@softeria/ms-365-mcp-server 0.114.3 → 0.114.4

package/dist/auth-tools.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { getRequestTokens } from "./request-context.js";
 function registerAuthTools(server, authManager) {
   server.tool(
     "login",
@@ -121,6 +122,7 @@ function registerAuthTools(server, authManager) {
         const accounts = await authManager.listAccounts();
         const selectedAccountId = authManager.getSelectedAccountId();
         const pinnedMode = authManager.hasExpectedAccount();
+        const oauthBearerMode = authManager.isOAuthModeEnabled() || Boolean(getRequestTokens());
         const result = accounts.map((account) => ({
           email: account.username || "unknown",
           name: account.name,
@@ -133,7 +135,7 @@ function registerAuthTools(server, authManager) {
               text: JSON.stringify({
                 accounts: result,
                 count: result.length,
-                tip: pinnedMode ? "Expected account pinning is configured; account parameters are disabled." : "Pass the 'email' value as the 'account' parameter in any tool call to target a specific account."
+                tip: pinnedMode ? "Expected account pinning is configured; account parameters are disabled." : oauthBearerMode ? "This server is in HTTP/OAuth mode: every request uses the identity of the connecting client's bearer token. The cached accounts listed here cannot be targeted via the 'account' parameter; reconnect the MCP client as the desired account instead." : "Pass the 'email' value as the 'account' parameter in any tool call to target a specific account."
               })
             }
           ]

package/dist/auth.js

@@ -718,6 +718,11 @@ class AuthManager {
    */
   async getTokenForAccount(identifier) {
     if (this.isOAuthMode && this.oauthToken) {
+      if (identifier) {
+        throw new Error(
+          `Cannot switch to account '${identifier}': the server is in OAuth mode and always uses the identity of the supplied bearer token. Account switching requires stdio mode (or HTTP with --trust-proxy-auth).`
+        );
+      }
       return this.oauthToken;
     }
     let targetAccount = null;

package/dist/graph-tools.js

@@ -46,6 +46,15 @@ function formatDisabledToolsForLog(disabledTools) {
   const suffix = disabledTools.length > shown.length ? `, ... +${disabledTools.length - shown.length} more` : "";
   return `${shown.join("; ")}${suffix}`;
 }
+async function checkAccountParamInBearerMode(accountParam, authManager) {
+  if (!accountParam || !authManager) return null;
+  const contextToken = getRequestTokens()?.accessToken;
+  if (!contextToken && !authManager.isOAuthModeEnabled()) return null;
+  const bearerToken = contextToken ?? await authManager.getToken().catch(() => null) ?? void 0;
+  const bearerIdentity = getUserIdentityForAudit(bearerToken);
+  if (bearerIdentity && bearerIdentity.toLowerCase() === accountParam.toLowerCase()) return null;
+  return `The 'account' parameter is not supported in HTTP/OAuth mode: every request uses the identity of the connecting client's bearer token` + (bearerIdentity ? ` ('${bearerIdentity}')` : "") + `, so account switching is not possible. To act as '${accountParam}', reconnect the MCP client authenticated as that account, or run the server in stdio mode (or HTTP with --trust-proxy-auth) where cached accounts are available.`;
+}
 const UTILITY_TOOLS = [
   {
     name: "parse-teams-url",
@@ -124,6 +133,13 @@ const UTILITY_TOOLS = [
         };
       }
       try {
+        const accountModeError = await checkAccountParamInBearerMode(accountParam, authManager);
+        if (accountModeError) {
+          return {
+            content: [{ type: "text", text: JSON.stringify({ error: accountModeError }) }],
+            isError: true
+          };
+        }
         let accountAccessToken;
         if (authManager && !authManager.isOAuthModeEnabled() && !getRequestTokens()) {
           accountAccessToken = await authManager.getTokenForAccount(accountParam);
@@ -158,9 +174,16 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
   const upn = getUserIdentityForAudit(getRequestTokens()?.accessToken);
   const httpMethod = tool.method.toUpperCase();
   try {
+    const accountParam = params.account;
+    const accountModeError = await checkAccountParamInBearerMode(accountParam, authManager);
+    if (accountModeError) {
+      return {
+        content: [{ type: "text", text: JSON.stringify({ error: accountModeError }) }],
+        isError: true
+      };
+    }
     let accountAccessToken;
     if (authManager && !authManager.isOAuthModeEnabled() && !getRequestTokens()) {
-      const accountParam = params.account;
       try {
         accountAccessToken = await authManager.getTokenForAccount(accountParam);
       } catch (err) {

package/dist/server.js

@@ -105,17 +105,24 @@ class MicrosoftGraphServer {
   async initialize(version) {
     this.secrets = await getSecrets();
     this.version = version;
-    try {
-      this.multiAccount = await this.authManager.isMultiAccount();
-      if (this.multiAccount) {
-        const accounts = await this.authManager.listAccounts();
-        this.accountNames = accounts.map((a) => a.username).filter((u) => !!u);
-        logger.info(
-          `Multi-account mode detected (${this.accountNames.length} accounts): "account" parameter will be injected into all tool schemas`
-        );
+    const accountRoutingAvailable = (!this.options.http || this.options.trustProxyAuth) && !this.authManager.isOAuthModeEnabled();
+    if (accountRoutingAvailable) {
+      try {
+        this.multiAccount = await this.authManager.isMultiAccount();
+        if (this.multiAccount) {
+          const accounts = await this.authManager.listAccounts();
+          this.accountNames = accounts.map((a) => a.username).filter((u) => !!u);
+          logger.info(
+            `Multi-account mode detected (${this.accountNames.length} accounts): "account" parameter will be injected into all tool schemas`
+          );
+        }
+      } catch (err) {
+        logger.warn(`Failed to detect multi-account mode: ${err.message}`);
       }
-    } catch (err) {
-      logger.warn(`Failed to detect multi-account mode: ${err.message}`);
+    } else {
+      logger.info(
+        'Account routing disabled: requests use the OAuth bearer identity, so the "account" parameter is not injected into tool schemas'
+      );
     }
     if (this.options.obo) {
       if (!this.options.http) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.114.3",
+  "version": "0.114.4",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",