@littlebearapps/outlook-assistant 3.13.0 → 3.14.1

package/index.js

@@ -38,15 +38,23 @@ Key environment variables:
   OUTLOOK_AUTH_METHOD               device-code (default) | browser
   OUTLOOK_AUTH_AUDIENCE             common | consumers | organizations | <tenant-guid>
   OUTLOOK_SHARED_MAILBOX            Opt in to shared mailboxes: read | true (work/school only)
+  OUTLOOK_READ_ONLY                 Set to "true" to refuse every tool call that would change,
+                                    send or delete anything (reads and sign-in still work)
   OUTLOOK_ALLOWED_RECIPIENTS        Comma-separated recipient allowlist
   OUTLOOK_MAX_EMAILS_PER_SESSION    Default cap per session for every rate-limited tool
-                                    (send-email, draft, manage-rules); 0 or unset = no cap
+                                    (send-email, draft, create-event, manage-rules).
+                                    Unset or empty = no cap. 0 BLOCKS those tools; so does
+                                    any value that isn't a whole number (fails closed)
   OUTLOOK_MAX_<TOOL>_PER_SESSION    Per-tool cap overriding the default, tool name in upper
                                     case with _ for -, e.g. OUTLOOK_MAX_SEND_EMAIL_PER_SESSION
+                                    (also covers draft action=send); 0 blocks that tool
   OUTLOOK_DEFAULT_TIMEZONE          IANA timezone for event times (default Australia/Melbourne)
   OUTLOOK_IMMUTABLE_IDS             Set to "true" for message IDs that survive folder moves
   OUTLOOK_SEARCH_SCAN_LIMIT         Local search fallback window (default 500, max 5000)
   OUTLOOK_REQUEST_TIMEOUT_MS        Graph request inactivity timeout (default 60000)
+  OUTLOOK_DEBUG                     Set to "true" for detailed stderr logs (addresses redacted)
+  OUTLOOK_EXPORT_DIR                Extra folder export/attachment downloads may write to
+                                    (besides the temp directory, ~/Downloads, ~/Documents)
   USE_TEST_MODE                     Set to "true" to run against mock data
 
 Documentation: https://github.com/littlebearapps/outlook-assistant`;
@@ -74,33 +82,40 @@ Documentation: https://github.com/littlebearapps/outlook-assistant`;
   process.exit(0);
 }
 
-const { Server } = require('@modelcontextprotocol/sdk/server/index.js');
 const {
   StdioServerTransport,
 } = require('@modelcontextprotocol/sdk/server/stdio.js');
 const config = require('./config');
-const { createRequestHandler } = require('./request-handler');
-
-// Import module tools
-const { authTools, setToolCount } = require('./auth');
-const { calendarTools } = require('./calendar');
-const { emailTools } = require('./email');
-const { folderTools } = require('./folder');
-const { rulesTools } = require('./rules');
-const { contactsTools } = require('./contacts');
-const { categoriesTools } = require('./categories');
-const { settingsTools } = require('./settings');
-const { advancedTools } = require('./advanced');
+const { createServer } = require('./server');
+
+const { setToolCount } = require('./auth');
+const { TOOLS } = require('./tools');
+const { isDebugEnabled } = require('./utils/logger');
+const {
+  blockedTools,
+  resolveSessionLimit,
+  RATE_LIMITED_TOOLS,
+} = require('./utils/safety');
 
 // Log startup information
-console.error(`STARTING ${config.SERVER_NAME.toUpperCase()} MCP SERVER`);
+console.error(
+  `STARTING ${config.SERVER_NAME.toUpperCase()} MCP SERVER v${config.SERVER_VERSION}`
+);
 console.error(`Test mode is ${config.USE_TEST_MODE ? 'enabled' : 'disabled'}`);
+if (isDebugEnabled()) {
+  console.error(
+    'Debug logging is on (OUTLOOK_DEBUG): stderr includes search terms, subjects and Graph errors, with addresses and IDs redacted.'
+  );
+}
 
