@littlebearapps/outlook-assistant 3.5.2 → 3.6.0

package/README.md

@@ -34,6 +34,7 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 
 - 📨 **Search and read emails** — find messages by sender, subject, date, or keywords; read full threads with conversation grouping; batch flag, move, export, or categorise multiple emails at once
 - 🛡️ **Send emails with safety controls** — dry-run preview, pre-send mail tips (out-of-office, mailbox full, delivery restrictions), session rate limiting, and recipient allowlist to prevent mistakes
+- ✏️ **Draft emails for review** — create, update, and send drafts; reply and forward as drafts; preview before saving with dry-run mode
 - 📅 **Manage your calendar** — view upcoming events, schedule meetings with attendees, decline or cancel invitations
 - 📦 **Export emails** — save to Markdown, EML, MBOX, JSON, or HTML for archiving, analysis, or migration; export search results or entire threads in one call
 - 🔍 **Investigate email headers** — check DKIM, SPF, and DMARC authentication; trace delivery chains; analyse spam scores — useful for phishing investigation and compliance
@@ -60,7 +61,7 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 
 | Module | Tools | What You Can Do |
 |--------|------:|-----------------|
-| **Email** | 7 | `search-emails` (list/search/delta/conversations), `read-email` (content + forensic headers), `send-email` (with dry-run + mail tips), `update-email` (read status, flags), `attachments`, `export`, `get-mail-tips` |
+| **Email** | 8 | `search-emails` (list/search/delta/conversations), `read-email` (content + forensic headers), `send-email` (with dry-run + mail tips), `draft` (create/update/send/delete/reply/forward), `update-email` (read status, flags), `attachments`, `export`, `get-mail-tips` |
 | **Calendar** | 3 | `list-events`, `create-event`, `manage-event` (decline/cancel/delete) |
 | **Contacts** | 2 | `manage-contact` (list/search/get/create/update/delete), `search-people` |
 | **Categories** | 3 | `manage-category` (CRUD), `apply-category`, `manage-focused-inbox` |
@@ -70,7 +71,7 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 | **Advanced** | 2 | `access-shared-mailbox`, `find-meeting-rooms` |
 | **Auth** | 1 | `auth` (status/authenticate/about) |
 
-**21 tools total** — consolidated from 55 for optimal AI performance. See the [Tools Reference](docs/quickrefs/tools-reference.md) for complete parameter details.
+**22 tools total** — consolidated from 55 for optimal AI performance. See the [Tools Reference](docs/quickrefs/tools-reference.md) for complete parameter details.
 
 ### Export Formats
 
@@ -126,7 +127,9 @@ Outlook Assistant is designed with safety-first principles for AI-driven email a
 - **Session rate limiting** — configurable via `OUTLOOK_MAX_EMAILS_PER_SESSION` (default: unlimited)
 - **Recipient allowlist** — restrict sending to approved addresses/domains via `OUTLOOK_ALLOWED_RECIPIENTS`
 
-**Token-optimised architecture** — Tools are consolidated using the STRAP (Single Tool, Resource, Action Pattern) approach. 21 tools instead of 55 reduces per-turn overhead by ~11,000 tokens (~64%), keeping more of the AI's context window available for your actual conversation. Fewer tools also means the AI selects the right tool more accurately — research shows tool selection degrades beyond ~40 tools.
+**Draft protections** — The `draft` tool shares `send-email` safety controls: dry-run preview, recipient allowlist, mail-tips validation, and rate limiting. The `send` action shares the `send-email` rate limit counter, preventing circumvention via the draft-then-send pathway.
+
+**Token-optimised architecture** — Tools are consolidated using the STRAP (Single Tool, Resource, Action Pattern) approach. 22 tools instead of 55 reduces per-turn overhead by ~11,000 tokens (~64%), keeping more of the AI's context window available for your actual conversation. Fewer tools also means the AI selects the right tool more accurately — research shows tool selection degrades beyond ~40 tools.
 
 > **Important**: These safeguards are defence-in-depth measures that reduce risk, but they are not a guarantee against unintended actions. AI-driven access to your email is inherently sensitive — always review tool calls before approving, particularly for sends and deletes. No automated guardrail is foolproof, and you remain responsible for actions taken through your mailbox.
 
@@ -374,7 +377,7 @@ This starts a local server on port 3333 to handle the OAuth callback.
