1),
+        optionalAttendees: attendeeList("optional attendees").optional(),
+        start: external_exports.string().min(1).describe("Earliest the meeting may start, e.g. 2026-10-12T09:00:00"),
+        end: external_exports.string().min(1).describe("Latest the meeting may end, e.g. 2026-10-16T17:00:00"),
+        durationMinutes: external_exports.number().int().min(5).max(1440).describe("Meeting length in minutes"),
+        timeZone: external_exports.string().optional().describe('Windows time-zone name, e.g. "Eastern Standard Time". Defaults to the MAILBOX time zone.'),
+        maxCandidates: external_exports.number().int().min(1).max(50).optional().describe("Max suggestions (default 10)"),
+        workingHoursOnly: external_exports.boolean().optional().describe("Only suggest times inside working hours (default true). false searches around the clock."),
+        minimumAttendeePercentage: external_exports.number().min(0).max(100).optional().describe("Lowest confidence (0-100) a slot needs to be suggested. Lower it to see slots where not everyone is free."),
+        isOrganizerOptional: external_exports.boolean().optional().describe("true when the signed-in user need not attend, so their own calendar is ignored")
+      })
+    },
+    async (args) => {
+      assertWindow(args.start, args.end);
+      const zone = args.timeZone ?? await mailboxTimeZone(client2) ?? "UTC";
+      const body = {
+        Attendees: [
+          ...args.attendees.map((Address) => ({ Type: "Required", EmailAddress: { Address } })),
+          ...(args.optionalAttendees ?? []).map((Address) => ({
+            Type: "Optional",
+            EmailAddress: { Address }
+          }))
+        ],
+        TimeConstraint: {
+          ActivityDomain: args.workingHoursOnly === false ? "Unrestricted" : "Work",
+          Timeslots: [
+            { Start: dateTimeTimeZone(args.start, zone), End: dateTimeTimeZone(args.end, zone) }
+          ]
+        },
+        MeetingDuration: `PT${args.durationMinutes}M`,
+        MaxCandidates: args.maxCandidates ?? 10,
+        ReturnSuggestionReasons: true,
+        ...args.minimumAttendeePercentage !== void 0 ? { MinimumAttendeePercentage: args.minimumAttendeePercentage } : {},
+        ...args.isOrganizerOptional !== void 0 ? { IsOrganizerOptional: args.isOrganizerOptional } : {}
+      };
+      const data = await client2.post("/me/findmeetingtimes", body, { prefer: `outlook.timezone="${zone}"` });
+      if (resolveView(args.view, VIEWS2) === "raw") return mailboxUntrusted(data);
+      const suggestions = (data?.MeetingTimeSuggestions ?? []).map((s) => ({
+        Start: trimTime(s.MeetingTimeSlot?.Start?.DateTime),
+        End: trimTime(s.MeetingTimeSlot?.End?.DateTime),
+        Confidence: s.Confidence,
+        Organizer: s.OrganizerAvailability,
+        Attendees: Object.fromEntries(
+          (s.AttendeeAvailability ?? []).map((a) => [
+            a.Attendee?.EmailAddress?.Address ?? a.Attendee?.EmailAddress?.Name ?? "?",
+            a.Availability
+          ])
+        ),
+        Reason: s.SuggestionReason
+      }));
+      return mailboxUntrusted({
+        timeZone: zone,
+        count: suggestions.length,
+        suggestions,
+        // Outlook explains an empty result ("AttendeesUnavailable", ...); an
+        // empty list without it reads as "nobody is ever free".
+        ...data?.EmptySuggestionsReason ? { emptySuggestionsReason: data.EmptySuggestionsReason } : {}
+      });
+    }
+  );
+  server.registerTool(
+    "outlook_get_schedule",
+    {
+      description: "Get people's free/busy blocks for a time window \u2014 the grid view of Outlook's Scheduling Assistant. Returns each person's busy, tentative and out-of-office items (with subject and location where their calendar shares them). Use outlook_find_meeting_times to have Outlook pick slots instead. `start`/`end` are local wall-clock times in `timeZone` (default: the mailbox zone). " + UNTRUSTED_DESCRIPTION_SUFFIX,
+      annotations: { readOnlyHint: true },
+      inputSchema: external_exports.object({
+        view: viewParam(VIEWS2),
+        people: attendeeList("people (or rooms) to look up").min(1).max(100),
+        start: external_exports.string().min(1).describe("Window start, e.g. 2026-10-12T09:00:00"),
+        end: external_exports.string().min(1).describe("Window end, e.g. 2026-10-12T17:00:00"),
+        timeZone: external_exports.string().optional().describe('Windows time-zone name, e.g. "Eastern Standard Time". Defaults to the MAILBOX time zone.'),
+        intervalMinutes: external_exports.number().int().min(5).max(1440).optional().describe("Slot size for the raw view's AvailabilityView string (default 30)")
+      })
+    },
+    async ({ view, people, start, end, timeZone, intervalMinutes }) => {
+      assertWindow(start, end);
+      const zone = timeZone ?? await mailboxTimeZone(client2) ?? "UTC";
+      const data = await client2.post(
+        "/me/calendar/getschedule",
+        {
+          Schedules: people,
+          StartTime: dateTimeTimeZone(start, zone),
+          EndTime: dateTimeTimeZone(end, zone),
+          AvailabilityViewInterval: intervalMinutes ?? 30
+        },
+        { prefer: `outlook.timezone="${zone}"` }
+      );
+      if (resolveView(view, VIEWS2) === "raw") return mailboxUntrusted(data);
+      const schedules = (data?.value ?? []).map(
+        (p) => (
+          // An unresolvable address must not read as "free all day".