 // F-1 / F-48: warn at startup when safety belts are unset. Mirrors the
 // warning surfaced by `auth action=about`. Visible to operators reading
 // stderr; AI clients reading the JSON-RPC stream are unaffected.
+const sessionLimitSet = Object.keys(RATE_LIMITED_TOOLS).some(
+  (tool) => resolveSessionLimit(tool).limit !== null
+);
 if (
-  !process.env.OUTLOOK_MAX_EMAILS_PER_SESSION &&
+  !sessionLimitSet &&
   !process.env.OUTLOOK_ALLOWED_RECIPIENTS &&
   !config.USE_TEST_MODE
 ) {
@@ -108,39 +123,18 @@ if (
     '⚠ Safety belts not configured. Consider setting OUTLOOK_MAX_EMAILS_PER_SESSION and OUTLOOK_ALLOWED_RECIPIENTS in your .mcp.json env block for safer AI-assisted sending. See `auth action=about` for details.'
   );
 }
-
-// Combine all tools
-const TOOLS = [
-  ...authTools,
-  ...calendarTools,
-  ...emailTools,
-  ...folderTools,
-  ...rulesTools,
-  ...contactsTools,
-  ...categoriesTools,
-  ...settingsTools,
-  ...advancedTools,
-];
+// #302: say plainly when a session limit of 0 switches a tool off.
+const blocked = blockedTools();
+if (blocked.length > 0) {
+  console.error(
+    `Session limits block ${blocked.join(', ')} (0 or an unreadable value). Unset the setting for no limit. See \`auth action=about\`.`
+  );
+}
 
 // Set dynamic tool count for auth about handler
 setToolCount(TOOLS.length);
 
-// Create server with tools capabilities
-const server = new Server(
-  { name: config.SERVER_NAME, version: config.SERVER_VERSION },
-  {
-    capabilities: {
-      tools: TOOLS.reduce((acc, tool) => {
-        acc[tool.name] = {};
-        return acc;
-      }, {}),
-    },
-  }
-);
-
-// Handle all requests. Dispatch + error-shaping logic lives in
-// request-handler.js so it is unit-testable without starting the transport.
-server.fallbackRequestHandler = createRequestHandler(TOOLS);
+const server = createServer(TOOLS);
 
