@mindstone/mcp-server-microsoft-teams 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to this connector will be documented in this file.
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-08-10
+
+### Changed
+
+- Re-sync the vendored envelope helper with the hardened canonical: attribute-bearing close tags and spoofed open tags escaped.
+
+### Fixed
+
+- Re-synced the vendored `<untrusted-content>` envelope helper with the canonical hardened reference: attribute-bearing close-tag variants (`</untrusted-content foo>`) and spoofed open tags inside wrapped content are now escaped, closing an envelope-breakout gap an LLM parser could read as an envelope boundary.
+
+## [0.3.0] - 2026-08-07
+
+### Changed
+
+- Microsoft Teams connector: canonical result envelopes, untrusted-content fencing, and hardening sync; expanded messaging/channel actions.
+
+### Security
+
+- Envelope Microsoft Graph error text in `<untrusted-content>` before returning it to the model, so vendor-controlled error bodies cannot inject instructions into the conversation.
+- Scope pre-checks now fail closed: when the stored token cannot be loaded or parsed, permission-gated tools return explicit reconnect guidance instead of silently skipping the check and proceeding to Graph.
+- Tools that change external state (`send_chat_message`, `reply_to_message`, `create_chat`, `send_channel_message`, `reply_to_channel_message`, `set_presence`) now declare `destructiveHint: true` so hosts can gate or confirm them.
+- Structural Graph fields (message/chat/team/channel/user IDs, content types, timestamps, presence states, chat types, channel membership types, member roles) are validated against safe formats; values carrying envelope-breakout or markup characters fail closed instead of reaching model-visible output. This now also covers the pre-existing `list_chats`, `get_chat`, `list_teams`, `list_channels`, and `send_chat_message` response paths, not only the newly added tools.
+- Re-synced the vendored untrusted-content helper with the canonical reference implementation (all-whitespace close-tag variants, plus the unwrap helpers).
+
+### Fixed
+
+- Corrected the 0.1.0 changelog entry below, which claimed "search" and "replies" tools that never actually shipped (message search and threaded replies only arrive in this release, as `search_messages` / `reply_to_message` / `reply_to_channel_message`).
+- `set_presence` rejects out-of-range or fractional `durationMinutes` instead of silently clamping/rounding them into a different duration.
+- `find_user` name searches and `list_channel_messages` now report `hasMore` (from Graph's `@odata.nextLink`) so truncated results are no longer indistinguishable from complete ones.
+
+### Added
+
+- `get_user_presence` (a colleague's availability; requires `Presence.Read.All`) and `set_presence` (set your own status via `setUserPreferredPresence`, with an optional duration; requires `Presence.ReadWrite`).
+- `reply_to_message` — threaded replies to a specific chat message.
+- `search_messages` — keyword search across chat and channel messages via the Graph `/search/query` `chatMessage` entity (works with the already-granted `Chat.Read` permission).
+- `find_user` (resolve colleagues by display name or email; requires `User.ReadBasic.All`) and `create_chat` (start a 1:1 or group chat by member email/user ID, returning the chat ID for use with `send_chat_message`) — together they enable "message a colleague" flows that previously required an existing chat ID.
+- Channel messaging tools: `list_channel_messages`, `send_channel_message`, and `reply_to_channel_message`. Channel reads require the `ChannelMessage.Read.All` Graph permission and sends `ChannelMessage.Send`; when the connected account's token lacks the scope, the tools return actionable reconnect guidance (naming the missing permission and the likely admin-consent step) instead of a raw Graph 403.
+
 ## [0.2.0] - 2026-07-30
 
 ### Changed
@@ -27,4 +65,4 @@ All notable changes to this connector will be documented in this file.
 
 ### Added
 
-- Initial Microsoft 365 Teams MCP server with seven tools for chats, messages, search, channels, sends, and replies.
+- Initial Microsoft 365 Teams MCP server with seven tools covering chats, messages, teams, channels, sends, and presence. (Corrected after release: the original entry also claimed search and reply tools, which did not exist until later.)

package/README.md

@@ -3,15 +3,15 @@
 [![npm version](https://img.shields.io/npm/v/@mindstone/mcp-server-microsoft-teams.svg)](https://www.npmjs.com/package/@mindstone/mcp-server-microsoft-teams)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/License-FSL--1.1--MIT-blue.svg)](./LICENSE)
 
-Microsoft 365 Teams MCP server — list and read Teams chats, send chat messages, list teams and channels, and read presence via the Microsoft Graph API.
+Microsoft 365 Teams MCP server — list and read Teams chats and channel messages, send messages and replies, start new chats, look up colleagues, search messages, and read or set presence via the Microsoft Graph API.
 
 *Cohort-style Microsoft 365 Teams MCP. Reuses the OAuth surface owned by [`@mindstone/mcp-server-microsoft-mail`](../microsoft-mail/) so the host signs in once and gets Teams plus mail plus calendar plus files plus SharePoint from the same credentials.*
 
 ## Status
 
-- **Version:** [0.2.0](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-microsoft-teams)
+- **Version:** [0.3.1](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-microsoft-teams)
 - **Auth:** OAuth (host-orchestrated, shared with [`mcp-server-microsoft-mail`](../microsoft-mail/)) ([`MS_CLIENT_ID`](./server.json))
-- **Tools:** [7](./src/tools.ts) (chats, messages, teams, channels, presence)
+- **Tools:** [17](./src/tools.ts) (chats, messages, teams, channels, users, search, presence)
 - **Surface:** cloud-api
 - **Machine-readable:** [`STATUS.json`](./STATUS.json)
 - **Shared library:** [`@mindstone/mcp-server-microsoft-shared`](https://www.npmjs.com/package/@mindstone/mcp-server-microsoft-shared)
@@ -164,7 +164,7 @@ Sign in via [`@mindstone/mcp-server-microsoft-mail`](../microsoft-mail/)'s `auth
 }
 ```
 
-## Tools (7)
+## Tools (17)
 
 | Tool | Description |
 | ---- | ----------- |
@@ -172,11 +172,21 @@ Sign in via [`@mindstone/mcp-server-microsoft-mail`](../microsoft-mail/)'s `auth
 | `get_chat` | Get details about a specific chat. |
 | `list_chat_messages` | List recent messages from a chat. |
 | `send_chat_message` | Send a message to a chat. |
+| `reply_to_message` | Reply to a specific chat message, creating a threaded reply. |
+| `compose_chat_message` | Open an inline editable compose form before sending; the form posts via `send_chat_message` when the user clicks Send. |
+| `find_user` | Look up people by display name or email. Requires `User.ReadBasic.All`. |
+| `create_chat` | Create a 1:1 or group chat by member email/user ID and return the new chat ID. |
+| `search_messages` | Search chat and channel messages by keyword. |
 | `list_teams` | List teams you are a member of. |
 | `list_channels` | List channels in a team. |
+| `list_channel_messages` | List recent messages in a channel. Requires `ChannelMessage.Read.All`. |
+| `send_channel_message` | Post a new message to a channel. Requires `ChannelMessage.Send`. |
+| `reply_to_channel_message` | Reply to an existing channel message. Requires `ChannelMessage.Send`. |
 | `get_presence` | Get your current presence status. |
+| `get_user_presence` | Get a colleague's presence status. Requires `Presence.Read.All`. |
+| `set_presence` | Set your own presence status, optionally for a limited duration. Requires `Presence.ReadWrite`. |
 
-Some Teams Graph APIs may require tenant admin approval.
