@mindstone/mcp-server-microsoft-teams 0.1.2 → 0.3.0

package/dist/server.js

@@ -1,12 +1,16 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SERVER_NAME, SERVER_VERSION } from './types.js';
-import { registerTeamsTools } from './tools.js';
+import { COMPOSE_MESSAGE_RESOURCE_URI, registerTeamsTools } from './tools.js';
+import { COMPOSE_MESSAGE_HTML } from './resources/compose-message-template.js';
 export function createServer() {
     const server = new McpServer({
         name: SERVER_NAME,
         version: SERVER_VERSION,
     });
     registerTeamsTools(server);
+    server.registerResource('compose-message', COMPOSE_MESSAGE_RESOURCE_URI, { mimeType: 'text/html' }, async (uri) => ({
+        contents: [{ uri: uri.href, mimeType: 'text/html', text: COMPOSE_MESSAGE_HTML }],
+    }));
     return server;
 }
 //# sourceMappingURL=server.js.map

package/dist/teams.d.ts

@@ -11,5 +11,15 @@ export declare function sendChatMessage(client: Client, args: ArgBag, signal: Ab
 export declare function listTeams(client: Client, _args: ArgBag, signal: AbortSignal): Promise<unknown>;
 export declare function listChannels(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
 export declare function getPresence(client: Client, _args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function getUserPresence(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare const PRESENCE_AVAILABILITY_VALUES: readonly ["Available", "Busy", "DoNotDisturb", "BeRightBack", "Away", "Offline"];
+export declare function setPresence(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function listChannelMessages(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function sendChannelMessage(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function replyToChannelMessage(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function replyToChatMessage(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function searchMessages(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function findUser(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function createChat(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
 export {};
 //# sourceMappingURL=teams.d.ts.map

package/dist/teams.js

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { wrapUntrusted } from './untrusted-content.js';
 export class TeamsBusinessError extends Error {
     nextStep;
@@ -28,6 +29,23 @@ function clampTop(value, defaultValue, maxValue) {
         return defaultValue;
     return Math.max(1, Math.min(value, maxValue));
 }
+// Structural Graph values (IDs, enum-like tokens, timestamps) are vendor-assigned
+// rather than user-authored free text, so instead of an untrusted-content
+// envelope — which would corrupt an ID the model must pass back verbatim in
+// follow-up calls — they are validated against shapes that cannot carry
+// envelope-breakout or markup characters. An unexpected value fails closed: the
+// Zod error surfaces through the standard (enveloped) error path.
+const graphStructuralTokenSchema = z
+    .string()
+    .max(512)
+    .regex(/^[^\s<>"'`\\]*$/, 'unexpected characters in Microsoft Graph identifier');
+const graphIsoDateTimeSchema = z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/, 'unexpected Microsoft Graph datetime format');
+const graphPresenceStateSchema = z
+    .string()
+    .max(64)
+    .regex(/^[A-Za-z][A-Za-z0-9]*$/, 'unexpected Microsoft Graph presence value');
 const HTML_ENTITIES = {
     '&nbsp;': ' ',
     '&amp;': '&',
@@ -58,15 +76,15 @@ function requireStringArg(args, name, label, nextStep) {
         return value;
     throw new TeamsBusinessError(`Missing required parameter: "${name}" (${label}).`, nextStep);
 }
-function formatMessage(msg) {
+function formatMessage(msg, tool) {
     return {
-        id: msg.id,
+        id: graphStructuralTokenSchema.nullish().parse(msg.id),
         from: msg.from?.user?.displayName
-            ? wrapUntrusted(msg.from.user.displayName, 'microsoft-teams:list_chat_messages:from')
+            ? wrapUntrusted(msg.from.user.displayName, `microsoft-teams:${tool}:from`)
             : 'Unknown',
-        content: wrapUntrusted(stripHtml(msg.body?.content ?? ''), 'microsoft-teams:list_chat_messages:content'),
-        contentType: msg.body?.contentType,
-        createdAt: msg.createdDateTime,
+        content: wrapUntrusted(stripHtml(msg.body?.content ?? ''), `microsoft-teams:${tool}:content`),
+        contentType: graphStructuralTokenSchema.nullish().parse(msg.body?.contentType),
+        createdAt: graphIsoDateTimeSchema.nullish().parse(msg.createdDateTime),
     };
 }
 export async function listChats(client, args, signal) {
@@ -85,13 +103,13 @@ export async function listChats(client, args, signal) {
     return {
         count: chats.length,
         chats: chats.map((chat) => ({
-            id: chat.id,
+            id: graphStructuralTokenSchema.parse(chat.id),