+          p.Error !== void 0 && p.Error !== null ? { Who: p.ScheduleId, Error: p.Error } : {
+            Who: p.ScheduleId,
+            Busy: (p.ScheduleItems ?? []).map((i) => ({
+              Start: trimTime(i.Start?.DateTime),
+              End: trimTime(i.End?.DateTime),
+              Status: i.Status,
+              ...i.Subject ? { Subject: i.Subject } : {},
+              ...i.Location ? { Location: i.Location } : {}
+            }))
+          }
+        )
+      );
+      return mailboxUntrusted({ timeZone: zone, schedules });
+    }
+  );
 }
 
 // src/tools/directory.ts
@@ -48808,6 +49064,31 @@ function messageBody(subject, body, html) {
     Body: { ContentType: html === true ? "HTML" : "Text", Content: body }
   };
 }
+var TEAMS = { IsOnlineMeeting: true, OnlineMeetingProvider: "TeamsForBusiness" };
+var teamsMeetingParam = external_exports.boolean().optional().describe("Attach a Microsoft Teams meeting (default true). false leaves it off.");
+var EVENT_STATE_SELECT = "Id,Subject,IsOrganizer,Start,End,Location,Attendees,IsOnlineMeeting,OnlineMeetingProvider,OnlineMeeting";
+function attendee(Address, Type) {
+  return { Type, EmailAddress: { Address } };
+}
+var lower = (a) => a.EmailAddress?.Address?.toLowerCase();
+function joinUrlOf(e) {
+  return e?.OnlineMeeting?.JoinUrl || void 0;
+}
+function isTeams(e) {
+  return e.IsOnlineMeeting === true && e.OnlineMeetingProvider === "TeamsForBusiness";
+}
+function dateTimeTimeZone2(value, zone) {
+  if (/(Z|[+-]\d{2}:?\d{2})$/i.test(value)) {
+    const d = new Date(value);
+    if (!Number.isNaN(d.getTime())) {
+      return { DateTime: d.toISOString().replace(/\.\d{3}Z$/, ""), TimeZone: "UTC" };
+    }
+  }
+  return { DateTime: value, TimeZone: zone };
+}
+var naiveMs = (dt) => Date.parse(`${dt.replace(/\.\d+$/, "")}Z`);
+var fromNaiveMs = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "");
+var trimTime2 = (dt) => dt?.replace(/\.\d+$/, "");
 function registerWriteTools(server, client2) {
   server.registerTool(
     "outlook_send_mail",
@@ -48967,7 +49248,7 @@ function registerWriteTools(server, client2) {
   server.registerTool(
     "outlook_create_event",
     {
-      description: 'Create a calendar event. `timeZone` takes a WINDOWS zone name such as "Eastern Standard Time", not an IANA name. Attendees are emailed an invitation. ' + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
+      description: 'Create a calendar event or meeting. A Microsoft Teams meeting is attached by default (`teamsMeeting: false` to skip) and its join link is returned. `timeZone` takes a WINDOWS zone name such as "Eastern Standard Time", not an IANA name. Attendees are emailed an invitation. To pick a time first, use outlook_find_meeting_times. ' + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
       annotations: { readOnlyHint: false, destructiveHint: false },
       inputSchema: external_exports.object({
         subject: external_exports.string().describe("Event title"),
@@ -48976,11 +49257,18 @@ function registerWriteTools(server, client2) {
         timeZone: external_exports.string().optional().describe("Windows time-zone name. Defaults to the MAILBOX time zone."),
         location: external_exports.string().optional().describe("Location display name"),
         body: external_exports.string().optional().describe("Event description"),
-        attendees: recipientList,
+        attendees: recipientList.describe("Required attendees' email addresses"),
+        optionalAttendees: recipientList.describe("Optional attendees' email addresses"),
+        teamsMeeting: teamsMeetingParam,
         confirmToken: confirmTokenParam
       })
     },
-    async ({ subject, start, end, timeZone, location, body, attendees, confirmToken }, ctx) => {
+    async ({ subject, start, end, timeZone, location, body, attendees, optionalAttendees, teamsMeeting, confirmToken }, ctx) => {
+      const wantTeams = teamsMeeting !== false;
+      const allAttendees = [
+        ...(attendees ?? []).map((a) => attendee(a, "Required")),
+        ...(optionalAttendees ?? []).map((a) => attendee(a, "Optional"))
+      ];
       const tz = timeZone ?? await mailboxTimeZone(client2) ?? "UTC";
       const payload = {
         Subject: subject,
@@ -48988,18 +49276,14 @@ function registerWriteTools(server, client2) {
         End: { DateTime: end, TimeZone: tz },
         ...location ? { Location: { DisplayName: location } } : {},
         ...body ? { Body: { ContentType: "Text", Content: body } } : {},
-        ...attendees?.length ? {
-          Attendees: attendees.map((Address) => ({
-            EmailAddress: { Address },
-            Type: "Required"
-          }))
-        } : {}
+        ...allAttendees.length ? { Attendees: allAttendees } : {},
+        ...wantTeams ? TEAMS : {}
       };
       const gate = await confirmWrite(ctx, {
         tool: "outlook_create_event",
         action: "calendar.create_event",
         message: "Review and confirm this event (attendees are emailed an invitation):",
-        summary: `Create event "${subject}" ${start} to ${end} (${tz})`,
+        summary: `Create ${wantTeams ? "Teams meeting" : "event"} "${subject}" ${start} to ${end} (${tz})`,
         // One signed-in mailbox per server process.