+Some Teams Graph APIs may require tenant admin approval. Tools marked with a required permission check the connected account's token up front and return actionable reconnect guidance when the permission is missing (under Microsoft's managed consent policy, `ChannelMessage.Read.All` is admin-consent-gated in most tenants).
 
 ## Security notes
 

package/dist/teams.d.ts

@@ -11,5 +11,15 @@ export declare function sendChatMessage(client: Client, args: ArgBag, signal: Ab
 export declare function listTeams(client: Client, _args: ArgBag, signal: AbortSignal): Promise<unknown>;
 export declare function listChannels(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
 export declare function getPresence(client: Client, _args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function getUserPresence(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare const PRESENCE_AVAILABILITY_VALUES: readonly ["Available", "Busy", "DoNotDisturb", "BeRightBack", "Away", "Offline"];
+export declare function setPresence(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function listChannelMessages(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function sendChannelMessage(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function replyToChannelMessage(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function replyToChatMessage(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function searchMessages(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function findUser(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
+export declare function createChat(client: Client, args: ArgBag, signal: AbortSignal): Promise<unknown>;
 export {};
 //# sourceMappingURL=teams.d.ts.map

package/dist/teams.js

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { wrapUntrusted } from './untrusted-content.js';
 export class TeamsBusinessError extends Error {
     nextStep;
@@ -28,6 +29,23 @@ function clampTop(value, defaultValue, maxValue) {
         return defaultValue;
     return Math.max(1, Math.min(value, maxValue));
 }
+// Structural Graph values (IDs, enum-like tokens, timestamps) are vendor-assigned
+// rather than user-authored free text, so instead of an untrusted-content
+// envelope — which would corrupt an ID the model must pass back verbatim in
+// follow-up calls — they are validated against shapes that cannot carry
+// envelope-breakout or markup characters. An unexpected value fails closed: the
+// Zod error surfaces through the standard (enveloped) error path.
+const graphStructuralTokenSchema = z
+    .string()
+    .max(512)
+    .regex(/^[^\s<>"'`\\]*$/, 'unexpected characters in Microsoft Graph identifier');
+const graphIsoDateTimeSchema = z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/, 'unexpected Microsoft Graph datetime format');
+const graphPresenceStateSchema = z
+    .string()
+    .max(64)
+    .regex(/^[A-Za-z][A-Za-z0-9]*$/, 'unexpected Microsoft Graph presence value');
 const HTML_ENTITIES = {
     '&nbsp;': ' ',
     '&amp;': '&',
@@ -58,15 +76,15 @@ function requireStringArg(args, name, label, nextStep) {
         return value;
     throw new TeamsBusinessError(`Missing required parameter: "${name}" (${label}).`, nextStep);
 }
-function formatMessage(msg) {
+function formatMessage(msg, tool) {
     return {
-        id: msg.id,
+        id: graphStructuralTokenSchema.nullish().parse(msg.id),
         from: msg.from?.user?.displayName
-            ? wrapUntrusted(msg.from.user.displayName, 'microsoft-teams:list_chat_messages:from')
+            ? wrapUntrusted(msg.from.user.displayName, `microsoft-teams:${tool}:from`)
             : 'Unknown',
-        content: wrapUntrusted(stripHtml(msg.body?.content ?? ''), 'microsoft-teams:list_chat_messages:content'),
-        contentType: msg.body?.contentType,
-        createdAt: msg.createdDateTime,
+        content: wrapUntrusted(stripHtml(msg.body?.content ?? ''), `microsoft-teams:${tool}:content`),
+        contentType: graphStructuralTokenSchema.nullish().parse(msg.body?.contentType),
+        createdAt: graphIsoDateTimeSchema.nullish().parse(msg.createdDateTime),
     };
 }
 export async function listChats(client, args, signal) {
@@ -85,13 +103,13 @@ export async function listChats(client, args, signal) {
     return {
         count: chats.length,
         chats: chats.map((chat) => ({
-            id: chat.id,
+            id: graphStructuralTokenSchema.parse(chat.id),
             topic: chat.topic
                 ? wrapUntrusted(chat.topic, 'microsoft-teams:list_chats:topic')
                 : '(No topic)',
-            type: chat.chatType,
-            createdAt: chat.createdDateTime,
-            lastUpdated: chat.lastUpdatedDateTime,
+            type: graphStructuralTokenSchema.nullish().parse(chat.chatType),
+            createdAt: graphIsoDateTimeSchema.nullish().parse(chat.createdDateTime),
+            lastUpdated: graphIsoDateTimeSchema.nullish().parse(chat.lastUpdatedDateTime),
         })),
     };
 }
@@ -103,17 +121,17 @@ export async function getChat(client, args, signal) {
         .expand('members')
         .get());
     return {
-        id: chat.id,
+        id: graphStructuralTokenSchema.parse(chat.id),
         topic: chat.topic
             ? wrapUntrusted(chat.topic, 'microsoft-teams:get_chat:topic')
             : '(No topic)',
-        type: chat.chatType,
-        createdAt: chat.createdDateTime,
-        lastUpdated: chat.lastUpdatedDateTime,
+        type: graphStructuralTokenSchema.nullish().parse(chat.chatType),
+        createdAt: graphIsoDateTimeSchema.nullish().parse(chat.createdDateTime),
+        lastUpdated: graphIsoDateTimeSchema.nullish().parse(chat.lastUpdatedDateTime),
         members: chat.members?.map((member) => ({