 // Make the script executable
 process.on('SIGTERM', () => {

package/llms-install.md

@@ -18,6 +18,16 @@ Add to your MCP client configuration:
 }
 ```
 
+## Plugin Install (Claude Code, GitHub Copilot CLI, Cursor)
+
+The plugin in `plugins/outlook-assistant/` runs a pinned server version and adds the `using-outlook-assistant` skill and a safety hook that asks the user before sends, deletes, rules and automatic replies.
+
+- Claude Code: `claude plugin marketplace add littlebearapps/outlook-assistant`, then `claude plugin install outlook-assistant@littlebearapps`. The plugin asks for its settings (client ID, read-only mode, confirmation level and others) when enabled.
+- GitHub Copilot CLI: `copilot plugin marketplace add littlebearapps/outlook-assistant`, then `copilot plugin install outlook-assistant@littlebearapps`. No plugin settings: the user gives the client ID at sign-in, and the hook's confirmation level comes from the `OUTLOOK_CONFIRM_LEVEL` environment variable (`outward`, `all-writes` or `off`).
+- Cursor (v3.14.0 plugin or later): loads the folder as a Cursor plugin (`.cursor-plugin/plugin.json`); in Cursor CLI, pass it with `--plugin-dir`. The v3.13.0 plugin fails sign-in in Cursor with `AADSTS900023`; use the manual config instead.
+
+Client limits (for example, Cursor's prompt doesn't show the hook's reason): `docs/how-to/getting-started/supported-clients.md`.
+
 ## Prerequisites
 
 1. **Node.js 18.18 or newer** must be installed
@@ -71,14 +81,19 @@ Add these to the same `env` block if needed:
 |----------|---------|
 | `OUTLOOK_AUTH_AUDIENCE` | `consumers` for Azure apps registered as personal-accounts-only (fixes `AADSTS9002331`); `organizations` or a tenant GUID for work-only apps. Default `common` |
 | `OUTLOOK_DEFAULT_TIMEZONE` | IANA timezone for calendar times (default `Australia/Melbourne`) |
-| `OUTLOOK_MAX_EMAILS_PER_SESSION` | Default per-session cap for `send-email`, `draft` and `manage-rules` (override one tool with `OUTLOOK_MAX_<TOOL>_PER_SESSION`, e.g. `OUTLOOK_MAX_SEND_EMAIL_PER_SESSION`) |
-| `OUTLOOK_ALLOWED_RECIPIENTS` | Comma-separated allowlist of recipient domains/addresses |
+| `OUTLOOK_MAX_EMAILS_PER_SESSION` | Default per-session cap, counted separately per tool, for `send-email` (including `draft` send), `draft` create/update/reply/reply-all/forward, `manage-rules` and `create-event` (override one tool with `OUTLOOK_MAX_<TOOL>_PER_SESSION`, e.g. `OUTLOOK_MAX_SEND_EMAIL_PER_SESSION`). Unset = no limit; `0` blocks the tool |
+| `OUTLOOK_ALLOWED_RECIPIENTS` | Comma-separated allowlist of recipient domains/addresses for sends, drafts, rule forwards and event attendees |
+| `OUTLOOK_READ_ONLY` | `true` refuses every tool call that would change something (sending, drafts, moves, deletes, rules, settings, file writes), dry runs included; reads and sign-in still work |
 | `OUTLOOK_SHARED_MAILBOX` | Opt-in shared-mailbox support, work/school accounts only: `read` or `true` (read and organise). Also add `Mail.Read.Shared` (and `Mail.ReadWrite.Shared` for `true`) in Azure, restart, then run `auth` with `action=authenticate` and `force=true` |
 | `OUTLOOK_SEARCH_SCAN_LIMIT` | Messages scanned by the local search fallback on personal accounts (default 500, max 5000) |
+| `OUTLOOK_EXPORT_DIR` | Extra folder `export` and attachment downloads may write to (besides the temp directory, `~/Downloads` and `~/Documents`) |
 | `OUTLOOK_REQUEST_TIMEOUT_MS` | Per-attempt Graph inactivity timeout in milliseconds (default 60000); not an overall deadline |
+| `OUTLOOK_DEBUG` | `true` for detailed stderr logs while troubleshooting (addresses and IDs redacted). Off by default: one line per tool call, no arguments |
 
 Run `npx @littlebearapps/outlook-assistant --help` for the full list of environment variables.
 
+`OUTLOOK_CONFIRM_LEVEL` is not a server variable: the plugin's safety hook reads it from the client's environment in GitHub Copilot, VS Code and Cursor. Don't put it in the server's `env` block.
+
 ## Configuration Files by Client
 
 ### Claude Desktop
@@ -86,9 +101,12 @@ File: `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 
 ### Claude Code
 ```bash
-claude mcp add outlook -- npx @littlebearapps/outlook-assistant
+claude mcp add outlook -e OUTLOOK_CLIENT_ID=<user-must-provide> -- npx -y @littlebearapps/outlook-assistant
 ```
 
+### VS Code / GitHub Copilot
+File: `.vscode/mcp.json` in your project root, or the user `mcp.json` (Command Palette → **MCP: Open User Configuration**). VS Code uses a top-level `servers` key instead of `mcpServers`, with `"type": "stdio"` on the entry.
+
 ### Cursor
 File: `.cursor/mcp.json` in your project root
 
@@ -111,5 +129,5 @@ After authentication, test with:
 | Device code "invalid_client" | Enable "Allow public client flows" in Azure → Authentication → Advanced settings |
 | "Shared-mailbox support is turned off" | Set `OUTLOOK_SHARED_MAILBOX`, restart, and re-authenticate with `force=true` (work/school accounts only) |
 | "EADDRINUSE :3333" | Run `npx kill-port 3333` then restart auth server |
-| Empty API responses | Run `auth` tool with `action=status` to check token |
+| "Authentication required." | Sign in with `auth` `action=authenticate`; `action=status` shows whether a token is saved |
 | Search returns no results (personal account) | Use `from`, `subject`, `to` filters instead of `query` |

package/llms.txt

@@ -26,17 +26,23 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 - **Progressive search**: Automatically falls back through 4 search strategies when Microsoft's `$search` API is unavailable (personal accounts) — most Graph API wrappers fail silently. Explicit "no results" messaging instead of unfiltered fallback, and `_meta.searchMetadata` reports which strategy answered plus any filter that could not be honoured (`droppedFilters`), so a partially-applied search can never pass as a complete one. Field-scoped `$search` expressions (`from:`/`to:`/`subject:`), which personal accounts reject outright, are translated to equivalent OData filters and retried. Cross-folder search (`searchAllFolders`) reliably returns a superset of inbox results.