 
 ```
 outlook-assistant/
-├── index.js                 # Main entry point (21 tools)
+├── index.js                 # Main entry point (22 tools)
 ├── config.js                # Configuration settings
 ├── outlook-auth-server.js   # OAuth server (port 3333)
 ├── auth/                    # Authentication module (1 tool)
@@ -466,7 +469,7 @@ USE_TEST_MODE=true npm start
 | [Azure Setup Guide](docs/guides/azure-setup.md) | Azure account creation, app registration, permissions, and secrets |
 | [How-To Guides](docs/how-to/index.md) | 28 practical guides for email, calendar, contacts, and settings |
 | [Troubleshooting & FAQ](docs/how-to/getting-started/verify-your-connection.md#common-connection-problems) | Common problems, re-authentication, and frequently asked questions |
-| [Tools Reference](docs/quickrefs/tools-reference.md) | All 21 tools with parameters |
+| [Tools Reference](docs/quickrefs/tools-reference.md) | All 22 tools with parameters |
 | [AI Agent Guide](docs/how-to/ai-agents/using-outlook-assistant-in-agents.md) | Tool selection and workflow patterns for AI agents |
 
 Full documentation: [docs/](docs/README.md)

package/email/draft.js

@@ -0,0 +1,484 @@
+/**
+ * Draft email functionality
+ *
+ * Supports creating, updating, sending, and deleting drafts,
+ * plus creating reply/reply-all/forward drafts from existing messages.
+ */
+const { callGraphAPI } = require('../utils/graph-api');
+const { ensureAuthenticated } = require('../auth');
+const {
+  checkRateLimit,
+  checkRecipientAllowlist,
+  formatDryRunPreview,
+} = require('../utils/safety');
+const { handleGetMailTips } = require('./mail-tips');
+
+/**
+ * Format comma-separated email string into Graph API recipient objects
+ * @param {string} recipientString - Comma-separated email addresses
+ * @returns {Array<{emailAddress: {address: string}}>}
+ */
+function formatRecipients(recipientString) {
+  if (!recipientString) return [];
+  return recipientString.split(',').map((email) => ({
+    emailAddress: { address: email.trim() },
+  }));
+}
+
+/**
+ * Auto-detect HTML vs plain text body
+ * @param {string} body - Email body content
+ * @returns {'html'|'text'}
+ */
+function detectContentType(body) {
+  if (!body) return 'text';
+  return /<(html|div|p|h[1-6]|br|table|ul|ol|li|span|a\s|img|strong|em|b|i)\b/i.test(
+    body
+  )
+    ? 'html'
+    : 'text';
+}
+
+/**
+ * Build a message object from draft parameters
+ * @param {object} args - Draft parameters
+ * @returns {object} - Graph API message object
+ */
+function buildMessageObject(args) {
+  const { to, cc, bcc, subject, body, importance } = args;
+  const message = {};
+
+  if (subject !== undefined) message.subject = subject;
+  if (body !== undefined) {
+    message.body = {
+      contentType: detectContentType(body),
+      content: body,
+    };
+  }
+  if (importance) message.importance = importance;
+
+  const toRecipients = formatRecipients(to);
+  const ccRecipients = formatRecipients(cc);
+  const bccRecipients = formatRecipients(bcc);
+
+  if (toRecipients.length > 0) message.toRecipients = toRecipients;
+  if (ccRecipients.length > 0) message.ccRecipients = ccRecipients;
+  if (bccRecipients.length > 0) message.bccRecipients = bccRecipients;
+
+  return message;
+}
+
+/**
+ * Format a draft response with key details
+ * @param {object} draft - Graph API message response
+ * @param {string} actionLabel - Human-readable action (e.g. "created", "updated")
+ * @returns {object} - MCP response
+ */
+function formatDraftResponse(draft, actionLabel) {
+  const to = (draft.toRecipients || [])
+    .map((r) => r.emailAddress?.address)
+    .join(', ');
+
+  let text = `Draft ${actionLabel}.\n\n`;
+  text += `**ID**: \`${draft.id}\`\n`;
+  if (draft.subject) text += `**Subject**: ${draft.subject}\n`;
+  if (to) text += `**To**: ${to}\n`;
+  if (draft.lastModifiedDateTime)
+    text += `**Modified**: ${draft.lastModifiedDateTime}\n`;
+  if (draft.hasAttachments) text += `**Attachments**: yes\n`;
+
+  return {
+    content: [{ type: 'text', text }],
+    _meta: { draftId: draft.id },
+  };
+}
+
+/**
+ * Draft handler — routes to action-specific logic
+ * @param {object} args - Tool arguments
+ * @returns {object} - MCP response
+ */
+async function handleDraft(args) {
+  const { action } = args;
+
+  if (!action) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: "Action is required. Use 'create', 'update', 'send', 'delete', 'reply', 'reply-all', or 'forward'.",
+        },
+      ],
+    };
+  }