             displayName: wrapUntrusted(member.displayName, 'microsoft-teams:get_chat:members.displayName'),
             email: wrapUntrusted(member.email, 'microsoft-teams:get_chat:members.email'),
-            roles: member.roles,
+            roles: z.array(graphStructuralTokenSchema).nullish().parse(member.roles),
         })),
     };
 }
@@ -129,13 +147,13 @@ export async function listChatMessages(client, args, signal) {
     return {
         chatId,
         count: messages.length,
-        messages: messages.map(formatMessage),
+        messages: messages.map((msg) => formatMessage(msg, 'list_chat_messages')),
     };
 }
 export async function sendChatMessage(client, args, signal) {
     const chatId = requireStringArg(args, 'chatId', 'chat ID', 'send_chat_message');
     const content = requireStringArg(args, 'content', 'message body', 'send_chat_message');
-    const response = (await client.api(`/me/chats/${chatId}/messages`).options({ signal }).post({
+    const response = sendMessageResponseSchema.parse(await client.api(`/me/chats/${chatId}/messages`).options({ signal }).post({
         body: {
             contentType: content.includes('<') ? 'html' : 'text',
             content,
@@ -149,10 +167,10 @@ export async function sendChatMessage(client, args, signal) {
 }
 function formatChannel(channel) {
     return {
-        id: channel.id,
+        id: graphStructuralTokenSchema.parse(channel.id),
         name: wrapUntrusted(channel.displayName, 'microsoft-teams:list_channels:name'),
         description: wrapUntrusted(channel.description, 'microsoft-teams:list_channels:description'),
-        membershipType: channel.membershipType,
+        membershipType: graphStructuralTokenSchema.nullish().parse(channel.membershipType),
     };
 }
 export async function listTeams(client, _args, signal) {
@@ -165,7 +183,7 @@ export async function listTeams(client, _args, signal) {
     return {
         count: teams.length,
         teams: teams.map((team) => ({
-            id: team.id,
+            id: graphStructuralTokenSchema.parse(team.id),
             name: wrapUntrusted(team.displayName, 'microsoft-teams:list_teams:name'),
             description: wrapUntrusted(team.description, 'microsoft-teams:list_teams:description'),
         })),
@@ -188,9 +206,344 @@ export async function listChannels(client, args, signal) {
 export async function getPresence(client, _args, signal) {
     const presence = (await client.api('/me/presence').options({ signal }).get());
     return {
+        availability: graphPresenceStateSchema.nullish().parse(presence.availability),
+        activity: graphPresenceStateSchema.nullish().parse(presence.activity),
+        statusMessage: wrapUntrusted(presence.statusMessage?.message?.content ?? undefined, 'microsoft-teams:get_presence:statusMessage'),
+    };
+}
+const presenceSchema = z
+    .object({
+    availability: graphPresenceStateSchema.nullish(),
+    activity: graphPresenceStateSchema.nullish(),
+    statusMessage: z
+        .object({
+        message: z
+            .object({
+            content: z.string().nullish(),
+        })
+            .nullish(),
+    })
+        .nullish(),
+})
+    .passthrough();
+export async function getUserPresence(client, args, signal) {
+    const userId = requireStringArg(args, 'userId', 'user ID or email', 'get_user_presence');
+    const presence = presenceSchema.parse(await client.api(`/users/${encodeURIComponent(userId)}/presence`).options({ signal }).get());
+    return {
+        userId,
         availability: presence.availability,
         activity: presence.activity,
-        statusMessage: wrapUntrusted(presence.statusMessage?.message?.content ?? undefined, 'microsoft-teams:get_presence:statusMessage'),
+        statusMessage: wrapUntrusted(presence.statusMessage?.message?.content ?? undefined, 'microsoft-teams:get_user_presence:statusMessage'),
+    };
+}
+export const PRESENCE_AVAILABILITY_VALUES = [
+    'Available',
+    'Busy',
+    'DoNotDisturb',
+    'BeRightBack',
+    'Away',
+    'Offline',
+];
+export async function setPresence(client, args, signal) {
+    const availability = requireStringArg(args, 'availability', `presence availability (${PRESENCE_AVAILABILITY_VALUES.join(', ')})`, 'set_presence');
+    const duration = numberArg(args, 'durationMinutes');
+    // The tool schema bounds this to an integer in 5-480; keep the business layer
+    // fail-closed too rather than silently coercing a value into a different
+    // meaning before a network write.
+    if (duration != null && (!Number.isInteger(duration) || duration < 5 || duration > 480)) {
+        throw new TeamsBusinessError('Invalid "durationMinutes": must be a whole number of minutes between 5 and 480.', 'set_presence');
+    }
+    const durationMinutes = duration;
+    const body = { availability, activity: availability };
+    if (durationMinutes != null)
+        body.expirationDuration = `PT${durationMinutes}M`;
+    await client.api('/me/presence/setUserPreferredPresence').options({ signal }).post(body);
+    return {
+        success: true,
+        availability,
+        ...(durationMinutes != null ? { durationMinutes } : {}),
+        message: `Presence set to ${availability}`,
+    };
+}
+// ---------------------------------------------------------------------------
+// Channel messages
+// ---------------------------------------------------------------------------
+// Every function validates the Graph strings it returns — free text via the
+// untrusted-content envelope, structural values (IDs, enum-like tokens,
+// datetimes) via the shape schemas above — so vendor-controlled markup never
+// reaches model-visible output raw. The older functions still cast at fetch
+// time for typing, but their output mappers apply the same schemas.