             topic: chat.topic
                 ? wrapUntrusted(chat.topic, 'microsoft-teams:list_chats:topic')
                 : '(No topic)',
-            type: chat.chatType,
-            createdAt: chat.createdDateTime,
-            lastUpdated: chat.lastUpdatedDateTime,
+            type: graphStructuralTokenSchema.nullish().parse(chat.chatType),
+            createdAt: graphIsoDateTimeSchema.nullish().parse(chat.createdDateTime),
+            lastUpdated: graphIsoDateTimeSchema.nullish().parse(chat.lastUpdatedDateTime),
         })),
     };
 }
@@ -103,17 +121,17 @@ export async function getChat(client, args, signal) {
         .expand('members')
         .get());
     return {
-        id: chat.id,
+        id: graphStructuralTokenSchema.parse(chat.id),
         topic: chat.topic
             ? wrapUntrusted(chat.topic, 'microsoft-teams:get_chat:topic')
             : '(No topic)',
-        type: chat.chatType,
-        createdAt: chat.createdDateTime,
-        lastUpdated: chat.lastUpdatedDateTime,
+        type: graphStructuralTokenSchema.nullish().parse(chat.chatType),
+        createdAt: graphIsoDateTimeSchema.nullish().parse(chat.createdDateTime),
+        lastUpdated: graphIsoDateTimeSchema.nullish().parse(chat.lastUpdatedDateTime),
         members: chat.members?.map((member) => ({
             displayName: wrapUntrusted(member.displayName, 'microsoft-teams:get_chat:members.displayName'),
             email: wrapUntrusted(member.email, 'microsoft-teams:get_chat:members.email'),
-            roles: member.roles,
+            roles: z.array(graphStructuralTokenSchema).nullish().parse(member.roles),
         })),
     };
 }
@@ -129,13 +147,13 @@ export async function listChatMessages(client, args, signal) {
     return {
         chatId,
         count: messages.length,
-        messages: messages.map(formatMessage),
+        messages: messages.map((msg) => formatMessage(msg, 'list_chat_messages')),
     };
 }
 export async function sendChatMessage(client, args, signal) {
     const chatId = requireStringArg(args, 'chatId', 'chat ID', 'send_chat_message');
     const content = requireStringArg(args, 'content', 'message body', 'send_chat_message');
-    const response = (await client.api(`/me/chats/${chatId}/messages`).options({ signal }).post({
+    const response = sendMessageResponseSchema.parse(await client.api(`/me/chats/${chatId}/messages`).options({ signal }).post({
         body: {
             contentType: content.includes('<') ? 'html' : 'text',
             content,
@@ -149,10 +167,10 @@ export async function sendChatMessage(client, args, signal) {
 }
 function formatChannel(channel) {
     return {
-        id: channel.id,
+        id: graphStructuralTokenSchema.parse(channel.id),
         name: wrapUntrusted(channel.displayName, 'microsoft-teams:list_channels:name'),
         description: wrapUntrusted(channel.description, 'microsoft-teams:list_channels:description'),
-        membershipType: channel.membershipType,
+        membershipType: graphStructuralTokenSchema.nullish().parse(channel.membershipType),
     };
 }
 export async function listTeams(client, _args, signal) {
@@ -165,7 +183,7 @@ export async function listTeams(client, _args, signal) {
     return {
         count: teams.length,
         teams: teams.map((team) => ({
-            id: team.id,
+            id: graphStructuralTokenSchema.parse(team.id),
             name: wrapUntrusted(team.displayName, 'microsoft-teams:list_teams:name'),
             description: wrapUntrusted(team.description, 'microsoft-teams:list_teams:description'),
         })),
@@ -188,9 +206,344 @@ export async function listChannels(client, args, signal) {
 export async function getPresence(client, _args, signal) {
     const presence = (await client.api('/me/presence').options({ signal }).get());
     return {
+        availability: graphPresenceStateSchema.nullish().parse(presence.availability),
+        activity: graphPresenceStateSchema.nullish().parse(presence.activity),
+        statusMessage: wrapUntrusted(presence.statusMessage?.message?.content ?? undefined, 'microsoft-teams:get_presence:statusMessage'),
+    };
+}
+const presenceSchema = z
+    .object({
+    availability: graphPresenceStateSchema.nullish(),
+    activity: graphPresenceStateSchema.nullish(),
+    statusMessage: z
+        .object({
+        message: z
+            .object({
+            content: z.string().nullish(),
+        })
+            .nullish(),
+    })
+        .nullish(),
+})
+    .passthrough();
+export async function getUserPresence(client, args, signal) {
+    const userId = requireStringArg(args, 'userId', 'user ID or email', 'get_user_presence');
+    const presence = presenceSchema.parse(await client.api(`/users/${encodeURIComponent(userId)}/presence`).options({ signal }).get());
+    return {
+        userId,
         availability: presence.availability,
         activity: presence.activity,
