@softeria/ms-365-mcp-server 0.11.0 → 0.11.2

package/README.md

@@ -60,6 +60,29 @@ get-sharepoint-site-drive-by-id, list-sharepoint-site-items, get-sharepoint-site
 get-sharepoint-site-list, list-sharepoint-site-list-items, get-sharepoint-site-list-item,
 get-sharepoint-sites-delta</sub>
 
+### Work Scopes Issues
+
+If you're having issues accessing work/school features (Teams, SharePoint, etc.), you should pass the
+`--force-work-scopes` flag!
+
+```json
+{
+  "mcpServers": {
+    "ms365": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@softeria/ms-365-mcp-server",
+        "--force-work-scopes"
+      ]
+    }
+  }
+}
+```
+
+While the server should attempt to force a re-login when work scopes are needed, passing the flag explicitly is safer
+and ensures proper scope permissions from the start.
+
 **User Profile**  
 <sub>get-current-user</sub>
 
@@ -146,22 +169,23 @@ MCP clients will automatically handle the OAuth flow when they see the advertise
 
 ##### Setting up Azure AD for OAuth Testing
 
-To use OAuth mode with custom Azure credentials (recommended for production), you'll need to set up an Azure AD app registration:
+To use OAuth mode with custom Azure credentials (recommended for production), you'll need to set up an Azure AD app
+registration:
 
 1. **Create Azure AD App Registration**:
-   - Go to [Azure Portal](https://portal.azure.com)
-   - Navigate to Azure Active Directory → App registrations → New registration
-   - Set name: "MS365 MCP Server"
+    - Go to [Azure Portal](https://portal.azure.com)
+    - Navigate to Azure Active Directory → App registrations → New registration
+    - Set name: "MS365 MCP Server"
 
 2. **Configure Redirect URIs**:
    Add these redirect URIs for testing with MCP Inspector:
-   - `http://localhost:6274/oauth/callback`
-   - `http://localhost:6274/oauth/callback/debug`
-   - `http://localhost:3000/callback` (optional, for server callback)
+    - `http://localhost:6274/oauth/callback`
+    - `http://localhost:6274/oauth/callback/debug`
+    - `http://localhost:3000/callback` (optional, for server callback)
 
 3. **Get Credentials**:
-   - Copy the **Application (client) ID** from Overview page
-   - Go to Certificates & secrets → New client secret → Copy the secret value
+    - Copy the **Application (client) ID** from Overview page
+    - Go to Certificates & secrets → New client secret → Copy the secret value
 
 4. **Configure Environment Variables**:
    Create a `.env` file in your project root:
@@ -175,13 +199,15 @@ With these configured, the server will use your custom Azure app instead of the
 
 #### 3. Bring Your Own Token (BYOT)
 
-If you are running ms-365-mcp-server as part of a larger system that manages Microsoft OAuth tokens externally, you can provide an access token directly to this MCP server:
+If you are running ms-365-mcp-server as part of a larger system that manages Microsoft OAuth tokens externally, you can
+provide an access token directly to this MCP server:
 
 ```bash
 MS365_MCP_OAUTH_TOKEN=your_oauth_token npx @softeria/ms-365-mcp-server
 ```
 
 This method:
+
 - Bypasses the interactive authentication flows
 - Uses your pre-existing OAuth token for Microsoft Graph API requests
 - Does not handle token refresh (token lifecycle management is your responsibility)

package/dist/auth-tools.js

@@ -77,4 +77,108 @@ export function registerAuthTools(server, authManager) {
             ],
         };
     });
+    server.tool('list-accounts', {}, async () => {
+        try {
+            const accounts = await authManager.listAccounts();
+            const selectedAccountId = authManager.getSelectedAccountId();
+            const result = accounts.map(account => ({
+                id: account.homeAccountId,
+                username: account.username,
+                name: account.name,
+                selected: account.homeAccountId === selectedAccountId
+            }));
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({ accounts: result }),
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({ error: `Failed to list accounts: ${error.message}` }),
+                    },
+                ],
+            };
+        }
+    });
+    server.tool('select-account', {
+        accountId: z.string().describe('The account ID to select'),
+    }, async ({ accountId }) => {
+        try {
+            const success = await authManager.selectAccount(accountId);
+            if (success) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({ message: `Selected account: ${accountId}` }),
+                        },
+                    ],
+                };
+            }
+            else {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({ error: `Account not found: ${accountId}` }),
+                        },
+                    ],
+                };
+            }
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({ error: `Failed to select account: ${error.message}` }),
+                    },
+                ],
+            };
+        }
+    });
+    server.tool('remove-account', {
+        accountId: z.string().describe('The account ID to remove'),
+    }, async ({ accountId }) => {
+        try {
+            const success = await authManager.removeAccount(accountId);
+            if (success) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({ message: `Removed account: ${accountId}` }),
+                        },
+                    ],
+                };
+            }
+            else {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({ error: `Account not found: ${accountId}` }),
+                        },
+                    ],
+                };
+            }
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({ error: `Failed to remove account: ${error.message}` }),
+                    },
+                ],
+            };
+        }
+    });
 }