+const graphMessageSchema = z
+    .object({
+    id: graphStructuralTokenSchema.optional(),
+    replyToId: graphStructuralTokenSchema.nullish(),
+    from: z
+        .object({
+        user: z
+            .object({
+            id: graphStructuralTokenSchema.nullish(),
+            displayName: z.string().nullish(),
+        })
+            .nullish(),
+    })
+        .nullish(),
+    body: z
+        .object({
+        content: z.string().nullish(),
+        contentType: graphStructuralTokenSchema.nullish(),
+    })
+        .nullish(),
+    createdDateTime: graphIsoDateTimeSchema.nullish(),
+})
+    .passthrough();
+const graphMessageCollectionSchema = z
+    .object({
+    value: z.array(graphMessageSchema).nullish(),
+    '@odata.nextLink': z.string().nullish(),
+})
+    .passthrough();
+const sendMessageResponseSchema = z
+    .object({
+    id: graphStructuralTokenSchema.optional(),
+})
+    .passthrough();
+function messagePostBody(content) {
+    return {
+        body: {
+            contentType: content.includes('<') ? 'html' : 'text',
+            content,
+        },
+    };
+}
+export async function listChannelMessages(client, args, signal) {
+    const teamId = requireStringArg(args, 'teamId', 'team ID', 'list_channel_messages');
+    const channelId = requireStringArg(args, 'channelId', 'channel ID', 'list_channel_messages');
+    const top = clampTop(numberArg(args, 'top'), 25, 50);
+    const response = graphMessageCollectionSchema.parse(await client
+        .api(`/teams/${teamId}/channels/${channelId}/messages`)
+        .options({ signal })
+        .top(top)
+        .get());
+    const messages = response.value ?? [];
+    return {
+        teamId,
+        channelId,
+        count: messages.length,
+        hasMore: Boolean(response['@odata.nextLink']),
+        messages: messages.map((msg) => ({
+            ...formatMessage(msg, 'list_channel_messages'),
+            replyToId: msg.replyToId ?? undefined,
+        })),
+    };
+}
+export async function sendChannelMessage(client, args, signal) {
+    const teamId = requireStringArg(args, 'teamId', 'team ID', 'send_channel_message');
+    const channelId = requireStringArg(args, 'channelId', 'channel ID', 'send_channel_message');
+    const content = requireStringArg(args, 'content', 'message body', 'send_channel_message');
+    const response = sendMessageResponseSchema.parse(await client
+        .api(`/teams/${teamId}/channels/${channelId}/messages`)
+        .options({ signal })
+        .post(messagePostBody(content)));
+    return {
+        success: true,
+        messageId: response.id,
+        message: 'Message sent successfully',
+    };
+}
+export async function replyToChannelMessage(client, args, signal) {
+    const teamId = requireStringArg(args, 'teamId', 'team ID', 'reply_to_channel_message');
+    const channelId = requireStringArg(args, 'channelId', 'channel ID', 'reply_to_channel_message');
+    const messageId = requireStringArg(args, 'messageId', 'channel message ID', 'reply_to_channel_message');
+    const content = requireStringArg(args, 'content', 'reply body', 'reply_to_channel_message');
+    const response = sendMessageResponseSchema.parse(await client
+        .api(`/teams/${teamId}/channels/${channelId}/messages/${messageId}/replies`)
+        .options({ signal })
+        .post(messagePostBody(content)));
+    return {
+        success: true,
+        messageId: response.id,
+        message: 'Reply sent successfully',
+    };
+}
+export async function replyToChatMessage(client, args, signal) {
+    const chatId = requireStringArg(args, 'chatId', 'chat ID', 'reply_to_message');
+    const messageId = requireStringArg(args, 'messageId', 'message ID', 'reply_to_message');
+    const content = requireStringArg(args, 'content', 'reply body', 'reply_to_message');
+    const response = sendMessageResponseSchema.parse(await client
+        .api(`/me/chats/${chatId}/messages/${messageId}/replies`)
+        .options({ signal })
+        .post(messagePostBody(content)));
+    return {
+        success: true,
+        messageId: response.id,
+        message: 'Reply sent successfully',
+    };
+}
+// ---------------------------------------------------------------------------
+// Message search
+// ---------------------------------------------------------------------------
+const searchHitSchema = z
+    .object({
+    hitId: z.string().nullish(),
+    summary: z.string().nullish(),
+    resource: graphMessageSchema.extend({ chatId: graphStructuralTokenSchema.nullish() }).nullish(),
+})
+    .passthrough();
+const searchResponseSchema = z
+    .object({
+    value: z
+        .array(z
+        .object({
+        hitsContainers: z
+            .array(z
+            .object({
+            hits: z.array(searchHitSchema).nullish(),
+            total: z.number().nullish(),
+        })
+            .passthrough())
+            .nullish(),
+    })
+        .passthrough())
+        .nullish(),
+})
+    .passthrough();
+export async function searchMessages(client, args, signal) {
+    const query = requireStringArg(args, 'query', 'search text', 'search_messages');
+    const top = clampTop(numberArg(args, 'top'), 10, 25);
+    const response = searchResponseSchema.parse(await client
+        .api('/search/query')
+        .options({ signal })
+        .post({
+        requests: [
+            {
+                entityTypes: ['chatMessage'],
+                query: { queryString: query },
+                from: 0,
+                size: top,
+            },
+        ],
+    }));
+    const container = response.value?.[0]?.hitsContainers?.[0];
+    const hits = container?.hits ?? [];
+    return {
+        query,
+        count: hits.length,
+        total: container?.total ?? hits.length,
+        results: hits.map((hit) => ({
+            ...formatMessage(hit.resource ?? {}, 'search_messages'),
+            chatId: hit.resource?.chatId ?? undefined,
+            summary: wrapUntrusted(hit.summary ? stripHtml(hit.summary) : undefined, 'microsoft-teams:search_messages:summary'),
+        })),
+    };
+}
+// ---------------------------------------------------------------------------
+// User lookup and chat creation
+// ---------------------------------------------------------------------------
+const graphUserSchema = z
+    .object({
+    id: graphStructuralTokenSchema,
+    displayName: z.string().nullish(),
+    mail: z.string().nullish(),
+    userPrincipalName: z.string().nullish(),
+})
+    .passthrough();
+const graphUserCollectionSchema = z
+    .object({
+    value: z.array(graphUserSchema).nullish(),
+    '@odata.nextLink': z.string().nullish(),
+})
+    .passthrough();
+function formatUser(user, tool) {
+    return {
+        id: user.id,
+        displayName: wrapUntrusted(user.displayName ?? undefined, `microsoft-teams:${tool}:displayName`),
+        email: wrapUntrusted(user.mail ?? user.userPrincipalName ?? undefined, `microsoft-teams:${tool}:email`),
+    };
+}
+export async function findUser(client, args, signal) {
+    const query = requireStringArg(args, 'query', 'name or email address', 'find_user');
+    if (query.includes('@')) {
+        try {
+            const user = graphUserSchema.parse(await client
+                .api(`/users/${encodeURIComponent(query)}`)
+                .options({ signal })
+                .select('id,displayName,mail,userPrincipalName')
+                .get());
+            return { count: 1, hasMore: false, users: [formatUser(user, 'find_user')] };
+        }
+        catch (err) {
+            // A 404 here means "no such user", which is a result, not a failure.