-        statusMessage: wrapUntrusted(presence.statusMessage?.message?.content ?? undefined, 'microsoft-teams:get_presence:statusMessage'),
+        statusMessage: wrapUntrusted(presence.statusMessage?.message?.content ?? undefined, 'microsoft-teams:get_user_presence:statusMessage'),
+    };
+}
+export const PRESENCE_AVAILABILITY_VALUES = [
+    'Available',
+    'Busy',
+    'DoNotDisturb',
+    'BeRightBack',
+    'Away',
+    'Offline',
+];
+export async function setPresence(client, args, signal) {
+    const availability = requireStringArg(args, 'availability', `presence availability (${PRESENCE_AVAILABILITY_VALUES.join(', ')})`, 'set_presence');
+    const duration = numberArg(args, 'durationMinutes');
+    // The tool schema bounds this to an integer in 5-480; keep the business layer
+    // fail-closed too rather than silently coercing a value into a different
+    // meaning before a network write.
+    if (duration != null && (!Number.isInteger(duration) || duration < 5 || duration > 480)) {
+        throw new TeamsBusinessError('Invalid "durationMinutes": must be a whole number of minutes between 5 and 480.', 'set_presence');
+    }
+    const durationMinutes = duration;
+    const body = { availability, activity: availability };
+    if (durationMinutes != null)
+        body.expirationDuration = `PT${durationMinutes}M`;
+    await client.api('/me/presence/setUserPreferredPresence').options({ signal }).post(body);
+    return {
+        success: true,
+        availability,
+        ...(durationMinutes != null ? { durationMinutes } : {}),
+        message: `Presence set to ${availability}`,
+    };
+}
+// ---------------------------------------------------------------------------
+// Channel messages
+// ---------------------------------------------------------------------------
+// Every function validates the Graph strings it returns — free text via the
+// untrusted-content envelope, structural values (IDs, enum-like tokens,
+// datetimes) via the shape schemas above — so vendor-controlled markup never
+// reaches model-visible output raw. The older functions still cast at fetch
+// time for typing, but their output mappers apply the same schemas.
+const graphMessageSchema = z
+    .object({
+    id: graphStructuralTokenSchema.optional(),
+    replyToId: graphStructuralTokenSchema.nullish(),
+    from: z
+        .object({
+        user: z
+            .object({
+            id: graphStructuralTokenSchema.nullish(),
+            displayName: z.string().nullish(),
+        })
+            .nullish(),
+    })
+        .nullish(),
+    body: z
+        .object({
+        content: z.string().nullish(),
+        contentType: graphStructuralTokenSchema.nullish(),
+    })
+        .nullish(),
+    createdDateTime: graphIsoDateTimeSchema.nullish(),
+})
+    .passthrough();
+const graphMessageCollectionSchema = z
+    .object({
+    value: z.array(graphMessageSchema).nullish(),
+    '@odata.nextLink': z.string().nullish(),
+})
+    .passthrough();
+const sendMessageResponseSchema = z
+    .object({
+    id: graphStructuralTokenSchema.optional(),
+})
+    .passthrough();
+function messagePostBody(content) {
+    return {
+        body: {
+            contentType: content.includes('<') ? 'html' : 'text',
+            content,
+        },
+    };
+}
+export async function listChannelMessages(client, args, signal) {
+    const teamId = requireStringArg(args, 'teamId', 'team ID', 'list_channel_messages');
+    const channelId = requireStringArg(args, 'channelId', 'channel ID', 'list_channel_messages');
+    const top = clampTop(numberArg(args, 'top'), 25, 50);
+    const response = graphMessageCollectionSchema.parse(await client
+        .api(`/teams/${teamId}/channels/${channelId}/messages`)
+        .options({ signal })
+        .top(top)
+        .get());
+    const messages = response.value ?? [];
+    return {
+        teamId,
+        channelId,
+        count: messages.length,
+        hasMore: Boolean(response['@odata.nextLink']),
+        messages: messages.map((msg) => ({
+            ...formatMessage(msg, 'list_channel_messages'),
+            replyToId: msg.replyToId ?? undefined,
+        })),
+    };
+}
+export async function sendChannelMessage(client, args, signal) {
+    const teamId = requireStringArg(args, 'teamId', 'team ID', 'send_channel_message');
+    const channelId = requireStringArg(args, 'channelId', 'channel ID', 'send_channel_message');
+    const content = requireStringArg(args, 'content', 'message body', 'send_channel_message');
+    const response = sendMessageResponseSchema.parse(await client
+        .api(`/teams/${teamId}/channels/${channelId}/messages`)
+        .options({ signal })
+        .post(messagePostBody(content)));
+    return {
+        success: true,
+        messageId: response.id,
+        message: 'Message sent successfully',
+    };
+}
+export async function replyToChannelMessage(client, args, signal) {
