@softeria/ms-365-mcp-server 0.118.0 → 0.118.2

package/README.md

@@ -584,7 +584,7 @@ Environment variables:
 - `SILENT=true|1`: Disable console output
 - `MS365_MCP_REDACT_PII=true|1`: Scrub JWTs, Bearer headers, OAuth token fields, and email addresses from log messages before they are written (default: disabled). Useful when logs are shipped to a central store or shared host.
 - `MS365_MCP_CLIENT_ID`: Custom Azure app client ID (defaults to built-in app)
-- `MS365_MCP_TENANT_ID`: Custom tenant ID (defaults to 'common' for multi-tenant)
+- `MS365_MCP_TENANT_ID`: Custom tenant ID (defaults to 'common' for multi-tenant). **Personal Microsoft accounts should set this to `consumers`** - as of June 2026, refresh tokens issued via the default 'common' authority are rejected at the first refresh, so sessions die roughly an hour after login
 - `MS365_MCP_OAUTH_TOKEN`: Pre-existing OAuth token for Microsoft Graph API (BYOT method)
 - `MS365_MCP_KEYVAULT_URL`: Azure Key Vault URL for secrets management (see Azure Key Vault section)
 - `MS365_MCP_TOKEN_CACHE_PATH`: Custom file path for MSAL token cache (see Token Storage below)

package/dist/auth.js

@@ -243,6 +243,13 @@ function describeAuthError(error) {
   }
   return error.message;
 }
+const MSA_HOME_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
+function consumersAuthorityHint(error, account, authority) {
+  if (error instanceof AuthError && error.errorCode === "invalid_grant" && account?.tenantId === MSA_HOME_TENANT_ID && (!authority || /\/common\/?$/i.test(authority))) {
+    return `This looks like a known issue (June 2026) where Microsoft rejects refresh tokens issued to personal accounts via the default 'common' authority. If this server is used only with personal accounts, set MS365_MCP_TENANT_ID=consumers and re-login with: --login`;
+  }
+  return null;
+}
 class AuthManager {
   constructor(config, scopes = [], expectedAccount, storage) {
     logger.info(`And scopes are ${scopes.join(", ")}`, scopes);
@@ -459,8 +466,13 @@ class AuthManager {
         await this.saveTokenCache();
         return this.accessToken;
       } catch (error) {
-        logger.error(`Silent token acquisition failed: ${describeAuthError(error)}`);
-        throw new Error("Silent token acquisition failed");
+        const hint = consumersAuthorityHint(error, currentAccount, this.config.auth.authority);
+        logger.error(
+          `Silent token acquisition failed: ${describeAuthError(error)}${hint ? ` ${hint}` : ""}`
+        );
+        throw new Error(
+          hint ? `Silent token acquisition failed. ${hint}` : "Silent token acquisition failed"
+        );
       }
     }
     throw new Error("No valid token found");
@@ -774,9 +786,12 @@ class AuthManager {
       await this.saveTokenCache();
       return response.accessToken;
     } catch (error) {
-      logger.error(`Silent token acquisition failed: ${describeAuthError(error)}`);
+      const hint = consumersAuthorityHint(error, targetAccount, this.config.auth.authority);
+      logger.error(
+        `Silent token acquisition failed: ${describeAuthError(error)}${hint ? ` ${hint}` : ""}`
+      );
       throw new Error(
-        `Failed to acquire token for account '${targetAccount.username || targetAccount.name || "unknown"}'. The token may have expired. Please re-login with: --login`
+        `Failed to acquire token for account '${targetAccount.username || targetAccount.name || "unknown"}'. ` + (hint ?? "The token may have expired. Please re-login with: --login")
       );
     }
   }
@@ -787,6 +802,7 @@ export {
   buildScopeDiagnostics,
   buildScopesFromEndpoints,
   collapseScopeHierarchy,
+  consumersAuthorityHint,
   auth_default as default,
   describeAuthError,
   getEndpointRequiredScopes,

package/dist/lib/log-redactor.js

@@ -10,9 +10,17 @@ const REDACTIONS = [
     replacement: "$1[REDACTED]"
   },
   // OAuth token fields in query strings or JSON bodies:
-  // refresh_token=..., "access_token": "...", code=..., client_secret=...
+  // refresh_token=..., "access_token": "...", client_secret=...
+  // The \b keeps composite keys like `statusCode` from matching via a substring.
   {
-    pattern: /(["']?(?:refresh_token|access_token|id_token|client_secret|code|assertion)["']?\s*[=:]\s*["']?)[A-Za-z0-9._~+/-]+=*/gi,
+    pattern: /(["']?\b(?:refresh_token|access_token|id_token|client_secret|assertion)["']?\s*[=:]\s*["']?)[A-Za-z0-9._~+/-]+=*/gi,
+    replacement: "$1[REDACTED]"
+  },
+  // OAuth authorization codes, query-string form only (?code=... / &code=...).
+  // `code:` in JSON or prose is an error/status code (ECONNRESET, AADSTS...),
+  // which must stay readable for diagnostics.
+  {
+    pattern: /([?&]code=)[^&\s"']+/gi,
     replacement: "$1[REDACTED]"
   },
   // Email addresses / UPNs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.118.0",
+  "version": "0.118.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",