+
+  switch (action) {
+    case 'create':
+      return handleCreateDraft(args);
+    case 'update':
+      return handleUpdateDraft(args);
+    case 'send':
+      return handleSendDraft(args);
+    case 'delete':
+      return handleDeleteDraft(args);
+    case 'reply':
+      return handleReplyDraft(args, 'createReply');
+    case 'reply-all':
+      return handleReplyDraft(args, 'createReplyAll');
+    case 'forward':
+      return handleForwardDraft(args);
+    default:
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `Invalid action '${action}'. Use 'create', 'update', 'send', 'delete', 'reply', 'reply-all', or 'forward'.`,
+          },
+        ],
+      };
+  }
+}
+
+/**
+ * Create a new draft
+ */
+async function handleCreateDraft(args) {
+  const { dryRun = false, checkRecipients: doCheckRecipients = false } = args;
+  const message = buildMessageObject(args);
+
+  // Check recipient allowlist if recipients specified
+  const allRecipients = [
+    ...(message.toRecipients || []),
+    ...(message.ccRecipients || []),
+    ...(message.bccRecipients || []),
+  ];
+  if (allRecipients.length > 0) {
+    const allowlistError = checkRecipientAllowlist(allRecipients);
+    if (allowlistError) return allowlistError;
+  }
+
+  // Pre-save recipient validation via mail-tips
+  if (doCheckRecipients && allRecipients.length > 0) {
+    const allAddresses = allRecipients.map((r) => r.emailAddress.address);
+    const tipsResult = await handleGetMailTips({ recipients: allAddresses });
+    const tipsText = tipsResult.content[0]?.text || '';
+
+    if (dryRun) {
+      const preview = formatDryRunPreview({ message, saveToSentItems: true });
+      return {
+        content: [
+          {
+            type: 'text',
+            text:
+              tipsText +
+              '\n\n---\n\n' +
+              preview.content[0].text.replace(
+                'Email NOT sent',
+                'Draft NOT saved'
+              ),
+          },
+        ],
+        _meta: { mailTips: tipsResult._meta },
+      };
+    }
+  }
+
+  // Dry-run mode: preview without saving
+  if (dryRun) {
+    const preview = formatDryRunPreview({ message, saveToSentItems: true });
+    return {
+      content: [
+        {
+          type: 'text',
+          text: preview.content[0].text.replace(
+            'Email NOT sent',
+            'Draft NOT saved'
+          ),
+        },
+      ],
+    };
+  }
+
+  // Rate limit check
+  const rateLimitError = checkRateLimit('draft');
+  if (rateLimitError) return rateLimitError;
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    const draft = await callGraphAPI(
+      accessToken,
+      'POST',
+      'me/messages',
+      message
+    );
+    return formatDraftResponse(draft, 'created');
+  } catch (error) {
+    return handleError('creating draft', error);
+  }
+}
+
+/**
+ * Update an existing draft
+ */
+async function handleUpdateDraft(args) {
+  const { id } = args;
+
+  if (!id) {
+    return {
+      content: [
+        { type: 'text', text: 'Draft ID (id) is required for update.' },
+      ],
+    };
+  }
+
+  const message = buildMessageObject(args);
+
+  // Check recipient allowlist if recipients changed
+  const allRecipients = [
+    ...(message.toRecipients || []),
+    ...(message.ccRecipients || []),
+    ...(message.bccRecipients || []),
+  ];
+  if (allRecipients.length > 0) {
+    const allowlistError = checkRecipientAllowlist(allRecipients);
+    if (allowlistError) return allowlistError;
+  }
+
+  // Rate limit check
+  const rateLimitError = checkRateLimit('draft');
+  if (rateLimitError) return rateLimitError;
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    const draft = await callGraphAPI(
+      accessToken,
+      'PATCH',
+      `me/messages/${id}`,
+      message
+    );
+    return formatDraftResponse(draft, 'updated');
+  } catch (error) {
+    return handleError('updating draft', error);
+  }
+}
+
+/**
+ * Send an existing draft
+ */
+async function handleSendDraft(args) {
+  const { id } = args;
+
+  if (!id) {
+    return {
+      content: [{ type: 'text', text: 'Draft ID (id) is required for send.' }],
+    };
+  }
+
+  // Rate limit via send-email counter (shares limit with direct sends)
+  const rateLimitError = checkRateLimit('send-email');
+  if (rateLimitError) return rateLimitError;
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    await callGraphAPI(accessToken, 'POST', `me/messages/${id}/send`);