+    const teamId = requireStringArg(args, 'teamId', 'team ID', 'reply_to_channel_message');
+    const channelId = requireStringArg(args, 'channelId', 'channel ID', 'reply_to_channel_message');
+    const messageId = requireStringArg(args, 'messageId', 'channel message ID', 'reply_to_channel_message');
+    const content = requireStringArg(args, 'content', 'reply body', 'reply_to_channel_message');
+    const response = sendMessageResponseSchema.parse(await client
+        .api(`/teams/${teamId}/channels/${channelId}/messages/${messageId}/replies`)
+        .options({ signal })
+        .post(messagePostBody(content)));
+    return {
+        success: true,
+        messageId: response.id,
+        message: 'Reply sent successfully',
+    };
+}
+export async function replyToChatMessage(client, args, signal) {
+    const chatId = requireStringArg(args, 'chatId', 'chat ID', 'reply_to_message');
+    const messageId = requireStringArg(args, 'messageId', 'message ID', 'reply_to_message');
+    const content = requireStringArg(args, 'content', 'reply body', 'reply_to_message');
+    const response = sendMessageResponseSchema.parse(await client
+        .api(`/me/chats/${chatId}/messages/${messageId}/replies`)
+        .options({ signal })
+        .post(messagePostBody(content)));
+    return {
+        success: true,
+        messageId: response.id,
+        message: 'Reply sent successfully',
+    };
+}
+// ---------------------------------------------------------------------------
+// Message search
+// ---------------------------------------------------------------------------
+const searchHitSchema = z
+    .object({
+    hitId: z.string().nullish(),
+    summary: z.string().nullish(),
+    resource: graphMessageSchema.extend({ chatId: graphStructuralTokenSchema.nullish() }).nullish(),
+})
+    .passthrough();
+const searchResponseSchema = z
+    .object({
+    value: z
+        .array(z
+        .object({
+        hitsContainers: z
+            .array(z
+            .object({
+            hits: z.array(searchHitSchema).nullish(),
+            total: z.number().nullish(),
+        })
+            .passthrough())
+            .nullish(),
+    })
+        .passthrough())
+        .nullish(),
+})
+    .passthrough();
+export async function searchMessages(client, args, signal) {
+    const query = requireStringArg(args, 'query', 'search text', 'search_messages');
+    const top = clampTop(numberArg(args, 'top'), 10, 25);
+    const response = searchResponseSchema.parse(await client
+        .api('/search/query')
+        .options({ signal })
+        .post({
+        requests: [
+            {
+                entityTypes: ['chatMessage'],
+                query: { queryString: query },
+                from: 0,
+                size: top,
+            },
+        ],
+    }));
+    const container = response.value?.[0]?.hitsContainers?.[0];
+    const hits = container?.hits ?? [];
+    return {
+        query,
+        count: hits.length,
+        total: container?.total ?? hits.length,
+        results: hits.map((hit) => ({
+            ...formatMessage(hit.resource ?? {}, 'search_messages'),
+            chatId: hit.resource?.chatId ?? undefined,
+            summary: wrapUntrusted(hit.summary ? stripHtml(hit.summary) : undefined, 'microsoft-teams:search_messages:summary'),
+        })),
+    };
+}
+// ---------------------------------------------------------------------------
+// User lookup and chat creation
+// ---------------------------------------------------------------------------
+const graphUserSchema = z
+    .object({
+    id: graphStructuralTokenSchema,
+    displayName: z.string().nullish(),
+    mail: z.string().nullish(),
+    userPrincipalName: z.string().nullish(),
+})
+    .passthrough();
+const graphUserCollectionSchema = z
+    .object({
+    value: z.array(graphUserSchema).nullish(),
+    '@odata.nextLink': z.string().nullish(),
+})
+    .passthrough();
+function formatUser(user, tool) {
+    return {
+        id: user.id,
+        displayName: wrapUntrusted(user.displayName ?? undefined, `microsoft-teams:${tool}:displayName`),
+        email: wrapUntrusted(user.mail ?? user.userPrincipalName ?? undefined, `microsoft-teams:${tool}:email`),
+    };
+}
+export async function findUser(client, args, signal) {
+    const query = requireStringArg(args, 'query', 'name or email address', 'find_user');
+    if (query.includes('@')) {
+        try {
+            const user = graphUserSchema.parse(await client
+                .api(`/users/${encodeURIComponent(query)}`)
+                .options({ signal })
+                .select('id,displayName,mail,userPrincipalName')
+                .get());
+            return { count: 1, hasMore: false, users: [formatUser(user, 'find_user')] };
+        }
+        catch (err) {
+            // A 404 here means "no such user", which is a result, not a failure.