 - **Remote-friendly auth**: Device code flow (default) — no auth server, no port forwarding, no SSH tunnels. State persists across MCP server restarts. Works from Untether, mosh, SSH, and headless environments.
 - **Email forensics**: Built-in header analysis for DKIM, SPF, DMARC authentication, delivery chains, and spam scores — useful for phishing investigation and compliance
-- **Delta sync**: Incremental inbox monitoring — returns only new, modified, and deleted emails since last check, with tokens for continuous polling
+- **Delta sync**: Incremental inbox monitoring — returns only new, modified, and deleted emails since last check, with tokens for continuous polling; every page is labelled initial or incremental (`_meta.syncType`)
 - **Batch operations**: Flag, move, export, or categorise multiple emails in a single tool call; search-driven export for batch archiving without collecting IDs
 - **Pre-send intelligence**: Check recipients for out-of-office, mailbox full, delivery restrictions, and moderation before sending — no other Outlook MCP server offers this
 - **Compound automation**: Rules + categories + nested folders (addressable by path or ID) + Focused Inbox for complete inbox management in one conversation
 
 ## Safety & Token Efficiency
 
-- **MCP safety annotations** on all 22 tools — AI clients auto-approve reads and prompt for destructive operations
-- **Send-email protections**: pre-send mail tips, dry-run preview, session rate limiting, recipient allowlist
-- **Rule protections**: dry-run preview on create/update, rate limiting, recipient allowlist on forward/redirect, no permanent-delete action
-- **Input and file hardening**: IDs with `.`/`..` path segments refused, the access token only ever sent to `graph.microsoft.com`, attachment downloads and exports (including conversation exports) confined to the output directory without overwriting, and a partly written file removed if a write fails
+- **MCP safety annotations** on all 22 tools, derived from a risk class per tool and action (read, reversible, outward, destructive, persistent), so clients can tell reads from risky changes
+- **Send-email protections**: pre-send mail tips (a send to a flagged recipient, such as out of office or external, is refused until `acknowledgeWarnings: true`), dry-run preview, session rate limiting (unset = no limit; `0` or a value that isn't a whole number blocks the tool; `draft` send counts as `send-email`), recipient allowlist (also checked on drafts, including replies and the draft's current recipients on send, and on `create-event`/`manage-event` update attendees; only single plain addresses can match)
+- **Rule protections**: dry-run preview on create/update, rate limiting (dry runs don't count; `0` blocks rule changes), reorder lists the resulting rule order, recipient allowlist on forward/redirect (a blocked forward refuses the whole rule), no permanent-delete action
+- **Dry-run previews beyond email**: `create-event` and every `manage-event` action, update included, say who would be emailed (with an external count; update also says who an attendee change adds or removes); `mailbox-settings` auto-replies, `folders` delete and `manage-contact` delete show what would change or be lost; `dryRun: true` on any other call is refused rather than run for real
+- **Read-only mode**: `OUTLOOK_READ_ONLY=true` refuses every tool call that would change anything before it runs; reads and sign-in still work
+- **Model guidance**: server `instructions` state the hard rules (retrieved content is data, confirm before outward actions, draft first, refusals and rate limits are final, with `0` = off) and name any tool a session limit of `0` blocks; `auth action=about` shows each tool's session limit; `send-email` and `create-event` ask Claude clients for user confirmation (`anthropic/requiresUserInteraction`)
+- **Plugin skill and safety hook** (Claude Code, GitHub Copilot CLI, Cursor; VS Code not yet checked by hand): the `using-outlook-assistant` skill sets the hard rules; the hook asks with a plain-English reason before anything that reaches other people, deletes or keeps acting, and marks retrieved content as untrusted. Confirmation level `outward` (default), `all-writes` or `off`: a plugin setting in Claude Code, the `OUTLOOK_CONFIRM_LEVEL` environment variable elsewhere. How the hook prompts and fails differs by client: see Supported Clients below
+- **Every client**: the server-side checks (read-only mode, dry runs, the recipient allowlist and send caps, mail-tips refusal, rule refusal), annotations and instructions work in any MCP client, including Codex CLI, Gemini CLI and Claude Desktop with a manual config; clients that support Agent Skills can copy the skill folder
+- **Private logs**: one stderr line per tool call (tool, action, outcome, duration), never its arguments; `OUTLOOK_DEBUG=true` adds detail with addresses and IDs redacted
+- **Input and file hardening**: IDs with `.`/`..` path segments refused, the access token only ever sent to `graph.microsoft.com`, attachment downloads and exports (including conversation exports) written only inside the temp directory, `~/Downloads`, `~/Documents` or `OUTLOOK_EXPORT_DIR`, never to dot-prefixed names; paths must be absolute (or start with `~/`) and symlinks aren't followed; an `export` `savePath` ending in `/` is a folder, created if missing; existing files are never replaced unless `export` is called with `overwrite: true` (and never a symlink, hard-linked file or dotfile); files are created `0600` and new folders `0700`; a partly written file is removed if a write fails
 - **Throttling-aware Graph client**: `429` (and `503`/`504` for non-POST requests) retried honouring `Retry-After`, a per-attempt inactivity timeout (`OUTLOOK_REQUEST_TIMEOUT_MS`, default 60000 ms) and at most 4 requests in flight, so bulk operations neither hang nor throttle themselves
 - **Shared mailboxes off by default**: `.Shared` scopes are requested only when `OUTLOOK_SHARED_MAILBOX` is set (`read` keeps shared access read-only)
 - **Token-optimised**: 22 tools instead of 55 saves ~11,000 tokens per turn (~64% reduction), improving AI accuracy and context efficiency
@@ -58,18 +64,18 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 }
 ```
 
