@softeria/ms-365-mcp-server 0.117.0 → 0.118.0

package/README.md

@@ -582,6 +582,7 @@ Environment variables:
 - `MS365_MCP_CLOUD_TYPE=global|china`: Microsoft cloud environment (alternative to --cloud flag)
 - `LOG_LEVEL`: Set logging level (default: 'info')
 - `SILENT=true|1`: Disable console output
+- `MS365_MCP_REDACT_PII=true|1`: Scrub JWTs, Bearer headers, OAuth token fields, and email addresses from log messages before they are written (default: disabled). Useful when logs are shipped to a central store or shared host.
 - `MS365_MCP_CLIENT_ID`: Custom Azure app client ID (defaults to built-in app)
 - `MS365_MCP_TENANT_ID`: Custom tenant ID (defaults to 'common' for multi-tenant)
 - `MS365_MCP_OAUTH_TOKEN`: Pre-existing OAuth token for Microsoft Graph API (BYOT method)

package/dist/lib/log-redactor.js

@@ -0,0 +1,38 @@
+const REDACTIONS = [
+  // JSON Web Tokens (header.payload.signature) — access_token, id_token, etc.
+  {
+    pattern: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+    replacement: "[REDACTED_JWT]"
+  },
+  // Authorization: Bearer <token>
+  {
+    pattern: /(Bearer\s+)[A-Za-z0-9._~+/-]+=*/gi,
+    replacement: "$1[REDACTED]"
+  },
+  // OAuth token fields in query strings or JSON bodies:
+  // refresh_token=..., "access_token": "...", code=..., client_secret=...
+  {
+    pattern: /(["']?(?:refresh_token|access_token|id_token|client_secret|code|assertion)["']?\s*[=:]\s*["']?)[A-Za-z0-9._~+/-]+=*/gi,
+    replacement: "$1[REDACTED]"
+  },
+  // Email addresses / UPNs
+  {
+    pattern: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,
+    replacement: "[REDACTED_EMAIL]"
+  }
+];
+function redactionEnabled() {
+  const raw = process.env.MS365_MCP_REDACT_PII;
+  return raw === "true" || raw === "1";
+}
+function redactSensitive(input) {
+  let out = input;
+  for (const { pattern, replacement } of REDACTIONS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+export {
+  redactSensitive,
+  redactionEnabled
+};

package/dist/logger.js

@@ -3,6 +3,14 @@ import path from "path";
 import { fileURLToPath } from "url";
 import fs from "fs";
 import os from "os";
+import { redactionEnabled, redactSensitive } from "./lib/log-redactor.js";
+const redactFormat = winston.format((info) => {
+  if (!redactionEnabled()) return info;
+  if (typeof info.message === "string") {
+    info.message = redactSensitive(info.message);
+  }
+  return info;
+});
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const logsDir = process.env.MS365_MCP_LOG_DIR || path.join(os.homedir(), ".ms-365-mcp-server", "logs");
 if (!fs.existsSync(logsDir)) {
@@ -29,6 +37,7 @@ ensureFileMode(serverLogPath);
 const logger = winston.createLogger({
   level: process.env.LOG_LEVEL || "info",
   format: winston.format.combine(
+    redactFormat(),
     winston.format.timestamp({
       format: "YYYY-MM-DD HH:mm:ss"
     }),
@@ -51,7 +60,11 @@ const logger = winston.createLogger({
 const enableConsoleLogging = () => {
   logger.add(
     new winston.transports.Console({
-      format: winston.format.combine(winston.format.colorize(), winston.format.simple()),
+      format: winston.format.combine(
+        redactFormat(),
+        winston.format.colorize(),
+        winston.format.simple()
+      ),
       silent: process.env.SILENT === "true" || process.env.SILENT === "1"
     })
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.117.0",
+  "version": "0.118.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",