@softeria/ms-365-mcp-server 0.120.1 → 0.122.0

package/README.md

@@ -150,6 +150,18 @@ Scope coverage is hierarchy-aware: for example, `Mail.ReadWrite` covers tools th
 
 In HTTP mode, OAuth discovery advertises the effective filtered permissions so clients request the same consent surface. On-Behalf-Of mode (`--obo`) still advertises `api://<clientId>/access_as_user` for protected-resource metadata; `--allowed-scopes` does not override OBO.
 
+### Requesting extra scopes
+
+`--allowed-scopes` only ever _narrows_ the token request. To request a Graph scope that no bundled tool needs — for example to drive an endpoint via `graph-batch` — use `--extra-scopes` (or `MS365_MCP_EXTRA_SCOPES`). These scopes are appended verbatim to the token request, on top of the tool-derived scopes.
+
+```bash
+npx @softeria/ms-365-mcp-server \
+  --org-mode \
+  --extra-scopes 'CopilotPackages.ReadWrite.All'
+```
+
+This is for use with your own Azure app registration (`MS365_MCP_CLIENT_ID` / `MS365_MCP_CLIENT_SECRET`): the default Softeria app only declares a lean, fixed permission set, so request additional scopes against an app you control (your tenant admin consents to them there). CLI value takes precedence over the env var; an empty value fails at startup.
+
 ## Organization/Work Mode
 