         account: void 0,
         request: { method: "POST", path: "/me/events", body: payload },
@@ -49011,7 +49295,136 @@ function registerWriteTools(server, client2) {
         "/me/events",
         payload
       );
-      return minifiedResult({ created: true, Id: created?.Id, WebLink: created?.WebLink });
+      let joinUrl = joinUrlOf(created);
+      if (wantTeams && !joinUrl && created?.Id) {
+        const after = await client2.get(
+          `/me/events/${encodeURIComponent(created.Id)}?$select=OnlineMeeting`
+        );
+        joinUrl = joinUrlOf(after);
+      }
+      return minifiedResult({
+        created: true,
+        Id: created?.Id,
+        WebLink: created?.WebLink,
+        ...joinUrl ? { JoinUrl: joinUrl } : {},
+        ...wantTeams && !joinUrl ? { warning: "The event was created, but Outlook returned no Teams join link." } : {}
+      });
+    }
+  );
+  server.registerTool(
+    "outlook_update_event",
+    {
+      description: "Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting's length. A Microsoft Teams meeting is added if the event lacks one (`teamsMeeting: false` to skip). Attendees are sent an updated invitation. Only the organizer can update a meeting \u2014 an attendee's edit would change their own copy alone, so it is refused. The result is verified by re-reading the event. " + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+      inputSchema: external_exports.object({
+        id: external_exports.string().min(1).describe("Event Id from outlook_list_events or outlook_get_event"),
+        subject: external_exports.string().optional().describe("New title"),
+        start: external_exports.string().optional().describe("New start, ISO 8601 local time e.g. 2026-09-22T15:00:00"),
+        end: external_exports.string().optional().describe("New end. Omit when moving `start` to keep the current length."),
+        timeZone: external_exports.string().optional().describe("Windows time-zone name for start/end. Defaults to the MAILBOX time zone."),
+        location: external_exports.string().optional().describe("New location display name"),
+        body: external_exports.string().optional().describe("New description (replaces the existing one)"),
+        addAttendees: recipientList.describe("Required attendees to add"),
+        addOptionalAttendees: recipientList.describe("Optional attendees to add"),
+        removeAttendees: recipientList.describe("Attendees to remove"),
+        teamsMeeting: teamsMeetingParam,
+        confirmToken: confirmTokenParam
+      })
+    },
+    async (args, ctx) => {
+      const tz = args.timeZone ?? await mailboxTimeZone(client2) ?? "UTC";
+      const path = `/me/events/${encodeURIComponent(args.id)}`;
+      const readEvent = (zone) => client2.get(`${path}?$select=${EVENT_STATE_SELECT}`, {
+        prefer: `outlook.timezone="${zone}"`
+      });
+      const current = await readEvent(tz);
+      if (current?.IsOrganizer === false) {
+        throw new McpToolError("Only the organizer can update this meeting.", {
+          hint: "You are an attendee. Changing your copy would not reach the organizer or anyone else; ask the organizer, or propose a new time from Outlook."
+        });
+      }
+      const payload = {};
+      if (args.subject !== void 0) payload.Subject = args.subject;
+      if (args.location !== void 0) payload.Location = { DisplayName: args.location };
+      if (args.body !== void 0) payload.Body = { ContentType: "Text", Content: args.body };
+      if (args.start !== void 0 || args.end !== void 0) {
+        const start = args.start !== void 0 ? dateTimeTimeZone2(args.start, tz) : void 0;
+        let end = args.end !== void 0 ? dateTimeTimeZone2(args.end, tz) : void 0;
+        if (start && !end && current?.Start?.DateTime && current?.End?.DateTime) {
+          const length = naiveMs(current.End.DateTime) - naiveMs(current.Start.DateTime);
+          end = { DateTime: fromNaiveMs(naiveMs(start.DateTime) + length), TimeZone: start.TimeZone };
+        }
+        if (args.start !== void 0 && args.end !== void 0 && start?.TimeZone !== end?.TimeZone) {
+          throw new McpToolError("`start` and `end` are in different zones.", {
+            hint: "Give both the same way: both local wall-clock times, or both with Z or an offset."
+          });
+        }
+        const startIn = start ?? (end && end.TimeZone !== tz ? (await readEvent(end.TimeZone))?.Start : current?.Start);
+        if (end && startIn?.DateTime && naiveMs(end.DateTime) <= naiveMs(startIn.DateTime)) {
+          throw new McpToolError("The meeting would end before it starts.", {
+            hint: "`end` must be later than `start`."
+          });
+        }
+        if (start) payload.Start = start;
+        if (end) payload.End = end;
+      }
+      const adding = [
+        ...(args.addAttendees ?? []).map((a) => attendee(a, "Required")),
+        ...(args.addOptionalAttendees ?? []).map((a) => attendee(a, "Optional"))
+      ];
+      const removing = new Set((args.removeAttendees ?? []).map((a) => a.toLowerCase()));
+      if (adding.length || removing.size) {
+        const next = (current?.Attendees ?? []).filter((a) => !removing.has(lower(a) ?? "")).map(({ Type, EmailAddress }) => ({ Type, EmailAddress }));
+        for (const a of adding) {
+          if (!next.some((n) => lower(n) === lower(a))) next.push(a);
+        }
+        payload.Attendees = next;
+      }
+      const addTeams = args.teamsMeeting !== false && !(current && isTeams(current));
+      if (addTeams) Object.assign(payload, TEAMS);
+      if (Object.keys(payload).length === 0) {
+        throw new McpToolError("Nothing to update.", {
+          hint: "Pass at least one of subject, start, end, location, body, or attendee changes."
+        });
+      }
+      const gate = await confirmWrite(ctx, {
+        tool: "outlook_update_event",
+        action: "calendar.update_event",
+        message: "Review and confirm this change (attendees are sent an updated invitation):",
+        summary: `Update "${current?.Subject ?? args.id}": ${Object.keys(payload).join(", ")}`,
+        // One signed-in mailbox per server process.