-`OUTLOOK_CLIENT_SECRET` is only needed for the browser sign-in flow; the default device-code flow uses the client ID alone. Claude Code users can instead install the plugin: `claude plugin marketplace add littlebearapps/outlook-assistant`, then `claude plugin install outlook-assistant@littlebearapps`. Requires an Azure app registration with Microsoft Graph delegated permissions. See README for full setup.
+`OUTLOOK_CLIENT_SECRET` is only needed for the browser sign-in flow; the default device-code flow uses the client ID alone. Claude Code users can instead install the plugin (server, skill and safety hook): `claude plugin marketplace add littlebearapps/outlook-assistant`, then `claude plugin install outlook-assistant@littlebearapps`. The same plugin folder also loads in GitHub Copilot CLI (VS Code not yet checked by hand) and, from v3.14.0, Cursor. Requires an Azure app registration with Microsoft Graph delegated permissions. See README for full setup.
 
 ## Tool Categories
 
 - **Authentication (1 tool)**: `auth` — status, authenticate (device code by default), device-code-complete, about (version, granted scopes, shared-mailbox status)
 - **Email (8 tools)**: `search-emails`, `read-email`, `send-email`, `draft`, `update-email`, `attachments`, `export`, `get-mail-tips`
-- **Calendar (3 tools)**: `list-events` (`startAfter`, `startBefore`, `subject` filters), `create-event`, `manage-event` (update, decline, cancel, delete)
+- **Calendar (3 tools)**: `list-events` (`startAfter`, `startBefore`, `subject` filters), `create-event` (`dryRun`; retry-safe `transactionId`), `manage-event` (update, decline, cancel, delete; `dryRun` on all)
 - **Contacts (2 tools)**: `manage-contact`, `search-people`
 - **Folders (1 tool)**: `folders` — list, create, move, stats, delete; folders addressable by nested path (`Parent/Child`) or ID
-- **Rules (1 tool)**: `manage-rules` — list, create, update, reorder, delete
+- **Rules (1 tool)**: `manage-rules` — list, create, update, reorder, delete (12 conditions including `hasAttachments`, 9 actions, `except*` exceptions)
 - **Categories (3 tools)**: `manage-category`, `apply-category`, `manage-focused-inbox`
-- **Settings (1 tool)**: `mailbox-settings` — get, set auto-replies, set working hours
+- **Settings (1 tool)**: `mailbox-settings` — get, set auto-replies (`dryRun`; schedules shown as UTC plus a labelled local time), set working hours
 - **Advanced (2 tools)**: `access-shared-mailbox` (messages, `listFolders`, `folderId`, nested folder paths), `find-meeting-rooms`
 