package/dist/auth.js

@@ -9,8 +9,10 @@ const endpoints = await import('./endpoints.json', {
 });
 const SERVICE_NAME = 'ms-365-mcp-server';
 const TOKEN_CACHE_ACCOUNT = 'msal-token-cache';
+const SELECTED_ACCOUNT_KEY = 'selected-account';
 const FALLBACK_DIR = path.dirname(fileURLToPath(import.meta.url));
 const FALLBACK_PATH = path.join(FALLBACK_DIR, '..', '.token-cache.json');
+const SELECTED_ACCOUNT_PATH = path.join(FALLBACK_DIR, '..', '.selected-account.json');
 const DEFAULT_CONFIG = {
     auth: {
         clientId: process.env.MS365_MCP_CLIENT_ID || '084a3e9f-a9f4-43f7-89f9-d229cf97853e',
@@ -53,6 +55,7 @@ class AuthManager {
         this.msalApp = new PublicClientApplication(this.config);
         this.accessToken = null;
         this.tokenExpiry = null;
+        this.selectedAccountId = null;
         const oauthTokenFromEnv = process.env.MS365_MCP_OAUTH_TOKEN;
         this.oauthToken = oauthTokenFromEnv ?? null;
         this.isOAuthMode = oauthTokenFromEnv != null;
@@ -75,11 +78,38 @@ class AuthManager {
             if (cacheData) {
                 this.msalApp.getTokenCache().deserialize(cacheData);
             }
+            // Load selected account
+            await this.loadSelectedAccount();
         }
         catch (error) {
             logger.error(`Error loading token cache: ${error.message}`);
         }
     }
+    async loadSelectedAccount() {
+        try {
+            let selectedAccountData;
+            try {
+                const cachedData = await keytar.getPassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY);
+                if (cachedData) {
+                    selectedAccountData = cachedData;
+                }
+            }
+            catch (keytarError) {
+                logger.warn(`Keychain access failed for selected account, falling back to file storage: ${keytarError.message}`);
+            }
+            if (!selectedAccountData && fs.existsSync(SELECTED_ACCOUNT_PATH)) {
+                selectedAccountData = fs.readFileSync(SELECTED_ACCOUNT_PATH, 'utf8');
+            }
+            if (selectedAccountData) {
+                const parsed = JSON.parse(selectedAccountData);
+                this.selectedAccountId = parsed.accountId;
+                logger.info(`Loaded selected account: ${this.selectedAccountId}`);
+            }
+        }
+        catch (error) {
+            logger.error(`Error loading selected account: ${error.message}`);
+        }
+    }
     async saveTokenCache() {
         try {
             const cacheData = this.msalApp.getTokenCache().serialize();
@@ -95,6 +125,21 @@ class AuthManager {
             logger.error(`Error saving token cache: ${error.message}`);
         }
     }
+    async saveSelectedAccount() {
+        try {
+            const selectedAccountData = JSON.stringify({ accountId: this.selectedAccountId });
+            try {
+                await keytar.setPassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY, selectedAccountData);
+            }
+            catch (keytarError) {
+                logger.warn(`Keychain save failed for selected account, falling back to file storage: ${keytarError.message}`);
+                fs.writeFileSync(SELECTED_ACCOUNT_PATH, selectedAccountData);
+            }
+        }
+        catch (error) {
+            logger.error(`Error saving selected account: ${error.message}`);
+        }
+    }
     async setOAuthToken(token) {
         this.oauthToken = token;
         this.isOAuthMode = true;
@@ -106,10 +151,10 @@ class AuthManager {
         if (this.accessToken && this.tokenExpiry && this.tokenExpiry > Date.now() && !forceRefresh) {
             return this.accessToken;
         }
-        const accounts = await this.msalApp.getTokenCache().getAllAccounts();
-        if (accounts.length > 0) {
+        const currentAccount = await this.getCurrentAccount();
+        if (currentAccount) {
             const silentRequest = {
-                account: accounts[0],
+                account: currentAccount,
                 scopes: this.scopes,
             };
             try {
@@ -125,6 +170,22 @@ class AuthManager {
         }
         throw new Error('No valid token found');
     }
+    async getCurrentAccount() {
+        const accounts = await this.msalApp.getTokenCache().getAllAccounts();
+        if (accounts.length === 0) {
+            return null;
+        }
+        // If a specific account is selected, find it
+        if (this.selectedAccountId) {
+            const selectedAccount = accounts.find((account) => account.homeAccountId === this.selectedAccountId);
+            if (selectedAccount) {
+                return selectedAccount;
+            }
+            logger.warn(`Selected account ${this.selectedAccountId} not found, falling back to first account`);
+        }
+        // Fall back to first account (backward compatibility)
+        return accounts[0];
+    }
     async acquireTokenByDeviceCode(hack) {
         const deviceCodeRequest = {
             scopes: this.scopes,
@@ -147,6 +208,12 @@ class AuthManager {
             logger.info('Device code login successful');
             this.accessToken = response?.accessToken || null;
             this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
+            // Set the newly authenticated account as selected if no account is currently selected
+            if (!this.selectedAccountId && response?.account) {