+        account: void 0,
+        target: args.id,
+        request: { method: "PATCH", path, body: payload },
+        confirmToken: args.confirmToken
+      });
+      if (gate) return gate;
+      await client2.write("PATCH", path, payload);
+      const writtenZone = (payload.Start ?? payload.End)?.TimeZone ?? tz;
+      const after = await readEvent(writtenZone);
+      const unchanged = [];
+      if (payload.Subject !== void 0 && after?.Subject !== payload.Subject) unchanged.push("Subject");
+      for (const key of ["Start", "End"]) {
+        const want = payload[key];
+        if (want && trimTime2(after?.[key]?.DateTime) !== trimTime2(want.DateTime)) unchanged.push(key);
+      }
+      if (payload.Location !== void 0 && after?.Location?.DisplayName !== args.location) {
+        unchanged.push("Location");
+      }
+      if (payload.Attendees !== void 0) {
+        const want = payload.Attendees.map(lower).sort().join();
+        const got = (after?.Attendees ?? []).map(lower).sort().join();
+        if (want !== got) unchanged.push("Attendees");
+      }
+      const joinUrl = joinUrlOf(after);
+      if (addTeams && !joinUrl) unchanged.push("Teams meeting");
+      return minifiedResult({
+        updated: unchanged.length === 0,
+        Id: after?.Id ?? args.id,
+        changed: Object.keys(payload),
+        ...joinUrl ? { JoinUrl: joinUrl } : {},
+        ...unchanged.length ? { warning: `Outlook accepted the update but these did not change: ${unchanged.join(", ")}.` } : {}
+      });
     }
   );
 }

package/dist/client.js

@@ -228,6 +228,19 @@ export class OutlookClient {
         }
         return this.get(target.pathname.slice(prefix.length) + target.search, opts);
     }
+    /**
+     * POST a read-only query — `findmeetingtimes`, `getschedule` — that changes
+     * nothing in the mailbox. Kept apart from `write` so a reader can tell the
+     * two apart at the call site, and because these take `Prefer` (notably
+     * `outlook.timezone`, without which every returned slot is UTC).
+     */
+    async post(path, body, opts = {}) {
+        this.#requireConfigured();
+        return this.#client().fetchJson('POST', path, {
+            body,
+            headers: opts.prefer ? { Prefer: opts.prefer } : undefined,
+        });
+    }
     /**
      * The single write path. Everything mutating goes through here so auth and
      * error shaping stay in one place.

package/dist/tools/calendar.js

@@ -1,11 +1,11 @@
 import { z } from 'zod';
-import { minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
+import { McpToolError, minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
 import { mailboxUntrusted, UNTRUSTED_DESCRIPTION_SUFFIX } from './_untrusted.js';
 import { compactEvent, fullEvent, projectCollection, } from '../view.js';
 import { fetchPage, nextLinkParam, plainCollection } from './_paging.js';
 import { VIEWS } from './mail.js';
 import { mailboxTimeZone } from '../timezone.js';
-const EVENT_SELECT = 'Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,BodyPreview';
+const EVENT_SELECT = 'Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,OnlineMeeting,BodyPreview';
 function qs(params) {
     const parts = [];
     for (const [k, v] of Object.entries(params)) {
@@ -15,6 +15,37 @@ function qs(params) {
     }
     return parts.length ? `?${parts.join('&')}` : '';
 }
+/**
+ * An Outlook `DateTimeTimeZone` for a caller-supplied time.
+ *
+ * A wall-clock time ("2026-10-12T09:00:00") is read in `zone`, matching
+ * outlook_create_event. One carrying `Z` or an offset already names its
+ * instant, so it is converted to UTC rather than having its offset silently
+ * ignored and re-read in the mailbox zone.
+ */
+function dateTimeTimeZone(value, zone) {
+    if (/(Z|[+-]\d{2}:?\d{2})$/i.test(value)) {
+        const d = new Date(value);
+        if (!Number.isNaN(d.getTime())) {
+            return { DateTime: d.toISOString().replace(/\.\d{3}Z$/, ''), TimeZone: 'UTC' };
+        }
+    }
+    return { DateTime: value, TimeZone: zone };
+}
+function assertWindow(start, end) {
+    const a = Date.parse(start);
+    const b = Date.parse(end);
+    if (!Number.isNaN(a) && !Number.isNaN(b) && b <= a) {
+        throw new McpToolError(`The window ends (${end}) before it starts (${start}).`, {
+            hint: '`end` must be later than `start`.',
+        });
+    }
+}
+/** Outlook pads times to 7 fractional digits; that is noise to a reader. */
+function trimTime(dt) {
+    return dt?.replace(/\.0+$/, '');
+}
+const attendeeList = (what) => z.array(z.string().min(3)).describe(`Email addresses of ${what}`);
 export function registerCalendarTools(server, client) {
     server.registerTool('outlook_list_events', {
         description: 'List calendar events in a date window. This uses the calendar VIEW, which expands recurring series into their individual occurrences — the right tool for "what is on my schedule". Times are returned in `timeZone` when given.' +
@@ -78,4 +109,135 @@ export function registerCalendarTools(server, client) {
             return minifiedResult(data);
         return minifiedResult(plainCollection(data));
     });
+    server.registerTool('outlook_find_meeting_times', {
+        description: "Find times when people can meet — Outlook's Scheduling Assistant. Give the attendees, a search window and a duration; Outlook checks everyone's free/busy (and the signed-in user's, as organizer) and returns ranked candidate slots with each attendee's availability. By default only working hours are searched. Use this to answer \"when can X and Y meet?\"; then book with outlook_create_event. `start`/`end` are local wall-clock times in `timeZone` (default: the mailbox zone), and returned slots are in that zone too." +
+            ' ' + UNTRUSTED_DESCRIPTION_SUFFIX,
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            attendees: attendeeList('required attendees').min(1),