+            if (err?.statusCode === 404) {
+                return { count: 0, hasMore: false, users: [] };
+            }
+            throw err;
+        }
+    }
+    // $search on /users requires the ConsistencyLevel: eventual header; strip
+    // characters that would break out of the quoted search expression.
+    const safeQuery = query.replace(/["\\]/g, ' ').trim();
+    const response = graphUserCollectionSchema.parse(await client
+        .api('/users')
+        .options({ signal })
+        .header('ConsistencyLevel', 'eventual')
+        .search(`"displayName:${safeQuery}"`)
+        .select('id,displayName,mail,userPrincipalName')
+        .top(10)
+        .get());
+    const users = response.value ?? [];
+    // Name searches are capped at 10 results; surface Graph's continuation link
+    // so a truncated result is never mistaken for a complete one.
+    return {
+        count: users.length,
+        hasMore: Boolean(response['@odata.nextLink']),
+        users: users.map((user) => formatUser(user, 'find_user')),
+    };
+}
+function requireStringArrayArg(args, name, label, nextStep) {
+    const value = args[name];
+    if (Array.isArray(value) && value.length > 0) {
+        const members = value.map((entry) => (typeof entry === 'string' ? entry.trim() : ''));
+        if (members.every((entry) => entry.length > 0))
+            return members;
+    }
+    throw new TeamsBusinessError(`Missing required parameter: "${name}" (${label}). Provide a non-empty array of email addresses or user IDs.`, nextStep);
+}
+const createdChatSchema = z
+    .object({
+    id: graphStructuralTokenSchema,
+    chatType: z.enum(['oneOnOne', 'group', 'meeting']).nullish(),
+})
+    .passthrough();
+export async function createChat(client, args, signal) {
+    const members = [...new Set(requireStringArrayArg(args, 'members', 'chat participants', 'create_chat'))];
+    const topic = stringArg(args, 'topic');
+    const chatType = members.length === 1 ? 'oneOnOne' : 'group';
+    const memberBindings = [
+        {
+            '@odata.type': '#microsoft.graph.aadUserConversationMember',
+            roles: ['owner'],
+            'user@odata.bind': 'https://graph.microsoft.com/v1.0/me',
+        },
+        ...members.map((member) => ({
+            '@odata.type': '#microsoft.graph.aadUserConversationMember',
+            roles: ['owner'],
+            'user@odata.bind': `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(member)}`,
+        })),
+    ];
+    const chat = createdChatSchema.parse(await client
+        .api('/chats')
+        .options({ signal })
+        .post({
+        chatType,
+        // Topic is only valid on group chats.
+        ...(chatType === 'group' && topic ? { topic } : {}),
+        'members@odata.bind': memberBindings,
+    }));
+    return {
+        success: true,
+        chatId: chat.id,
+        chatType: chat.chatType ?? chatType,
+        message: 'Chat created successfully',
     };
 }
 //# sourceMappingURL=teams.js.map

package/dist/tools.js

@@ -1,8 +1,10 @@
 import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { hasScope } from '@mindstone/mcp-server-microsoft-shared';
 import { z } from 'zod';
-import { callGraph } from './client.js';
-import { successJson, withErrorHandling } from './utils.js';
-import { getChat, getPresence, listChannels, listChats, listChatMessages, listTeams, sendChatMessage, } from './teams.js';
+import { callGraph, getTokenProvider } from './client.js';
+import { errorResponse, successJson, withErrorHandling } from './utils.js';
+import { AUTH_TOOL_NAME } from './types.js';
+import { createChat, findUser, getChat, getPresence, getUserPresence, listChannelMessages, listChannels, listChats, listChatMessages, listTeams, PRESENCE_AVAILABILITY_VALUES, replyToChannelMessage, replyToChatMessage, searchMessages, sendChannelMessage, sendChatMessage, setPresence, } from './teams.js';
 /**
  * `ui://` resource URI the compose_chat_message iframe is served under. The
  * shared compose-app template posts `send_chat_message` when the user clicks
@@ -29,6 +31,52 @@ const WRITE_ANNOTATIONS = {
     destructiveHint: false,
     openWorldHint: true,
 };
+// Tools that change external state (send messages, create chats, set presence)
+// must declare destructiveHint so hosts can gate or confirm them — AGENTS.md
+// security invariant #7. compose_chat_message keeps the plain write
+// annotations: it returns an editable draft and performs no Graph send itself.
+const DESTRUCTIVE_WRITE_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    openWorldHint: true,
+};
+/**
+ * Some Teams Graph surfaces (channel messages, user lookup, other users'
+ * presence) need delegated permissions beyond the cohort's base scope set,
+ * and several are admin-consent-gated under Microsoft's managed consent
+ * policy. When the connected account's token lacks the scope, return an
+ * actionable error up front instead of letting Graph 403 — same pattern as
+ * the SharePoint connector's Sites.Read.All gate. When there is no token on
+ * disk yet, fall through to the real call so the standard auth_required
+ * envelope handles it. A token that fails to LOAD (corrupt file, unreadable
+ * disk, provider error) is different from "no token": fail closed with
+ * observable guidance instead of silently skipping the permission gate.