+                this.selectedAccountId = response.account.homeAccountId;
+                await this.saveSelectedAccount();
+                logger.info(`Auto-selected new account: ${response.account.username}`);
+            }
             await this.saveTokenCache();
             return this.accessToken;
         }
@@ -218,8 +285,10 @@ class AuthManager {
             }
             this.accessToken = null;
             this.tokenExpiry = null;
+            this.selectedAccountId = null;
             try {
                 await keytar.deletePassword(SERVICE_NAME, TOKEN_CACHE_ACCOUNT);
+                await keytar.deletePassword(SERVICE_NAME, SELECTED_ACCOUNT_KEY);
             }
             catch (keytarError) {
                 logger.warn(`Keychain deletion failed: ${keytarError.message}`);
@@ -227,6 +296,9 @@ class AuthManager {
             if (fs.existsSync(FALLBACK_PATH)) {
                 fs.unlinkSync(FALLBACK_PATH);
             }
+            if (fs.existsSync(SELECTED_ACCOUNT_PATH)) {
+                fs.unlinkSync(SELECTED_ACCOUNT_PATH);
+            }
             return true;
         }
         catch (error) {
@@ -236,8 +308,8 @@ class AuthManager {
     }
     async hasWorkAccountPermissions() {
         try {
-            const accounts = await this.msalApp.getTokenCache().getAllAccounts();
-            if (accounts.length === 0) {
+            const currentAccount = await this.getCurrentAccount();
+            if (!currentAccount) {
                 return false;
             }
             const workScopes = endpoints.default
@@ -246,7 +318,7 @@ class AuthManager {
             try {
                 await this.msalApp.acquireTokenSilent({
                     scopes: workScopes.slice(0, 1),
-                    account: accounts[0],
+                    account: currentAccount,
                 });
                 return true;
             }
@@ -287,6 +359,12 @@ class AuthManager {
             this.accessToken = response?.accessToken || null;
             this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
             this.scopes = allScopes;
+            // Update selected account if this is a new account
+            if (response?.account) {
+                this.selectedAccountId = response.account.homeAccountId;
+                await this.saveSelectedAccount();
+                logger.info(`Updated selected account after scope expansion: ${response.account.username}`);
+            }
             await this.saveTokenCache();
             return true;
         }
@@ -295,6 +373,71 @@ class AuthManager {
             return false;
         }
     }
+    // Multi-account support methods
+    async listAccounts() {
+        return await this.msalApp.getTokenCache().getAllAccounts();
+    }
+    async selectAccount(accountId) {
+        const accounts = await this.listAccounts();
+        const account = accounts.find((acc) => acc.homeAccountId === accountId);
+        if (!account) {
+            logger.error(`Account with ID ${accountId} not found`);
+            return false;
+        }
+        this.selectedAccountId = accountId;
+        await this.saveSelectedAccount();
+        // Clear cached tokens to force refresh with new account
+        this.accessToken = null;
+        this.tokenExpiry = null;
+        logger.info(`Selected account: ${account.username} (${accountId})`);
+        return true;
+    }
+    async getTokenForAccount(accountId) {
+        const accounts = await this.listAccounts();
+        const account = accounts.find((acc) => acc.homeAccountId === accountId);
+        if (!account) {
+            throw new Error(`Account with ID ${accountId} not found`);
+        }
+        const silentRequest = {
+            account: account,
+            scopes: this.scopes,
+        };
+        try {
+            const response = await this.msalApp.acquireTokenSilent(silentRequest);
+            return response.accessToken;
+        }
+        catch (error) {
+            logger.error(`Failed to get token for account ${accountId}: ${error.message}`);
+            throw error;
+        }
+    }
+    async removeAccount(accountId) {
+        const accounts = await this.listAccounts();
+        const account = accounts.find((acc) => acc.homeAccountId === accountId);
+        if (!account) {
+            logger.error(`Account with ID ${accountId} not found`);
+            return false;
+        }
+        try {
+            await this.msalApp.getTokenCache().removeAccount(account);
+            // If this was the selected account, clear the selection
+            if (this.selectedAccountId === accountId) {
+                this.selectedAccountId = null;
+                await this.saveSelectedAccount();
+                this.accessToken = null;
+                this.tokenExpiry = null;
+            }
+            logger.info(`Removed account: ${account.username} (${accountId})`);
+            return true;
+        }
+        catch (error) {
+            logger.error(`Failed to remove account ${accountId}: ${error.message}`);
+            return false;
+        }
+    }
+    getSelectedAccountId() {
+        return this.selectedAccountId;
+    }
     requiresWorkAccountScope(toolName) {
         const endpoint = endpoints.default.find((e) => e.toolName === toolName);
         return endpoint?.requiresWorkAccount === true;