 To access work/school features (Teams, SharePoint, etc.), enable organization mode using any of these flags:
@@ -542,6 +554,7 @@ The following options can be used when running ms-365-mcp-server directly from t
 --force-work-scopes Backwards compatibility alias for --org-mode (deprecated)
 --cloud <type>    Microsoft cloud environment: global (default) or china (21Vianet)
 --allowed-scopes <scopes> Limit exposed tools to Graph scopes covered by this allowlist
+--extra-scopes <scopes> Append additional Graph scopes to the token request (for use with your own app registration + graph-batch)
 --expected-username <username> Require local MSAL auth to use this account username
 --expected-home-account-id <id> Require local MSAL auth to use this exact homeAccountId
 ```

package/dist/auth.js

@@ -218,7 +218,12 @@ function buildAllowedScopeDiagnostics(options = {}) {
   };
 }
 function resolveAuthScopes(options = {}) {
-  return buildAllowedScopeDiagnostics(options).effectivePermissions;
+  const toolScopes = buildAllowedScopeDiagnostics(options).effectivePermissions;
+  const extraScopes = parseAllowedScopes(options.extraScopes);
+  if (!extraScopes || extraScopes.length === 0) {
+    return toolScopes;
+  }
+  return Array.from(/* @__PURE__ */ new Set([...toolScopes, ...extraScopes]));
 }
 function buildScopeDiagnostics(toolScopes, allowedScopesInput) {
   const toolPermissions = [...toolScopes].sort((a, b) => a.localeCompare(b));

package/dist/cli.js

@@ -26,6 +26,9 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 ).option(
   "--allowed-scopes <scopes>",
   "Limit exposed tools to Graph scopes covered by this whitespace-separated allowlist"
+).option(
+  "--extra-scopes <scopes>",
+  "Append additional Graph scopes (whitespace-separated) to the token request, beyond those derived from enabled tools. Use with your own app registration (MS365_MCP_CLIENT_ID/SECRET) to request scopes the default app does not declare, then call the endpoints via graph-batch."
 ).option(
   "--preset <names>",
   "Use preset tool categories (comma-separated). Available: mail, calendar, files, personal, work, excel, contacts, tasks, onenote, search, users, all"
@@ -97,6 +100,15 @@ function parseArgs() {
     );
     process.exit(1);
   }
+  if (options.extraScopes === void 0 && process.env.MS365_MCP_EXTRA_SCOPES !== void 0) {
+    options.extraScopes = process.env.MS365_MCP_EXTRA_SCOPES;
+  }
+  if (options.extraScopes !== void 0 && options.extraScopes.trim() === "") {
+    console.error(
+      "Error: --extra-scopes / MS365_MCP_EXTRA_SCOPES was provided but is empty. Provide one or more whitespace-separated scopes, or omit it."
+    );
+    process.exit(1);
+  }
   if (options.expectedUsername === void 0 && process.env.MS365_MCP_EXPECTED_USERNAME !== void 0) {
     options.expectedUsername = process.env.MS365_MCP_EXPECTED_USERNAME;
   }

package/dist/endpoints.json

@@ -944,6 +944,27 @@
     "presets": ["onenote", "work"],
     "workScopes": ["Notes.Read"]
   },
+  {
+    "pathPattern": "/sites/{site-id}/onenote/notebooks/{notebook-id}/sectionGroups",
+    "method": "get",
+    "toolName": "list-sharepoint-site-onenote-notebook-section-groups",
+    "presets": ["onenote", "work"],
+    "workScopes": ["Notes.Read"]
+  },
+  {
+    "pathPattern": "/sites/{site-id}/onenote/sectionGroups/{sectionGroup-id}/sections",
+    "method": "get",
+    "toolName": "list-sharepoint-site-onenote-section-group-sections",
+    "presets": ["onenote", "work"],
+    "workScopes": ["Notes.Read"]
+  },
+  {
+    "pathPattern": "/sites/{site-id}/onenote/sectionGroups/{sectionGroup-id}/sectionGroups",
+    "method": "get",
+    "toolName": "list-sharepoint-site-onenote-section-group-section-groups",
+    "presets": ["onenote", "work"],
+    "workScopes": ["Notes.Read"]
+  },
   {
     "pathPattern": "/sites/{site-id}/onenote/pages/{onenotePage-id}/content",
     "method": "get",

package/dist/generated/client.js

@@ -13290,6 +13290,56 @@ To list them, include system in your $select statement.`,
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/sites/:siteId/onenote/notebooks/:notebookId/sectionGroups",
+    alias: "list-sharepoint-site-onenote-notebook-section-groups",
+    description: `The section groups in the notebook. Read-only. Nullable.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/sites/:siteId/onenote/notebooks/:notebookId/sections",
@@ -13348,6 +13398,106 @@ To list them, include system in your $select statement.`,
     requestFormat: "json",
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/sites/:siteId/onenote/sectionGroups/:sectionGroupId/sectionGroups",
+    alias: "list-sharepoint-site-onenote-section-group-section-groups",
+    description: `The section groups in the section. Read-only. Nullable.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "get",
+    path: "/sites/:siteId/onenote/sectionGroups/:sectionGroupId/sections",
+    alias: "list-sharepoint-site-onenote-section-group-sections",
+    description: `The sections in the section group. Read-only. Nullable.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/sites/:siteId/onenote/sections/:onenoteSectionId/pages",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.120.1",
+  "version": "0.122.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -944,6 +944,27 @@
     "presets": ["onenote", "work"],
     "workScopes": ["Notes.Read"]
   },
+  {
+    "pathPattern": "/sites/{site-id}/onenote/notebooks/{notebook-id}/sectionGroups",
+    "method": "get",
+    "toolName": "list-sharepoint-site-onenote-notebook-section-groups",
+    "presets": ["onenote", "work"],
+    "workScopes": ["Notes.Read"]
+  },
+  {
+    "pathPattern": "/sites/{site-id}/onenote/sectionGroups/{sectionGroup-id}/sections",
+    "method": "get",
+    "toolName": "list-sharepoint-site-onenote-section-group-sections",
+    "presets": ["onenote", "work"],
+    "workScopes": ["Notes.Read"]
+  },
+  {
+    "pathPattern": "/sites/{site-id}/onenote/sectionGroups/{sectionGroup-id}/sectionGroups",
+    "method": "get",
+    "toolName": "list-sharepoint-site-onenote-section-group-section-groups",
+    "presets": ["onenote", "work"],
+    "workScopes": ["Notes.Read"]
+  },
   {
     "pathPattern": "/sites/{site-id}/onenote/pages/{onenotePage-id}/content",
     "method": "get",