+            optionalAttendees: attendeeList('optional attendees').optional(),
+            start: z.string().min(1).describe('Earliest the meeting may start, e.g. 2026-10-12T09:00:00'),
+            end: z.string().min(1).describe('Latest the meeting may end, e.g. 2026-10-16T17:00:00'),
+            durationMinutes: z.number().int().min(5).max(1440).describe('Meeting length in minutes'),
+            timeZone: z
+                .string()
+                .optional()
+                .describe('Windows time-zone name, e.g. "Eastern Standard Time". Defaults to the MAILBOX time zone.'),
+            maxCandidates: z.number().int().min(1).max(50).optional().describe('Max suggestions (default 10)'),
+            workingHoursOnly: z
+                .boolean()
+                .optional()
+                .describe("Only suggest times inside working hours (default true). false searches around the clock."),
+            minimumAttendeePercentage: z
+                .number()
+                .min(0)
+                .max(100)
+                .optional()
+                .describe('Lowest confidence (0-100) a slot needs to be suggested. Lower it to see slots where not everyone is free.'),
+            isOrganizerOptional: z
+                .boolean()
+                .optional()
+                .describe("true when the signed-in user need not attend, so their own calendar is ignored"),
+        }),
+    }, async (args) => {
+        assertWindow(args.start, args.end);
+        const zone = args.timeZone ?? (await mailboxTimeZone(client)) ?? 'UTC';
+        const body = {
+            Attendees: [
+                ...args.attendees.map((Address) => ({ Type: 'Required', EmailAddress: { Address } })),
+                ...(args.optionalAttendees ?? []).map((Address) => ({
+                    Type: 'Optional',
+                    EmailAddress: { Address },
+                })),
+            ],
+            TimeConstraint: {
+                ActivityDomain: args.workingHoursOnly === false ? 'Unrestricted' : 'Work',
+                Timeslots: [
+                    { Start: dateTimeTimeZone(args.start, zone), End: dateTimeTimeZone(args.end, zone) },
+                ],
+            },
+            MeetingDuration: `PT${args.durationMinutes}M`,
+            MaxCandidates: args.maxCandidates ?? 10,
+            ReturnSuggestionReasons: true,
+            ...(args.minimumAttendeePercentage !== undefined
+                ? { MinimumAttendeePercentage: args.minimumAttendeePercentage }
+                : {}),
+            ...(args.isOrganizerOptional !== undefined
+                ? { IsOrganizerOptional: args.isOrganizerOptional }
+                : {}),
+        };
+        const data = await client.post('/me/findmeetingtimes', body, { prefer: `outlook.timezone="${zone}"` });
+        if (resolveView(args.view, VIEWS) === 'raw')
+            return mailboxUntrusted(data);
+        const suggestions = (data?.MeetingTimeSuggestions ?? []).map((s) => ({
+            Start: trimTime(s.MeetingTimeSlot?.Start?.DateTime),
+            End: trimTime(s.MeetingTimeSlot?.End?.DateTime),
+            Confidence: s.Confidence,
+            Organizer: s.OrganizerAvailability,
+            Attendees: Object.fromEntries((s.AttendeeAvailability ?? []).map((a) => [
+                a.Attendee?.EmailAddress?.Address ?? a.Attendee?.EmailAddress?.Name ?? '?',
+                a.Availability,
+            ])),
+            Reason: s.SuggestionReason,
+        }));
+        return mailboxUntrusted({
+            timeZone: zone,
+            count: suggestions.length,
+            suggestions,
+            // Outlook explains an empty result ("AttendeesUnavailable", ...); an
+            // empty list without it reads as "nobody is ever free".
+            ...(data?.EmptySuggestionsReason
+                ? { emptySuggestionsReason: data.EmptySuggestionsReason }
+                : {}),
+        });
+    });
+    server.registerTool('outlook_get_schedule', {
+        description: "Get people's free/busy blocks for a time window — the grid view of Outlook's Scheduling Assistant. Returns each person's busy, tentative and out-of-office items (with subject and location where their calendar shares them). Use outlook_find_meeting_times to have Outlook pick slots instead. `start`/`end` are local wall-clock times in `timeZone` (default: the mailbox zone)." +
+            ' ' + UNTRUSTED_DESCRIPTION_SUFFIX,
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            people: attendeeList('people (or rooms) to look up').min(1).max(100),
+            start: z.string().min(1).describe('Window start, e.g. 2026-10-12T09:00:00'),
+            end: z.string().min(1).describe('Window end, e.g. 2026-10-12T17:00:00'),
+            timeZone: z
+                .string()
+                .optional()
+                .describe('Windows time-zone name, e.g. "Eastern Standard Time". Defaults to the MAILBOX time zone.'),
+            intervalMinutes: z
+                .number()
+                .int()
+                .min(5)
+                .max(1440)
+                .optional()
+                .describe('Slot size for the raw view\'s AvailabilityView string (default 30)'),
+        }),
+    }, async ({ view, people, start, end, timeZone, intervalMinutes }) => {
+        assertWindow(start, end);
+        const zone = timeZone ?? (await mailboxTimeZone(client)) ?? 'UTC';
+        const data = await client.post('/me/calendar/getschedule', {
+            Schedules: people,
+            StartTime: dateTimeTimeZone(start, zone),
+            EndTime: dateTimeTimeZone(end, zone),
+            AvailabilityViewInterval: intervalMinutes ?? 30,
+        }, { prefer: `outlook.timezone="${zone}"` });
+        if (resolveView(view, VIEWS) === 'raw')
+            return mailboxUntrusted(data);
+        const schedules = (data?.value ?? []).map((p) => 
+        // An unresolvable address must not read as "free all day".