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Draft sent successfully.\n\n**Note**: The draft ID \`${id}\` is no longer valid — the message has been moved to Sent Items with a new ID.`,
+        },
+      ],
+    };
+  } catch (error) {
+    return handleError('sending draft', error);
+  }
+}
+
+/**
+ * Delete a draft
+ */
+async function handleDeleteDraft(args) {
+  const { id } = args;
+
+  if (!id) {
+    return {
+      content: [
+        { type: 'text', text: 'Draft ID (id) is required for delete.' },
+      ],
+    };
+  }
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    await callGraphAPI(accessToken, 'DELETE', `me/messages/${id}`);
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Draft \`${id}\` deleted.`,
+        },
+      ],
+    };
+  } catch (error) {
+    return handleError('deleting draft', error);
+  }
+}
+
+/**
+ * Create a reply or reply-all draft from an existing message
+ */
+async function handleReplyDraft(args, endpoint) {
+  const { id, body, comment } = args;
+
+  if (!id) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Message ID (id) is required for ${endpoint === 'createReplyAll' ? 'reply-all' : 'reply'}.`,
+        },
+      ],
+    };
+  }
+
+  if (comment && body) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: 'Cannot use both comment and body. Use comment for a short prepended note, or body for full HTML/text content.',
+        },
+      ],
+    };
+  }
+
+  const requestBody = {};
+  if (comment) {
+    requestBody.comment = comment;
+  } else if (body) {
+    requestBody.message = {
+      body: {
+        contentType: detectContentType(body),
+        content: body,
+      },
+    };
+  }
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    const draft = await callGraphAPI(
+      accessToken,
+      'POST',
+      `me/messages/${id}/${endpoint}`,
+      Object.keys(requestBody).length > 0 ? requestBody : null
+    );
+    const label =
+      endpoint === 'createReplyAll'
+        ? 'reply-all draft created'
+        : 'reply draft created';
+    return formatDraftResponse(draft, label);
+  } catch (error) {
+    return handleError(
+      `creating ${endpoint === 'createReplyAll' ? 'reply-all' : 'reply'} draft`,
+      error
+    );
+  }
+}
+
+/**
+ * Create a forward draft from an existing message
+ */
+async function handleForwardDraft(args) {
+  const { id, to, body, comment } = args;
+
+  if (!id) {
+    return {
+      content: [
+        { type: 'text', text: 'Message ID (id) is required for forward.' },
+      ],
+    };
+  }
+
+  if (!to) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: 'Forward recipient (to) is required for forward.',
+        },
+      ],
+    };
+  }
+
+  if (comment && body) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: 'Cannot use both comment and body. Use comment for a short prepended note, or body for full HTML/text content.',
+        },
+      ],
+    };
+  }
+
+  const toRecipients = formatRecipients(to);
+
+  // Check recipient allowlist
+  const allowlistError = checkRecipientAllowlist(toRecipients);
+  if (allowlistError) return allowlistError;
+
+  const requestBody = {
+    toRecipients,
+  };
+
+  if (comment) {
+    requestBody.comment = comment;
+  } else if (body) {
+    requestBody.message = {
+      body: {
+        contentType: detectContentType(body),
+        content: body,
+      },
+    };
+  }
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    const draft = await callGraphAPI(
+      accessToken,
+      'POST',
+      `me/messages/${id}/createForward`,
+      requestBody
+    );
+    return formatDraftResponse(draft, 'forward draft created');
+  } catch (error) {
+    return handleError('creating forward draft', error);
+  }
+}
+
+/**
+ * Standard error handler
+ */
+function handleError(actionLabel, error) {
+  if (error.message === 'Authentication required') {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: "Authentication required. Please use the 'auth' tool with action=authenticate first.",
+        },
+      ],
+    };
+  }
+
+  return {
+    content: [
+      {
+        type: 'text',
+        text: `Error ${actionLabel}: ${error.message}`,
+      },
+    ],
+  };
+}
+
+module.exports = handleDraft;

package/email/index.js

@@ -23,6 +23,7 @@ const {
   handleExportConversation,
 } = require('./conversations');
 const { handleGetMailTips } = require('./mail-tips');
+const handleDraft = require('./draft');
 
 // Import flag handlers from advanced module
 const { handleSetMessageFlag, handleClearMessageFlag } = require('../advanced');
