@softeria/ms-365-mcp-server 0.107.1 → 0.108.0

package/dist/endpoints.json

@@ -620,7 +620,7 @@
     "isExcelOp": true,
     "scopes": ["Files.ReadWrite"],
     "skipEncoding": ["address"],
-    "llmTip": "Apply font/fill/borders/alignment/wrapText/columnWidth/rowHeight to a specific range. Required path param 'address' (e.g. 'A1:E5' or 'Sheet1!A1:E5'). Body: { font: {bold,color,size,italic,name,underline}, fill: {color}, borders: [{sideIndex,style,color,weight}], horizontalAlignment, verticalAlignment, wrapText, columnWidth, rowHeight }."
+    "llmTip": "Apply rangeFormat properties to a specific range. Required path param 'address' (e.g. 'A1:E5' or 'Sheet1!A1:E5'). Body: { horizontalAlignment, verticalAlignment, wrapText, columnWidth, rowHeight }. Note: font, fill, and borders are sub-resources on rangeFormat — set them via /format/font, /format/fill, and /format/borders/{sideIndex} respectively, not on this endpoint."
   },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/workbook/worksheets/{workbookWorksheet-id}/range()/sort",
@@ -704,7 +704,7 @@
     "method": "get",
     "toolName": "get-excel-used-range",
     "isExcelOp": true,
-    "scopes": ["Files.Read"],
+    "scopes": ["Files.ReadWrite"],
     "llmTip": "Get the smallest range that encompasses any cells with values or formatting on the worksheet. Returns address, values, formulas, numberFormat, rowCount, columnCount. Use this to discover the populated bounds of a sheet before reading or appending — avoids guessing how far data extends. Optional $select to trim the response."
   },
   {

package/dist/server.js

@@ -170,7 +170,11 @@ class MicrosoftGraphServer {
         const protocol = req.secure ? "https" : "http";
         const requestOrigin = `${protocol}://${req.get("host")}`;
         const browserBase = publicBase ?? requestOrigin;
-        const scopes = buildScopesFromEndpoints(this.options.orgMode, this.options.enabledTools);
+        const scopes = buildScopesFromEndpoints(
+          this.options.orgMode,
+          this.options.enabledTools,
+          this.options.readOnly
+        );
         const metadata = {
           issuer: browserBase,
           authorization_endpoint: `${browserBase}/authorize`,
@@ -191,7 +195,11 @@ class MicrosoftGraphServer {
         const protocol = req.secure ? "https" : "http";
         const requestOrigin = `${protocol}://${req.get("host")}`;
         const browserBase = publicBase ?? requestOrigin;
-        const scopes = this.options.obo ? [`api://${this.secrets.clientId}/access_as_user`] : buildScopesFromEndpoints(this.options.orgMode, this.options.enabledTools);
+        const scopes = this.options.obo ? [`api://${this.secrets.clientId}/access_as_user`] : buildScopesFromEndpoints(
+          this.options.orgMode,
+          this.options.enabledTools,
+          this.options.readOnly
+        );
         res.json({
           resource: `${requestOrigin}/mcp`,
           authorization_servers: [browserBase],
@@ -296,19 +304,14 @@ class MicrosoftGraphServer {
           }
         }
         microsoftAuthUrl.searchParams.set("client_id", clientId);
-        if (!microsoftAuthUrl.searchParams.get("scope")) {
-          microsoftAuthUrl.searchParams.set(
-            "scope",
-            "User.Read Files.Read Mail.Read offline_access"
-          );
-        } else {
-          const scopeValue = microsoftAuthUrl.searchParams.get("scope");
-          const scopeList = scopeValue.split(/\s+/).filter(Boolean);
-          if (!scopeList.includes("offline_access")) {
-            scopeList.push("offline_access");
-            microsoftAuthUrl.searchParams.set("scope", scopeList.join(" "));
-          }
-        }
+        const clientScope = microsoftAuthUrl.searchParams.get("scope");
+        const baseScopes = clientScope ? clientScope.split(/\s+/).filter(Boolean) : buildScopesFromEndpoints(
+          this.options.orgMode,
+          this.options.enabledTools,
+          this.options.readOnly
+        );
+        const scopeSet = /* @__PURE__ */ new Set([...baseScopes, "User.Read", "offline_access"]);
+        microsoftAuthUrl.searchParams.set("scope", Array.from(scopeSet).join(" "));
         res.redirect(microsoftAuthUrl.toString());
       });
       app.post("/token", async (req, res) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.107.1",
+  "version": "0.108.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -620,7 +620,7 @@
     "isExcelOp": true,
     "scopes": ["Files.ReadWrite"],
     "skipEncoding": ["address"],
-    "llmTip": "Apply font/fill/borders/alignment/wrapText/columnWidth/rowHeight to a specific range. Required path param 'address' (e.g. 'A1:E5' or 'Sheet1!A1:E5'). Body: { font: {bold,color,size,italic,name,underline}, fill: {color}, borders: [{sideIndex,style,color,weight}], horizontalAlignment, verticalAlignment, wrapText, columnWidth, rowHeight }."
+    "llmTip": "Apply rangeFormat properties to a specific range. Required path param 'address' (e.g. 'A1:E5' or 'Sheet1!A1:E5'). Body: { horizontalAlignment, verticalAlignment, wrapText, columnWidth, rowHeight }. Note: font, fill, and borders are sub-resources on rangeFormat — set them via /format/font, /format/fill, and /format/borders/{sideIndex} respectively, not on this endpoint."
   },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/workbook/worksheets/{workbookWorksheet-id}/range()/sort",
@@ -704,7 +704,7 @@
     "method": "get",
     "toolName": "get-excel-used-range",
     "isExcelOp": true,
-    "scopes": ["Files.Read"],
+    "scopes": ["Files.ReadWrite"],
     "llmTip": "Get the smallest range that encompasses any cells with values or formatting on the worksheet. Returns address, values, formulas, numberFormat, rowCount, columnCount. Use this to discover the populated bounds of a sheet before reading or appending — avoids guessing how far data extends. Optional $select to trim the response."
   },
   {