package/dist/cli.js

@@ -15,6 +15,9 @@ program
     .option('--login', 'Login using device code flow')
     .option('--logout', 'Log out and clear saved credentials')
     .option('--verify-login', 'Verify login without starting the server')
+    .option('--list-accounts', 'List all cached accounts')
+    .option('--select-account <accountId>', 'Select a specific account by ID')
+    .option('--remove-account <accountId>', 'Remove a specific account by ID')
     .option('--read-only', 'Start server in read-only mode, disabling write operations')
     .option('--http [port]', 'Use Streamable HTTP transport instead of stdio (optionally specify port, default: 3000)')
     .option('--enable-auth-tools', 'Enable login/logout tools when using HTTP mode (disabled by default in HTTP mode)')

package/dist/graph-client.js

@@ -11,14 +11,39 @@ class GraphClient {
         this.accessToken = accessToken;
         this.refreshToken = refreshToken || null;
     }
+    async getCurrentAccountId() {
+        const currentAccount = await this.authManager.getCurrentAccount();
+        return currentAccount?.homeAccountId || null;
+    }
+    getAccountSessions(accountId) {
+        if (!this.sessions.has(accountId)) {
+            this.sessions.set(accountId, new Map());
+        }
+        return this.sessions.get(accountId);
+    }
+    async getSessionForFile(filePath) {
+        const accountId = await this.getCurrentAccountId();
+        if (!accountId)
+            return null;
+        const accountSessions = this.getAccountSessions(accountId);
+        return accountSessions.get(filePath) || null;
+    }
+    async setSessionForFile(filePath, sessionId) {
+        const accountId = await this.getCurrentAccountId();
+        if (!accountId)
+            return;
+        const accountSessions = this.getAccountSessions(accountId);
+        accountSessions.set(filePath, sessionId);
+    }
     async createSession(filePath) {
         try {
             if (!filePath) {
                 logger.error('No file path provided for Excel session');
                 return null;
             }
-            if (this.sessions.has(filePath)) {
-                return this.sessions.get(filePath) || null;
+            const existingSession = await this.getSessionForFile(filePath);
+            if (existingSession) {
+                return existingSession;
             }
             logger.info(`Creating new Excel session for file: ${filePath}`);
             const accessToken = await this.authManager.getToken();
@@ -37,7 +62,7 @@ class GraphClient {
             }
             const result = await response.json();
             logger.info(`Session created successfully for file: ${filePath}`);
-            this.sessions.set(filePath, result.id);
+            await this.setSessionForFile(filePath, result.id);
             return result.id;
         }
         catch (error) {
@@ -116,7 +141,7 @@ class GraphClient {
             !endpoint.startsWith('/teams') &&
             !endpoint.startsWith('/chats') &&
             !endpoint.startsWith('/planner')) {
-            sessionId = this.sessions.get(options.excelFile) || null;
+            sessionId = await this.getSessionForFile(options.excelFile);
             if (!sessionId) {
                 sessionId = await this.createSessionWithToken(options.excelFile, accessToken);
             }
@@ -166,8 +191,9 @@ class GraphClient {
                 logger.error('No file path provided for Excel session');
                 return null;
             }
-            if (this.sessions.has(filePath)) {
-                return this.sessions.get(filePath) || null;
+            const existingSession = await this.getSessionForFile(filePath);
+            if (existingSession) {
+                return existingSession;
             }
             logger.info(`Creating new Excel session for file: ${filePath}`);
             const response = await fetch(`https://graph.microsoft.com/v1.0/me/drive/root:${filePath}:/workbook/createSession`, {
@@ -185,7 +211,7 @@ class GraphClient {
             }
             const result = await response.json();
             logger.info(`Session created successfully for file: ${filePath}`);
-            this.sessions.set(filePath, result.id);
+            await this.setSessionForFile(filePath, result.id);