@@ -289,6 +290,84 @@ const emailTools = [
     },
     handler: handleSendEmail,
   },
+  {
+    name: 'draft',
+    description:
+      'Manage email drafts. action=create saves a new draft. action=update edits an existing draft. action=send sends a draft. action=delete removes a draft. action=reply/reply-all/forward creates a reply or forward draft from an existing message.',
+    annotations: {
+      title: 'Draft Operations',
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
+    inputSchema: {
+      type: 'object',
+      properties: {
+        action: {
+          type: 'string',
+          enum: [
+            'create',
+            'update',
+            'send',
+            'delete',
+            'reply',
+            'reply-all',
+            'forward',
+          ],
+          description: 'Action to perform (required)',
+        },
+        id: {
+          type: 'string',
+          description:
+            'Draft or message ID. Required for update/send/delete/reply/reply-all/forward.',
+        },
+        to: {
+          type: 'string',
+          description:
+            'Comma-separated recipient email addresses (optional for create/update, required for forward)',
+        },
+        cc: {
+          type: 'string',
+          description: 'Comma-separated CC email addresses',
+        },
+        bcc: {
+          type: 'string',
+          description: 'Comma-separated BCC email addresses',
+        },
+        subject: {
+          type: 'string',
+          description: 'Email subject',
+        },
+        body: {
+          type: 'string',
+          description: 'Email body (plain text or HTML)',
+        },
+        importance: {
+          type: 'string',
+          enum: ['normal', 'high', 'low'],
+          description: 'Email importance (default: normal)',
+        },
+        comment: {
+          type: 'string',
+          description:
+            'Comment text for reply/forward (prepended to original message). Cannot combine with body.',
+        },
+        dryRun: {
+          type: 'boolean',
+          description:
+            'Preview draft without saving (action=create only, default: false)',
+        },
+        checkRecipients: {
+          type: 'boolean',
+          description:
+            'Check recipients for out-of-office, delivery restrictions before saving (action=create, default: false)',
+        },
+      },
+      required: ['action'],
+    },
+    handler: handleDraft,
+  },
   {
     name: 'update-email',
     description:
@@ -559,6 +638,7 @@ const emailTools = [
 
 module.exports = {
   emailTools,
+  handleDraft,
   handleListEmails,
   handleSearchEmails,
   handleSearchByMessageId,

package/llms.txt

@@ -11,12 +11,12 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 - **License**: MIT
 - **Node.js**: >= 18.0.0
 - **Authentication**: OAuth 2.0 with Microsoft Graph API (requires Azure app registration)
-- **Tools**: 21 tools across 9 modules (reduced from 55 for optimal AI performance)
+- **Tools**: 22 tools across 9 modules (reduced from 55 for optimal AI performance)
 
 ## Why Outlook Assistant?
 
 - Read, search, send, and export emails directly from Claude instead of switching apps
-- 7 email tools covering search, conversations, attachments, bulk export, and pre-send mail tips
+- 8 email tools covering search, conversations, attachments, bulk export, pre-send mail tips, and draft management
 - Manage calendar events, contacts, rules, categories, and mailbox settings in one place
 - Export to multiple formats: MIME/EML, MBOX, Markdown, JSON, HTML
 
@@ -31,9 +31,9 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 
 ## Safety & Token Efficiency
 
-- **MCP safety annotations** on all 21 tools — AI clients auto-approve reads and prompt for destructive operations
+- **MCP safety annotations** on all 22 tools — AI clients auto-approve reads and prompt for destructive operations
 - **Send-email protections**: pre-send mail tips, dry-run preview, session rate limiting, recipient allowlist
-- **Token-optimised**: 21 tools instead of 55 saves ~11,000 tokens per turn (~64% reduction), improving AI accuracy and context efficiency
+- **Token-optimised**: 22 tools instead of 55 saves ~11,000 tokens per turn (~64% reduction), improving AI accuracy and context efficiency
 - These safeguards reduce risk but are not foolproof — always review actions before approving
 
 ## Quick Start
@@ -58,7 +58,7 @@ Requires an Azure app registration with Microsoft Graph delegated permissions. S