+ */
+async function requireScopesGranted(requiredScopes, feature) {
+    let tokenScope;
+    try {
+        const tokenData = await getTokenProvider().loadToken();
+        if (!tokenData)
+            return null;
+        tokenScope = tokenData.scope;
+    }
+    catch (err) {
+        return errorResponse({
+            error: `${feature} could not verify the Microsoft Graph permissions granted to the connected account: ${err instanceof Error ? err.message : String(err)}`,
+            action_required: 'Reconnect the Microsoft account so the granted permissions can be verified. In many organizations an administrator must approve these permissions first.',
+            next_step: AUTH_TOOL_NAME,
+        });
+    }
+    const missing = requiredScopes.filter((scope) => !hasScope(tokenScope, scope));
+    if (missing.length === 0)
+        return null;
+    return errorResponse({
+        error: `${feature} requires Microsoft Graph permission(s) not granted to the connected account: ${missing.join(', ')}.`,
+        action_required: 'Reconnect the Microsoft account with the additional permissions. In many organizations an administrator must approve these permissions first.',
+        next_step: AUTH_TOOL_NAME,
+        missing_scopes: missing,
+    });
+}
 export function registerTeamsTools(server) {
     server.registerTool('list_chats', {
         description: 'List recent Teams chats (1:1, group, and meeting chats).',
@@ -114,8 +162,56 @@ PARAMETERS: target (the chat ID to send to), text (message content).`,
             chatId: z.string().describe('Chat ID'),
             content: z.string().describe('Message content (HTML supported)'),
         }).strict(),
-        annotations: WRITE_ANNOTATIONS,
+        annotations: DESTRUCTIVE_WRITE_ANNOTATIONS,
     }, withErrorHandling(async (args, extra) => successJson(await callGraph(extra, (c, signal) => sendChatMessage(c, args, signal)))));
+    server.registerTool('reply_to_message', {
+        description: 'Reply to a specific message in a chat, creating a threaded reply.',
+        inputSchema: z
+            .object({
+            chatId: z.string().describe('Chat ID'),
+            messageId: z.string().describe('ID of the chat message to reply to'),
+            content: z.string().describe('Reply content (HTML supported)'),
+        })
+            .strict(),
+        annotations: DESTRUCTIVE_WRITE_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => successJson(await callGraph(extra, (c, signal) => replyToChatMessage(c, args, signal)))));
+    server.registerTool('search_messages', {
+        description: 'Search Teams chat and channel messages by keyword across conversations you can access.',
+        inputSchema: z
+            .object({
+            query: z.string().describe('Search text (keyword or phrase)'),
+            top: z.number().optional().describe('Max results to return (default: 10, max: 25)'),
+        })
+            .strict(),
+        annotations: READ_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => successJson(await callGraph(extra, (c, signal) => searchMessages(c, args, signal)))));
+    server.registerTool('find_user', {
+        description: 'Look up people in the organization by display name or email address. Use this to resolve a colleague to a user ID or email before creating a chat. Requires the User.ReadBasic.All Graph permission.',
+        inputSchema: z
+            .object({
+            query: z.string().describe('Display name or email address of the person to find'),
+        })
+            .strict(),
+        annotations: READ_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => {
+        const gate = await requireScopesGranted(['User.ReadBasic.All'], 'Looking up users');
+        if (gate)
+            return gate;
+        return successJson(await callGraph(extra, (c, signal) => findUser(c, args, signal)));
+    }));
+    server.registerTool('create_chat', {
+        description: 'Create a new 1:1 or group chat with one or more colleagues (by email address or user ID) and return the new chat ID, which can then be used with send_chat_message.',
+        inputSchema: z
+            .object({
+            members: z
+                .array(z.string())
+                .min(1)
+                .describe('Email addresses or user IDs of the other participants (one for a 1:1 chat, several for a group chat)'),
+            topic: z.string().optional().describe('Chat topic (group chats only)'),
+        })
+            .strict(),
+        annotations: DESTRUCTIVE_WRITE_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => successJson(await callGraph(extra, (c, signal) => createChat(c, args, signal)))));
     server.registerTool('list_teams', {
         description: 'List Teams you are a member of.',
         inputSchema: z.object({}).shape,
@@ -128,10 +224,94 @@ PARAMETERS: target (the chat ID to send to), text (message content).`,
         }).shape,
         annotations: READ_ANNOTATIONS,
     }, withErrorHandling(async (args, extra) => successJson(await callGraph(extra, (c, signal) => listChannels(c, args, signal)))));
+    server.registerTool('list_channel_messages', {
+        description: 'List recent messages in a Teams channel. Requires the ChannelMessage.Read.All Graph permission, which may need tenant admin approval.',
+        inputSchema: z.object({
+            teamId: z.string().describe('Team ID'),
+            channelId: z.string().describe('Channel ID'),
+            top: z.number().optional().describe('Max messages to return (default: 25, max: 50)'),
+        }).shape,
+        annotations: READ_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => {
+        const gate = await requireScopesGranted(['ChannelMessage.Read.All'], 'Reading channel messages');
+        if (gate)
+            return gate;
+        return successJson(await callGraph(extra, (c, signal) => listChannelMessages(c, args, signal)));
+    }));
+    server.registerTool('send_channel_message', {
+        description: 'Post a new message to a Teams channel. Requires the ChannelMessage.Send Graph permission, which may need tenant admin approval.',
+        inputSchema: z
+            .object({
+            teamId: z.string().describe('Team ID'),
+            channelId: z.string().describe('Channel ID'),
+            content: z.string().describe('Message content (HTML supported)'),
+        })
+            .strict(),
+        annotations: DESTRUCTIVE_WRITE_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => {
+        const gate = await requireScopesGranted(['ChannelMessage.Send'], 'Posting channel messages');
+        if (gate)
+            return gate;
+        return successJson(await callGraph(extra, (c, signal) => sendChannelMessage(c, args, signal)));
+    }));
+    server.registerTool('reply_to_channel_message', {