             return result.id;
         }
         catch (error) {
@@ -236,7 +262,7 @@ class GraphClient {
                 !endpoint.startsWith('/chats') &&
                 !endpoint.startsWith('/planner') &&
                 !endpoint.startsWith('/sites')) {
-                sessionId = this.sessions.get(options.excelFile) || null;
+                sessionId = await this.getSessionForFile(options.excelFile);
                 if (!sessionId) {
                     sessionId = await this.createSession(options.excelFile);
                 }
@@ -407,7 +433,8 @@ class GraphClient {
         }
     }
     async closeSession(filePath) {
-        if (!filePath || !this.sessions.has(filePath)) {
+        const sessionId = await this.getSessionForFile(filePath);
+        if (!filePath || !sessionId) {
             return {
                 content: [
                     {
@@ -417,7 +444,6 @@ class GraphClient {
                 ],
             };
         }
-        const sessionId = this.sessions.get(filePath);
         try {
             const accessToken = await this.authManager.getToken();
             const response = await fetch(`https://graph.microsoft.com/v1.0/me/drive/root:${filePath}:/workbook/closeSession`, {
@@ -429,7 +455,11 @@ class GraphClient {
                 },
             });
             if (response.ok) {
-                this.sessions.delete(filePath);
+                const accountId = await this.getCurrentAccountId();
+                if (accountId) {
+                    const accountSessions = this.getAccountSessions(accountId);
+                    accountSessions.delete(filePath);
+                }
                 return {
                     content: [
                         {
@@ -458,9 +488,13 @@ class GraphClient {
     }
     async closeAllSessions() {
         const results = [];
-        for (const [filePath] of this.sessions) {
-            const result = await this.closeSession(filePath);
-            results.push(result);
+        const accountId = await this.getCurrentAccountId();
+        if (accountId) {
+            const accountSessions = this.getAccountSessions(accountId);
+            for (const [filePath] of accountSessions) {
+                const result = await this.closeSession(filePath);
+                results.push(result);
+            }
         }
         return {
             content: [

package/dist/index.js

@@ -40,6 +40,40 @@ async function main() {
             console.log(JSON.stringify({ message: 'Logged out successfully' }));
             process.exit(0);
         }
+        if (args.listAccounts) {
+            const accounts = await authManager.listAccounts();
+            const selectedAccountId = authManager.getSelectedAccountId();
+            const result = accounts.map(account => ({
+                id: account.homeAccountId,
+                username: account.username,
+                name: account.name,
+                selected: account.homeAccountId === selectedAccountId
+            }));
+            console.log(JSON.stringify({ accounts: result }));
+            process.exit(0);
+        }
+        if (args.selectAccount) {
+            const success = await authManager.selectAccount(args.selectAccount);
+            if (success) {
+                console.log(JSON.stringify({ message: `Selected account: ${args.selectAccount}` }));
+            }
+            else {
+                console.log(JSON.stringify({ error: `Account not found: ${args.selectAccount}` }));
+                process.exit(1);
+            }
+            process.exit(0);
+        }
+        if (args.removeAccount) {
+            const success = await authManager.removeAccount(args.removeAccount);
+            if (success) {
+                console.log(JSON.stringify({ message: `Removed account: ${args.removeAccount}` }));
+            }
+            else {
+                console.log(JSON.stringify({ error: `Account not found: ${args.removeAccount}` }));
+                process.exit(1);
+            }
+            process.exit(0);
+        }
         const server = new MicrosoftGraphServer(authManager, args);
         await server.initialize(version);
         await server.start();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Microsoft 365 MCP Server",
   "type": "module",
   "main": "dist/index.js",