+            if (err?.statusCode === 404) {
+                return { count: 0, hasMore: false, users: [] };
+            }
+            throw err;
+        }
+    }
+    // $search on /users requires the ConsistencyLevel: eventual header; strip
+    // characters that would break out of the quoted search expression.
+    const safeQuery = query.replace(/["\\]/g, ' ').trim();
+    const response = graphUserCollectionSchema.parse(await client
+        .api('/users')
+        .options({ signal })
+        .header('ConsistencyLevel', 'eventual')
+        .search(`"displayName:${safeQuery}"`)
+        .select('id,displayName,mail,userPrincipalName')
+        .top(10)
+        .get());
+    const users = response.value ?? [];
+    // Name searches are capped at 10 results; surface Graph's continuation link
+    // so a truncated result is never mistaken for a complete one.
+    return {
+        count: users.length,
+        hasMore: Boolean(response['@odata.nextLink']),
+        users: users.map((user) => formatUser(user, 'find_user')),
+    };
+}
+function requireStringArrayArg(args, name, label, nextStep) {
+    const value = args[name];
+    if (Array.isArray(value) && value.length > 0) {
+        const members = value.map((entry) => (typeof entry === 'string' ? entry.trim() : ''));
+        if (members.every((entry) => entry.length > 0))
+            return members;
+    }
+    throw new TeamsBusinessError(`Missing required parameter: "${name}" (${label}). Provide a non-empty array of email addresses or user IDs.`, nextStep);
+}
+const createdChatSchema = z
+    .object({
+    id: graphStructuralTokenSchema,
+    chatType: z.enum(['oneOnOne', 'group', 'meeting']).nullish(),
+})
+    .passthrough();
+export async function createChat(client, args, signal) {
+    const members = [...new Set(requireStringArrayArg(args, 'members', 'chat participants', 'create_chat'))];
+    const topic = stringArg(args, 'topic');
+    const chatType = members.length === 1 ? 'oneOnOne' : 'group';
+    const memberBindings = [
+        {
+            '@odata.type': '#microsoft.graph.aadUserConversationMember',
+            roles: ['owner'],
+            'user@odata.bind': 'https://graph.microsoft.com/v1.0/me',
+        },
+        ...members.map((member) => ({
+            '@odata.type': '#microsoft.graph.aadUserConversationMember',
+            roles: ['owner'],
+            'user@odata.bind': `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(member)}`,
+        })),
+    ];
+    const chat = createdChatSchema.parse(await client
+        .api('/chats')
+        .options({ signal })
+        .post({
+        chatType,
+        // Topic is only valid on group chats.
+        ...(chatType === 'group' && topic ? { topic } : {}),
+        'members@odata.bind': memberBindings,
+    }));
+    return {
+        success: true,
+        chatId: chat.id,
+        chatType: chat.chatType ?? chatType,
+        message: 'Chat created successfully',
     };
 }
 //# sourceMappingURL=teams.js.map

package/dist/tools.d.ts

@@ -1,3 +1,10 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * `ui://` resource URI the compose_chat_message iframe is served under. The
+ * shared compose-app template posts `send_chat_message` when the user clicks
+ * Send; the HTML twin lives in src/resources/compose-message-template.ts
+ * (generated from the shared compose-app package, drift-gated).
+ */
+export declare const COMPOSE_MESSAGE_RESOURCE_URI = "ui://microsoft-teams/compose-message";
 export declare function registerTeamsTools(server: McpServer): void;
 //# sourceMappingURL=tools.d.ts.map