 ## Documentation
@@ -77,12 +83,15 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 - [README](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/README.md): Full documentation including setup, Azure configuration, and usage
 - [Tools Reference](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/quickrefs/tools-reference.md): All 22 tools with parameters and safety annotations
 - [Connect Outlook to Claude](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/how-to/getting-started/connect-outlook-to-claude.md): Step-by-step setup guide for Claude Desktop / Claude Code
+- [Supported Clients](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/how-to/getting-started/supported-clients.md): What each client gets — plugin, skill, safety hook and server-side checks — for Claude Code, GitHub Copilot, Cursor, Codex CLI, Gemini CLI and Claude Desktop
+- [Plugin README](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/plugins/outlook-assistant/README.md): Plugin settings, the skill and the safety hook in each client
+- [Cross-client Matrix](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/cross-client-matrix.md): Which clients and models have been checked against the safety scenarios, and when
 - [Verify Your Connection](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/how-to/getting-started/verify-your-connection.md): Test and troubleshoot the connection after installation
 - [Azure Setup](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/guides/azure-setup.md): Azure app registration and API permissions walkthrough
 - [Troubleshooting](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/troubleshooting.md): Known errors and fixes — auth, search, export, shared mailboxes
 - [FAQ](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/faq/faq.md): Frequently asked questions — install, accounts, permissions, tokens, send safety, updates, uninstall (also at <https://littlebearapps.com/help/outlook-assistant/faq/>)
 - [CLAUDE.md](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CLAUDE.md): Quick reference for development
 - [CONTRIBUTING](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CONTRIBUTING.md): Contribution guidelines
-- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.13.0 — marketplace plugin bundle for Claude Code, GitHub Copilot and Cursor; Azure client ID can be given at sign-in and saved locally; client secret documented as browser-flow only)
-- [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.12.x tool description audit, the patch-release fix queue, v3.8.x carry-over, v3.13.0+ new Graph APIs)
+- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.14.1 — security and safety release: read-only mode, server instructions, more dry-run previews, mail-tips refusal, the plugin skill and a safety hook for Claude Code, GitHub Copilot and Cursor, and fixes for three advisories covering the recipient allowlist, export file writes and dry runs)
+- [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.14.1 live-test fixes; v3.15.0 structured outputs and paging; v4.0.0 MCP 2026-07-28 and server-side confirmation; the patch-release fix queue; v3.8.x carry-over; v3.16.0+ new Graph APIs)
 - [SECURITY](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/SECURITY.md): Security policy (report vulnerabilities privately via GitHub private vulnerability reporting; acknowledged within 7 days), token handling, and MCP safety controls

package/outlook-auth-server.js

@@ -35,6 +35,9 @@ require('dotenv').config();
 
 // Import scopes and token path from central config to stay in sync
 const { AUTH_CONFIG: centralAuth } = require('./config');
+// Console output never includes the secret, the CSRF state or an auth code,
+// and Azure error text is redacted (it can carry the user's address) (#278).
+const { redact } = require('./utils/logger');
 
 // Log to console
 console.log('Starting Outlook Authentication Server');
@@ -64,7 +67,9 @@ const server = http.createServer((req, res) => {
 
     if (query.error) {
       console.error(
-        `Authentication error: ${query.error} - ${query.error_description}`
+        redact(
+          `Authentication error: ${query.error} - ${query.error_description}`
+        )
       );
       res.writeHead(400, SECURITY_HEADERS);
       res.end(`
@@ -147,7 +152,7 @@ const server = http.createServer((req, res) => {
           `);
         })
         .catch((error) => {
-          console.error(`Token exchange error: ${error.message}`);
+          console.error(redact(`Token exchange error: ${error.message}`));
           res.writeHead(500, SECURITY_HEADERS);
           res.end(`
             <html>
@@ -253,7 +258,9 @@ const server = http.createServer((req, res) => {
     // Use the audience from config (defaults to "common"; configurable via
     // OUTLOOK_AUTH_AUDIENCE for personal-only / single-tenant Azure apps).
     const authUrl = `${AUTH_CONFIG.authorizeEndpoint}?${querystring.stringify(authParams)}`;
-    console.log(`Redirecting to: ${authUrl}`);
+    console.log(
+      `Redirecting to Microsoft sign-in: ${AUTH_CONFIG.authorizeEndpoint}`
+    );
 
     // Redirect to Microsoft's login page
     res.writeHead(302, { Location: authUrl });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@littlebearapps/outlook-assistant",
-  "version": "3.13.0",
+  "version": "3.14.1",
   "mcpName": "io.github.littlebearapps/outlook-assistant",
   "description": "Outlook Assistant — MCP server with 22 tools for email, calendar, contacts, and settings via Microsoft Graph API",
   "main": "index.js",
@@ -60,6 +60,8 @@
     "index.js",
     "config.js",
     "request-handler.js",
+    "server.js",
+    "tools.js",
     "outlook-auth-server.js",
     "auth/",
     "calendar/",
@@ -86,6 +88,7 @@
     "@commitlint/config-conventional": "^20.4.3",
     "@eslint/js": "^10.0.1",
     "@modelcontextprotocol/inspector": "^2.8.0",
+    "ajv": "^8.20.0",
     "eslint": "^10.0.2",
     "globals": "^17.4.0",
     "husky": "^9.1.7",