+        p.Error !== undefined && p.Error !== null
+            ? { Who: p.ScheduleId, Error: p.Error }
+            : {
+                Who: p.ScheduleId,
+                Busy: (p.ScheduleItems ?? []).map((i) => ({
+                    Start: trimTime(i.Start?.DateTime),
+                    End: trimTime(i.End?.DateTime),
+                    Status: i.Status,
+                    ...(i.Subject ? { Subject: i.Subject } : {}),
+                    ...(i.Location ? { Location: i.Location } : {}),
+                })),
+            });
+        return mailboxUntrusted({ timeZone: zone, schedules });
+    });
 }

package/dist/tools/writes.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { CONFIRM_FLOW_SENTENCE, CONFIRM_INJECTION_RULE, confirmTokenParam, confirmWrite, minifiedResult, } from '@chrischall/mcp-utils';
+import { CONFIRM_FLOW_SENTENCE, CONFIRM_INJECTION_RULE, confirmTokenParam, confirmWrite, McpToolError, minifiedResult, } from '@chrischall/mcp-utils';
 import { mailboxTimeZone } from '../timezone.js';
 const recipientList = z
     .array(z.string().min(3))
@@ -18,6 +18,44 @@ function messageBody(subject, body, html) {
         Body: { ContentType: html === true ? 'HTML' : 'Text', Content: body },
     };
 }
+/**
+ * What makes an event a Teams meeting. Field names verified on live events
+ * 2026-10-08; the join link then appears at `OnlineMeeting.JoinUrl`.
+ */
+const TEAMS = { IsOnlineMeeting: true, OnlineMeetingProvider: 'TeamsForBusiness' };
+const teamsMeetingParam = z
+    .boolean()
+    .optional()
+    .describe('Attach a Microsoft Teams meeting (default true). false leaves it off.');
+const EVENT_STATE_SELECT = 'Id,Subject,IsOrganizer,Start,End,Location,Attendees,IsOnlineMeeting,OnlineMeetingProvider,OnlineMeeting';
+function attendee(Address, Type) {
+    return { Type, EmailAddress: { Address } };
+}
+const lower = (a) => a.EmailAddress?.Address?.toLowerCase();
+function joinUrlOf(e) {
+    return e?.OnlineMeeting?.JoinUrl || undefined;
+}
+function isTeams(e) {
+    return e.IsOnlineMeeting === true && e.OnlineMeetingProvider === 'TeamsForBusiness';
+}
+/**
+ * A `DateTimeTimeZone` for a caller-supplied time: wall-clock is read in
+ * `zone`; a value with `Z` or an offset already names its instant and goes to
+ * UTC rather than having the offset ignored.
+ */
+function dateTimeTimeZone(value, zone) {
+    if (/(Z|[+-]\d{2}:?\d{2})$/i.test(value)) {
+        const d = new Date(value);
+        if (!Number.isNaN(d.getTime())) {
+            return { DateTime: d.toISOString().replace(/\.\d{3}Z$/, ''), TimeZone: 'UTC' };
+        }
+    }
+    return { DateTime: value, TimeZone: zone };
+}
+/** Wall-clock arithmetic: both sides are naive times in one zone. */
+const naiveMs = (dt) => Date.parse(`${dt.replace(/\.\d+$/, '')}Z`);
+const fromNaiveMs = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, '');
+const trimTime = (dt) => dt?.replace(/\.\d+$/, '');
 export function registerWriteTools(server, client) {
     server.registerTool('outlook_send_mail', {
         description: 'Send an email from the signed-in mailbox.' +
@@ -172,7 +210,7 @@ export function registerWriteTools(server, client) {
         });
     });
     server.registerTool('outlook_create_event', {
-        description: 'Create a calendar event. `timeZone` takes a WINDOWS zone name such as "Eastern Standard Time", not an IANA name. Attendees are emailed an invitation.' +
+        description: 'Create a calendar event or meeting. A Microsoft Teams meeting is attached by default (`teamsMeeting: false` to skip) and its join link is returned. `timeZone` takes a WINDOWS zone name such as "Eastern Standard Time", not an IANA name. Attendees are emailed an invitation. To pick a time first, use outlook_find_meeting_times.' +
             ' ' +
             CONFIRM_FLOW_SENTENCE +
             ' ' +
@@ -188,10 +226,17 @@ export function registerWriteTools(server, client) {
                 .describe('Windows time-zone name. Defaults to the MAILBOX time zone.'),
             location: z.string().optional().describe('Location display name'),
             body: z.string().optional().describe('Event description'),
-            attendees: recipientList,
+            attendees: recipientList.describe('Required attendees\' email addresses'),
+            optionalAttendees: recipientList.describe('Optional attendees\' email addresses'),
+            teamsMeeting: teamsMeetingParam,
             confirmToken: confirmTokenParam,
         }),
-    }, async ({ subject, start, end, timeZone, location, body, attendees, confirmToken }, ctx) => {
+    }, async ({ subject, start, end, timeZone, location, body, attendees, optionalAttendees, teamsMeeting, confirmToken }, ctx) => {
+        const wantTeams = teamsMeeting !== false;
+        const allAttendees = [
+            ...(attendees ?? []).map((a) => attendee(a, 'Required')),
+            ...(optionalAttendees ?? []).map((a) => attendee(a, 'Optional')),
+        ];
         // Falls back to UTC only when the mailbox itself declares no zone.