+        description: 'Reply to an existing message in a Teams channel. Requires the ChannelMessage.Send Graph permission, which may need tenant admin approval.',
+        inputSchema: z
+            .object({
+            teamId: z.string().describe('Team ID'),
+            channelId: z.string().describe('Channel ID'),
+            messageId: z.string().describe('ID of the channel message to reply to'),
+            content: z.string().describe('Reply content (HTML supported)'),
+        })
+            .strict(),
+        annotations: DESTRUCTIVE_WRITE_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => {
+        const gate = await requireScopesGranted(['ChannelMessage.Send'], 'Replying to channel messages');
+        if (gate)
+            return gate;
+        return successJson(await callGraph(extra, (c, signal) => replyToChannelMessage(c, args, signal)));
+    }));
     server.registerTool('get_presence', {
         description: 'Get your current presence status (available, busy, away, etc.).',
         inputSchema: z.object({}).shape,
         annotations: READ_ANNOTATIONS,
     }, withErrorHandling(async (args, extra) => successJson(await callGraph(extra, (c, signal) => getPresence(c, args, signal)))));
+    server.registerTool('get_user_presence', {
+        description: "Get a colleague's current presence status (available, busy, in a meeting, etc.). Requires the Presence.Read.All Graph permission, which may need tenant admin approval.",
+        inputSchema: z
+            .object({
+            userId: z.string().describe('User ID or email address of the colleague'),
+        })
+            .strict(),
+        annotations: READ_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => {
+        const gate = await requireScopesGranted(['Presence.Read.All'], "Reading a colleague's presence");
+        if (gate)
+            return gate;
+        return successJson(await callGraph(extra, (c, signal) => getUserPresence(c, args, signal)));
+    }));
+    server.registerTool('set_presence', {
+        description: 'Set your own presence status (e.g. Busy, DoNotDisturb, Away), optionally for a limited duration. Requires the Presence.ReadWrite Graph permission.',
+        inputSchema: z
+            .object({
+            availability: z
+                .enum(PRESENCE_AVAILABILITY_VALUES)
+                .describe('Presence availability to set'),
+            durationMinutes: z
+                .number()
+                .int()
+                .min(5)
+                .max(480)
+                .optional()
+                .describe('How long the status applies, in whole minutes (5-480). Omit to keep it until changed.'),
+        })
+            .strict(),
+        annotations: DESTRUCTIVE_WRITE_ANNOTATIONS,
+    }, withErrorHandling(async (args, extra) => {
+        const gate = await requireScopesGranted(['Presence.ReadWrite'], 'Setting presence');
+        if (gate)
+            return gate;
+        return successJson(await callGraph(extra, (c, signal) => setPresence(c, args, signal)));
+    }));
 }
 //# sourceMappingURL=tools.js.map

package/dist/untrusted-content.d.ts

@@ -20,14 +20,37 @@
  */
 /**
  * Wrap a single untrusted string in an `<untrusted-content source="…">`
- * envelope, escaping any embedded close-tag variant so the envelope cannot be
- * broken out of. `undefined` passes through untouched. Idempotent for the same
- * `source`.
+ * envelope, escaping any embedded open/close-tag variant so the envelope can
+ * neither be broken out of nor have a spoofed nested envelope planted inside.
+ *
+ * `undefined` and `null` are passed through untouched so callers can apply the wrapper
+ * uniformly to optional fields without branching.
+ *
+ * Idempotent: when `text` is already a properly-shaped envelope for the SAME
+ * `source` (starts with the matching OPEN tag, ends with CLOSE, and contains no
+ * internal open/close-tag variants), the original string is returned unchanged so
+ * `wrapUntrusted(wrapUntrusted(s, src), src) === wrapUntrusted(s, src)`.
  */
-export declare function wrapUntrusted(text: string | undefined, source: string): string | undefined;
+export declare function wrapUntrusted(text: string | null | undefined, source: string): string | undefined;
 /**
- * Recursively wrap every string value reachable inside `value`. Object keys are
- * structural and NOT wrapped; non-string leaves pass through unchanged.
+ * Strip one `<untrusted-content>` envelope from `text` if present, returning raw
+ * strings unchanged. This is intentionally one-layer and idempotent for already
+ * raw input so callers can accept either displayed wrapped content or manually
+ * authored content.
+ */
+export declare function unwrapUntrusted(text: string): string;
+/**
+ * Recursively wrap every string key and value reachable inside `value` (strings,
+ * arrays, plain-object property keys and values) in an `<untrusted-content>` envelope.
+ *
+ * Use this when a whole response blob is third-party data and you want to
+ * envelope it wholesale rather than enumerate fields. Non-string leaves (numbers,
+ * booleans, null) pass through unchanged.
  */
 export declare function wrapUntrustedJsonStrings<T>(value: T, source: string): T;
+/**
+ * Recursively unwrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export declare function unwrapUntrustedJsonStrings<T>(value: T): T;
 //# sourceMappingURL=untrusted-content.d.ts.map

package/dist/untrusted-content.js

@@ -18,38 +18,81 @@
  * `untrusted-content` in any connector that talks to an external system; this
  * file (and the call sites that import from it) is what satisfies that gate.
  */
-const UNTRUSTED_CLOSE_TAG_VARIANT = /<\/untrusted-content[ \t]*>/gi;
+const UNTRUSTED_CLOSE_TAG_VARIANT = /<\/untrusted-content(?:\s[^>]*)?>/gi;
 const ESCAPED_UNTRUSTED_CLOSE_TAG = '<\\/untrusted-content>';
+const UNTRUSTED_OPEN_TAG_VARIANT = /<untrusted-content(?:\s[^>]*)?>/gi;
+const ESCAPED_UNTRUSTED_OPEN_TAG = '<\\untrusted-content>';
+const UNTRUSTED_ENVELOPE = /^<untrusted-content source="[^"]*">([\s\S]*)<\/untrusted-content>$/;
 function escapeAttr(s) {
     return s.replaceAll('&', '&amp;').replaceAll('"', '&quot;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
 }
-function escapeCloseTagSentinels(s) {
-    return s.replace(UNTRUSTED_CLOSE_TAG_VARIANT, ESCAPED_UNTRUSTED_CLOSE_TAG);
+/**
+ * Rewrite every `</untrusted-content>` and `<untrusted-content …>` variant
+ * (case-insensitive, optional whitespace / attributes before `>`) inside `s`
+ * to a benign textual form, so an attacker who controls the wrapped content
+ * can neither terminate the envelope early nor spoof a nested open tag that a
+ * downstream parser could re-read as a fresh envelope. An LLM parsing the
+ * markup plausibly accepts attribute-bearing close forms such as
+ * `</untrusted-content foo>` — the matcher must cover them too.