 ## Tool Categories
 
 - **Authentication (1 tool)**: `auth` — OAuth flow, status, about
-- **Email (7 tools)**: `search-emails`, `read-email`, `send-email`, `update-email`, `attachments`, `export`, `get-mail-tips`
+- **Email (8 tools)**: `search-emails`, `read-email`, `send-email`, `draft`, `update-email`, `attachments`, `export`, `get-mail-tips`
 - **Calendar (3 tools)**: `list-events`, `create-event`, `manage-event`
 - **Contacts (2 tools)**: `manage-contact`, `search-people`
 - **Folders (1 tool)**: `folders` — list, create, move, stats
@@ -70,7 +70,7 @@ Requires an Azure app registration with Microsoft Graph delegated permissions. S
 ## Documentation
 
 - [README](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/README.md): Full documentation including setup, Azure configuration, and usage
-- [Tools Reference](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/quickrefs/tools-reference.md): All 21 tools with parameters and safety annotations
+- [Tools Reference](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/quickrefs/tools-reference.md): All 22 tools with parameters and safety annotations
 - [CLAUDE.md](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CLAUDE.md): Quick reference for development
 - [CONTRIBUTING](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CONTRIBUTING.md): Contribution guidelines
 - [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@littlebearapps/outlook-assistant",
-  "version": "3.5.2",
+  "version": "3.6.0",
   "mcpName": "io.github.littlebearapps/outlook-assistant",
-  "description": "Outlook Assistant — MCP server with 21 tools for email, calendar, contacts, and settings via Microsoft Graph API",
+  "description": "Outlook Assistant — MCP server with 22 tools for email, calendar, contacts, and settings via Microsoft Graph API",
   "main": "index.js",
   "bin": {
     "outlook-assistant": "./index.js"

package/utils/field-presets.js

@@ -107,6 +107,26 @@ const FIELD_PRESETS = {
     'changeKey',
   ],
 
+  /**
+   * Draft fields for viewing/editing drafts
+   * Use case: Draft creation, update, listing
+   */
+  draft: [
+    'id',
+    'subject',
+    'from',
+    'toRecipients',
+    'ccRecipients',
+    'bccRecipients',
+    'body',
+    'bodyPreview',
+    'lastModifiedDateTime',
+    'isDraft',
+    'importance',
+    'hasAttachments',
+    'conversationId',
+  ],
+
   /**
    * Search result fields (optimized for relevance display)
    * Use case: Search results with context

package/utils/graph-api.js

@@ -7,6 +7,7 @@ const mockData = require('./mock-data');
 
 /**
  * Makes a request to the Microsoft Graph API
+ * In test mode (USE_TEST_MODE=true), routes to mock data instead of the real API.
  * @param {string} accessToken - The access token for authentication
  * @param {string} method - HTTP method (GET, POST, etc.)
  * @param {string} path - API endpoint path
@@ -14,6 +15,8 @@ const mockData = require('./mock-data');
  * @param {object} queryParams - Query parameters
  * @param {object} extraHeaders - Additional headers (e.g. Prefer for immutable IDs)
  * @returns {Promise<object>} - The API response
+ * @throws {Error} 'UNAUTHORIZED' if the server returns HTTP 401 (token expired or invalid)
+ * @throws {Error} If the HTTP status is outside 2xx, or if JSON parsing or network fails
  */
 async function callGraphAPI(
   accessToken,
@@ -153,6 +156,8 @@ async function callGraphAPI(
  * @param {object} queryParams - Initial query parameters
  * @param {number} maxCount - Maximum number of items to retrieve (0 = all)
  * @returns {Promise<object>} - Combined API response with all items
+ * @throws {Error} If method is not 'GET'
+ * @throws {Error} If any page request fails for any other reason
  */
 async function callGraphAPIPaginated(
   accessToken,
@@ -268,9 +273,12 @@ async function callGraphAPIBatch(accessToken, requests) {
 
 /**
  * Calls Graph API to get raw MIME content (for email export)
+ * In test mode (USE_TEST_MODE=true), returns mock MIME content instead of calling the real API.
  * @param {string} accessToken - The access token for authentication
  * @param {string} emailId - The email ID to export
  * @returns {Promise<string>} - Raw MIME content as string
+ * @throws {Error} 'UNAUTHORIZED' if the server returns HTTP 401 (token expired or invalid)
+ * @throws {Error} If the HTTP status is outside 2xx or a network error occurs
  */
 async function callGraphAPIRaw(accessToken, emailId) {
   // Test mode: return mock MIME content