         const tz = timeZone ?? (await mailboxTimeZone(client)) ?? 'UTC';
         const payload = {
@@ -200,20 +245,14 @@ export function registerWriteTools(server, client) {
             End: { DateTime: end, TimeZone: tz },
             ...(location ? { Location: { DisplayName: location } } : {}),
             ...(body ? { Body: { ContentType: 'Text', Content: body } } : {}),
-            ...(attendees?.length
-                ? {
-                    Attendees: attendees.map((Address) => ({
-                        EmailAddress: { Address },
-                        Type: 'Required',
-                    })),
-                }
-                : {}),
+            ...(allAttendees.length ? { Attendees: allAttendees } : {}),
+            ...(wantTeams ? TEAMS : {}),
         };
         const gate = await confirmWrite(ctx, {
             tool: 'outlook_create_event',
             action: 'calendar.create_event',
             message: 'Review and confirm this event (attendees are emailed an invitation):',
-            summary: `Create event "${subject}" ${start} to ${end} (${tz})`,
+            summary: `Create ${wantTeams ? 'Teams meeting' : 'event'} "${subject}" ${start} to ${end} (${tz})`,
             // One signed-in mailbox per server process.
             account: undefined,
             request: { method: 'POST', path: '/me/events', body: payload },
@@ -222,6 +261,175 @@ export function registerWriteTools(server, client) {
         if (gate)
             return gate;
         const created = await client.write('POST', '/me/events', payload);
-        return minifiedResult({ created: true, Id: created?.Id, WebLink: created?.WebLink });
+        let joinUrl = joinUrlOf(created);
+        // A 201 is not proof the Teams meeting was provisioned — the link is.
+        // Re-read once in case it was filled in after the create returned.
+        if (wantTeams && !joinUrl && created?.Id) {
+            const after = await client.get(`/me/events/${encodeURIComponent(created.Id)}?$select=OnlineMeeting`);
+            joinUrl = joinUrlOf(after);
+        }
+        return minifiedResult({
+            created: true,
+            Id: created?.Id,
+            WebLink: created?.WebLink,
+            ...(joinUrl ? { JoinUrl: joinUrl } : {}),
+            ...(wantTeams && !joinUrl
+                ? { warning: 'The event was created, but Outlook returned no Teams join link.' }
+                : {}),
+        });
+    });
+    server.registerTool('outlook_update_event', {
+        description: 'Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting\'s length. A Microsoft Teams meeting is added if the event lacks one (`teamsMeeting: false` to skip). Attendees are sent an updated invitation. Only the organizer can update a meeting — an attendee\'s edit would change their own copy alone, so it is refused. The result is verified by re-reading the event.' +
+            ' ' +
+            CONFIRM_FLOW_SENTENCE +
+            ' ' +
+            CONFIRM_INJECTION_RULE,
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+        inputSchema: z.object({
+            id: z.string().min(1).describe('Event Id from outlook_list_events or outlook_get_event'),
+            subject: z.string().optional().describe('New title'),
+            start: z.string().optional().describe('New start, ISO 8601 local time e.g. 2026-09-22T15:00:00'),
+            end: z
+                .string()
+                .optional()
+                .describe('New end. Omit when moving `start` to keep the current length.'),
+            timeZone: z
+                .string()
+                .optional()
+                .describe('Windows time-zone name for start/end. Defaults to the MAILBOX time zone.'),
+            location: z.string().optional().describe('New location display name'),
+            body: z.string().optional().describe('New description (replaces the existing one)'),
+            addAttendees: recipientList.describe('Required attendees to add'),
+            addOptionalAttendees: recipientList.describe('Optional attendees to add'),
+            removeAttendees: recipientList.describe('Attendees to remove'),
+            teamsMeeting: teamsMeetingParam,
+            confirmToken: confirmTokenParam,
+        }),
+    }, async (args, ctx) => {
+        const tz = args.timeZone ?? (await mailboxTimeZone(client)) ?? 'UTC';
+        const path = `/me/events/${encodeURIComponent(args.id)}`;
+        const readEvent = (zone) => client.get(`${path}?$select=${EVENT_STATE_SELECT}`, {
+            prefer: `outlook.timezone="${zone}"`,
+        });
+        const current = await readEvent(tz);
+        if (current?.IsOrganizer === false) {
+            throw new McpToolError('Only the organizer can update this meeting.', {
+                hint: "You are an attendee. Changing your copy would not reach the organizer or anyone else; ask the organizer, or propose a new time from Outlook.",
+            });
+        }
+        const payload = {};
+        if (args.subject !== undefined)
+            payload.Subject = args.subject;
+        if (args.location !== undefined)
+            payload.Location = { DisplayName: args.location };
+        if (args.body !== undefined)
+            payload.Body = { ContentType: 'Text', Content: args.body };
+        if (args.start !== undefined || args.end !== undefined) {
+            const start = args.start !== undefined ? dateTimeTimeZone(args.start, tz) : undefined;
+            let end = args.end !== undefined ? dateTimeTimeZone(args.end, tz) : undefined;
+            // Moving the start alone keeps the length. The current times were read
+            // in `tz`, so convert the duration onto whatever zone the new start uses.
+            if (start && !end && current?.Start?.DateTime && current?.End?.DateTime) {
+                const length = naiveMs(current.End.DateTime) - naiveMs(current.Start.DateTime);
+                end = { DateTime: fromNaiveMs(naiveMs(start.DateTime) + length), TimeZone: start.TimeZone };
+            }
+            // A wall-clock time and one with an offset cannot be ordered without
+            // the Windows zone's rules, which we do not have. Refuse rather than
+            // skip the order check and write a meeting that ends before it starts.