+ */
+function escapeTagSentinels(s) {
+    return s
+        .replace(UNTRUSTED_OPEN_TAG_VARIANT, ESCAPED_UNTRUSTED_OPEN_TAG)
+        .replace(UNTRUSTED_CLOSE_TAG_VARIANT, ESCAPED_UNTRUSTED_CLOSE_TAG);
+}
+function unescapeTagSentinels(s) {
+    return s
+        .replaceAll(ESCAPED_UNTRUSTED_OPEN_TAG, '<untrusted-content>')
+        .replaceAll(ESCAPED_UNTRUSTED_CLOSE_TAG, '</untrusted-content>');
 }
 /**
  * Wrap a single untrusted string in an `<untrusted-content source="…">`
- * envelope, escaping any embedded close-tag variant so the envelope cannot be
- * broken out of. `undefined` passes through untouched. Idempotent for the same
- * `source`.
+ * envelope, escaping any embedded open/close-tag variant so the envelope can
+ * neither be broken out of nor have a spoofed nested envelope planted inside.
+ *
+ * `undefined` and `null` are passed through untouched so callers can apply the wrapper
+ * uniformly to optional fields without branching.
+ *
+ * Idempotent: when `text` is already a properly-shaped envelope for the SAME
+ * `source` (starts with the matching OPEN tag, ends with CLOSE, and contains no
+ * internal open/close-tag variants), the original string is returned unchanged so
+ * `wrapUntrusted(wrapUntrusted(s, src), src) === wrapUntrusted(s, src)`.
  */
 export function wrapUntrusted(text, source) {
-    if (text === undefined)
+    if (text === undefined || text === null)
         return undefined;
     const open = `<untrusted-content source="${escapeAttr(source)}">`;
     const close = '</untrusted-content>';
     if (text.startsWith(open) && text.endsWith(close) && text.length >= open.length + close.length) {
         const inner = text.slice(open.length, text.length - close.length);
-        if (!UNTRUSTED_CLOSE_TAG_VARIANT.test(inner)) {
-            UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
+        const hasVariant = UNTRUSTED_CLOSE_TAG_VARIANT.test(inner) || UNTRUSTED_OPEN_TAG_VARIANT.test(inner);
+        UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0; // reset stateful /g regexes
+        UNTRUSTED_OPEN_TAG_VARIANT.lastIndex = 0;
+        if (!hasVariant) {
             return text;
         }
-        UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
     }
-    return `${open}${escapeCloseTagSentinels(text)}${close}`;
+    return `${open}${escapeTagSentinels(text)}${close}`;
 }
 /**
- * Recursively wrap every string value reachable inside `value`. Object keys are
- * structural and NOT wrapped; non-string leaves pass through unchanged.
+ * Strip one `<untrusted-content>` envelope from `text` if present, returning raw
+ * strings unchanged. This is intentionally one-layer and idempotent for already
+ * raw input so callers can accept either displayed wrapped content or manually
+ * authored content.
+ */
+export function unwrapUntrusted(text) {
+    const match = UNTRUSTED_ENVELOPE.exec(text);
+    if (!match)
+        return text;
+    return unescapeTagSentinels(match[1]);
+}
+/**
+ * Recursively wrap every string key and value reachable inside `value` (strings,
+ * arrays, plain-object property keys and values) in an `<untrusted-content>` envelope.
+ *
+ * Use this when a whole response blob is third-party data and you want to
+ * envelope it wholesale rather than enumerate fields. Non-string leaves (numbers,
+ * booleans, null) pass through unchanged.
  */
 export function wrapUntrustedJsonStrings(value, source) {
     if (typeof value === 'string') {
@@ -59,7 +102,29 @@ export function wrapUntrustedJsonStrings(value, source) {
         return value.map((item) => wrapUntrustedJsonStrings(item, source));
     }
     if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, wrapUntrustedJsonStrings(item, source)]));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            wrapUntrusted(key, source) ?? key,
+            wrapUntrustedJsonStrings(item, source),
+        ]));
+    }
+    return value;
+}
+/**
+ * Recursively unwrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export function unwrapUntrustedJsonStrings(value) {
+    if (typeof value === 'string') {
+        return unwrapUntrusted(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => unwrapUntrustedJsonStrings(item));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            unwrapUntrusted(key),
+            unwrapUntrustedJsonStrings(item),
+        ]));
     }
     return value;
 }

package/dist/utils.js

@@ -1,6 +1,13 @@
 import { MicrosoftRefreshDisabledError, detectAuthRequiredReason, formatGraphError, } from '@mindstone/mcp-server-microsoft-shared';
 import { TeamsBusinessError } from './teams.js';
 import { AUTH_TOOL_NAME, REQUEST_TIMEOUT_MS, getMsPackageId } from './types.js';
+import { wrapUntrusted } from './untrusted-content.js';
+// formatGraphError surfaces vendor-controlled response-body text
+// (`error.message` from the Graph JSON body). Envelope it so the model treats
+// it as data, not instructions (AGENTS.md security invariant #6).
+function formatGraphErrorForModel(err) {
+    return wrapUntrusted(formatGraphError(err), 'microsoft-teams:error:graph') ?? 'Unknown error';
+}
 export function abortableSignal(callerSignal) {
     const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
     if (!callerSignal)
@@ -140,7 +147,7 @@ export function buildErrorResponse(err) {
                     text: JSON.stringify({
                         ...buildAuthRequiredResponse(),
                         reason,
-                        error: formatGraphError(err),
+                        error: formatGraphErrorForModel(err),
                         package_id: getMsPackageId(),
                     }),
                 },
@@ -149,7 +156,7 @@ export function buildErrorResponse(err) {
         };
     }
     return errorResponse({
-        error: formatGraphError(err),
+        error: formatGraphErrorForModel(err),
         action_required: 'Retry the call. If it continues to fail, run authenticate_microsoft_account to refresh the connection.',
         next_step: AUTH_TOOL_NAME,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindstone/mcp-server-microsoft-teams",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "mcpName": "io.github.mindstone/mcp-server-microsoft-teams",
   "description": "Microsoft 365 Teams via Graph: list chats, read/send messages, list teams/channels, presence.",
   "license": "FSL-1.1-MIT",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.mindstone/mcp-server-microsoft-teams",
   "title": "Microsoft 365 Teams",
   "description": "Microsoft 365 Teams via Graph: list chats, read/send messages, list teams/channels, presence.",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "repository": {
     "url": "https://github.com/mindstone/mcp-servers",
     "source": "github",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@mindstone/mcp-server-microsoft-teams",
-      "version": "0.2.0",
+      "version": "0.3.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"