+            if (args.start !== undefined && args.end !== undefined && start?.TimeZone !== end?.TimeZone) {
+                throw new McpToolError('`start` and `end` are in different zones.', {
+                    hint: 'Give both the same way: both local wall-clock times, or both with Z or an offset.',
+                });
+            }
+            // Order check against the start the meeting will have. When only `end`
+            // moves that is the current start, read in the end's zone.
+            const startIn = start ??
+                (end && end.TimeZone !== tz
+                    ? (await readEvent(end.TimeZone))?.Start
+                    : current?.Start);
+            if (end &&
+                startIn?.DateTime &&
+                naiveMs(end.DateTime) <= naiveMs(startIn.DateTime)) {
+                throw new McpToolError('The meeting would end before it starts.', {
+                    hint: '`end` must be later than `start`.',
+                });
+            }
+            if (start)
+                payload.Start = start;
+            if (end)
+                payload.End = end;
+        }
+        const adding = [
+            ...(args.addAttendees ?? []).map((a) => attendee(a, 'Required')),
+            ...(args.addOptionalAttendees ?? []).map((a) => attendee(a, 'Optional')),
+        ];
+        const removing = new Set((args.removeAttendees ?? []).map((a) => a.toLowerCase()));
+        if (adding.length || removing.size) {
+            // PATCH replaces the whole list, so build it from the current one.
+            const next = (current?.Attendees ?? [])
+                .filter((a) => !removing.has(lower(a) ?? ''))
+                .map(({ Type, EmailAddress }) => ({ Type, EmailAddress }));
+            for (const a of adding) {
+                if (!next.some((n) => lower(n) === lower(a)))
+                    next.push(a);
+            }
+            payload.Attendees = next;
+        }
+        const addTeams = args.teamsMeeting !== false && !(current && isTeams(current));
+        if (addTeams)
+            Object.assign(payload, TEAMS);
+        if (Object.keys(payload).length === 0) {
+            throw new McpToolError('Nothing to update.', {
+                hint: 'Pass at least one of subject, start, end, location, body, or attendee changes.',
+            });
+        }
+        const gate = await confirmWrite(ctx, {
+            tool: 'outlook_update_event',
+            action: 'calendar.update_event',
+            message: 'Review and confirm this change (attendees are sent an updated invitation):',
+            summary: `Update "${current?.Subject ?? args.id}": ${Object.keys(payload).join(', ')}`,
+            // One signed-in mailbox per server process.
+            account: undefined,
+            target: args.id,
+            request: { method: 'PATCH', path, body: payload },
+            confirmToken: args.confirmToken,
+        });
+        if (gate)
+            return gate;
+        await client.write('PATCH', path, payload);
+        // Re-read rather than trust the status, in the zone the write used so
+        // the times compare like for like.
+        // Start and End share a zone (enforced above), but either may be alone.
+        const writtenZone = (payload.Start ?? payload.End)?.TimeZone ?? tz;
+        const after = await readEvent(writtenZone);
+        const unchanged = [];
+        if (payload.Subject !== undefined && after?.Subject !== payload.Subject)
+            unchanged.push('Subject');
+        for (const key of ['Start', 'End']) {
+            const want = payload[key];
+            if (want && trimTime(after?.[key]?.DateTime) !== trimTime(want.DateTime))
+                unchanged.push(key);
+        }
+        if (payload.Location !== undefined && after?.Location?.DisplayName !== args.location) {
+            unchanged.push('Location');
+        }
+        if (payload.Attendees !== undefined) {
+            const want = payload.Attendees.map(lower).sort().join();
+            const got = (after?.Attendees ?? []).map(lower).sort().join();
+            if (want !== got)
+                unchanged.push('Attendees');
+        }
+        const joinUrl = joinUrlOf(after);
+        if (addTeams && !joinUrl)
+            unchanged.push('Teams meeting');
+        return minifiedResult({
+            updated: unchanged.length === 0,
+            Id: after?.Id ?? args.id,
+            changed: Object.keys(payload),
+            ...(joinUrl ? { JoinUrl: joinUrl } : {}),
+            ...(unchanged.length
+                ? { warning: `Outlook accepted the update but these did not change: ${unchanged.join(', ')}.` }
+                : {}),
+        });
     });
 }

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.3.4'; // x-release-please-version
+export const VERSION = '0.4.0'; // x-release-please-version

package/dist/view.js

@@ -70,7 +70,11 @@ export function fullEvent(e) {
         ...compactEvent(e),
         ShowAs: e.ShowAs,
         Attendees: e.Attendees?.map((a) => pruned({ Who: addr(a), Response: a.Status?.Response })),
-        OnlineMeetingUrl: e.OnlineMeetingUrl,
+        // The Teams link lives under OnlineMeeting; OnlineMeetingUrl is empty on
+        // every live Teams meeting checked.
+        JoinUrl: e.OnlineMeeting?.JoinUrl || e.OnlineMeetingUrl || undefined,
+        // Kept beside JoinUrl so a consumer of the old field still finds it.
+        OnlineMeetingUrl: e.OnlineMeetingUrl || undefined,
         Preview: e.BodyPreview?.trim() || undefined,
         WebLink: e.WebLink,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,8 +45,8 @@
     "typecheck": "tsc -p tsconfig.check.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.14.0",
-    "@fetchproxy/server": "^3.4.1",
+    "@chrischall/mcp-utils": "^2.15.0",
+    "@fetchproxy/server": "^3.6.0",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.1",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.3.4",
+  "version": "0.4.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.3.4",
+      "version": "0.4.0",
       "transport": {
         "type": "stdio"
       },