@softeria/ms-365-mcp-server 0.123.0 → 0.124.1

package/dist/auth.js

@@ -49,13 +49,47 @@ function getEndpointRequiredScopes(endpoint, includeWorkAccountScopes = false) {
     return [];
   }
   const scopes = /* @__PURE__ */ new Set();
-  if (endpoint.scopes && Array.isArray(endpoint.scopes)) {
-    endpoint.scopes.forEach((scope) => scopes.add(scope));
+  getEndpointScopeGroups(endpoint, includeWorkAccountScopes).forEach(
+    (group) => group.forEach((scope) => scopes.add(scope))
+  );
+  return Array.from(scopes);
+}
+function toScopeGroups(value) {
+  if (!value || value.length === 0) {
+    return [];
   }
-  if (includeWorkAccountScopes && endpoint.workScopes && Array.isArray(endpoint.workScopes)) {
-    endpoint.workScopes.forEach((scope) => scopes.add(scope));
+  return Array.isArray(value[0]) ? value : [value];
+}
+function getEndpointScopeGroups(endpoint, includeWorkAccountScopes = false) {
+  if (!endpoint) {
+    return [];
   }
-  return Array.from(scopes);
+  const groups = [...toScopeGroups(endpoint.scopes)];
+  if (includeWorkAccountScopes) {
+    groups.push(...toScopeGroups(endpoint.workScopes));
+  }
+  return groups;
+}
+function getEndpointLoginScopes(endpoint, includeWorkAccountScopes = false) {
+  const groups = getEndpointScopeGroups(endpoint, includeWorkAccountScopes);
+  return groups.length > 0 ? groups[0] : [];
+}
+function getMissingAllowedScopesForGroups(scopeGroups, allowedScopes) {
+  if (allowedScopes === void 0 || scopeGroups.length === 0) {
+    return [];
+  }
+  const coveredAllowedScopes = new Set(collapseScopeHierarchy(allowedScopes));
+  let closest;
+  for (const group of scopeGroups) {
+    const missing = group.filter((scope) => !coveredAllowedScopes.has(scope));
+    if (missing.length === 0) {
+      return [];
+    }
+    if (!closest || missing.length < closest.length) {
+      closest = missing;
+    }
+  }
+  return closest ?? [];
 }
 function collapseRedundantScopes(scopes) {
   const scopesSet = new Set(scopes);
@@ -91,7 +125,7 @@ function buildScopesFromEndpoints(includeWorkAccountScopes = false, enabledTools
     if (!includeWorkAccountScopes && !endpoint.scopes && endpoint.workScopes) {
       return;
     }
-    getEndpointRequiredScopes(endpoint, includeWorkAccountScopes).forEach(
+    getEndpointLoginScopes(endpoint, includeWorkAccountScopes).forEach(
       (scope) => scopesSet.add(scope)
     );
   });
@@ -173,6 +207,7 @@ function buildAllowedScopeDiagnostics(options = {}) {
   }
   const normalToolScopes = /* @__PURE__ */ new Set();
   const effectiveToolScopes = /* @__PURE__ */ new Set();
+  const effectiveToolScopesAllGroups = /* @__PURE__ */ new Set();
   const disabledTools = [];
   for (const endpoint of endpoints.default) {
     if (!endpointMatchesNormalToolSurface(
@@ -183,18 +218,21 @@ function buildAllowedScopeDiagnostics(options = {}) {
     )) {
       continue;
     }
-    const requiredScopes = getEndpointRequiredScopes(endpoint, Boolean(options.orgMode));
-    requiredScopes.forEach((scope) => normalToolScopes.add(scope));
-    const missingScopes = getMissingAllowedScopes(requiredScopes, allowedScopes);
+    const scopeGroups = getEndpointScopeGroups(endpoint, Boolean(options.orgMode));
+    const loginScopes = getEndpointLoginScopes(endpoint, Boolean(options.orgMode));
+    const allScopes = getEndpointRequiredScopes(endpoint, Boolean(options.orgMode));
+    loginScopes.forEach((scope) => normalToolScopes.add(scope));
+    const missingScopes = getMissingAllowedScopesForGroups(scopeGroups, allowedScopes);
     if (missingScopes.length > 0) {
       disabledTools.push({
         toolName: endpoint.toolName,
-        requiredScopes: requiredScopes.sort((a, b) => a.localeCompare(b)),
+        requiredScopes: allScopes.sort((a, b) => a.localeCompare(b)),
         missingScopes: missingScopes.sort((a, b) => a.localeCompare(b))
       });
       continue;
     }
-    requiredScopes.forEach((scope) => effectiveToolScopes.add(scope));
+    loginScopes.forEach((scope) => effectiveToolScopes.add(scope));
+    allScopes.forEach((scope) => effectiveToolScopesAllGroups.add(scope));
   }
   const toolPermissions = collapseRedundantScopes(Array.from(normalToolScopes)).sort(
     (a, b) => a.localeCompare(b)
@@ -206,7 +244,8 @@ function buildAllowedScopeDiagnostics(options = {}) {
   const missingAllowedScopesForTools = Array.from(
     new Set(disabledTools.flatMap((tool) => tool.missingScopes))
   ).sort((a, b) => a.localeCompare(b));
-  const extraAllowedScopesNotUsedByTools = sortedAllowedScopes?.filter((scope) => !isScopeUsedByTools(scope, effectivePermissions)) ?? [];
+  const allEffectiveToolScopes = Array.from(effectiveToolScopesAllGroups);
+  const extraAllowedScopesNotUsedByTools = sortedAllowedScopes?.filter((scope) => !isScopeUsedByTools(scope, allEffectiveToolScopes)) ?? [];
   return {
     permissions: effectivePermissions,
     toolPermissions,
@@ -811,7 +850,9 @@ export {
   auth_default as default,
   describeAuthError,
   getEndpointRequiredScopes,
+  getEndpointScopeGroups,
   getMissingAllowedScopes,
+  getMissingAllowedScopesForGroups,
   getSelectedAccountPath,
   getTokenCachePath,
   parseAllowedScopes,

package/dist/endpoints.json

@@ -1748,7 +1748,7 @@
     "toolName": "copilot-retrieve",
     "presets": ["search", "work"],
     "readOnly": true,
-    "workScopes": ["Files.Read.All", "Sites.Read.All", "ExternalItem.Read.All"],
+    "workScopes": [["Files.Read.All", "Sites.Read.All"], ["ExternalItem.Read.All"]],
     "requestBodySchema": {
       "type": "object",
       "required": ["queryString", "dataSource"],
@@ -1782,7 +1782,7 @@
         }
       }
     },
-    "llmTip": "Semantic/hybrid search over Microsoft 365 content via the Copilot Retrieval API. Grounds a natural-language query against the same hybrid index that powers Microsoft 365 Copilot and returns permission-trimmed text extracts with their source URLs — unlike search-query/search-onedrive-files/search-sharepoint-sites, which are lexical KQL. Prefer this for paraphrase/intent queries (e.g. resolving an informal project nickname, or matching 'packaging requirements' against text that never uses that phrase). Pass the request fields nested under a 'body' object: { queryString, dataSource, filterExpression?, resourceMetadata?, maximumNumberOfResults? }. Returns { retrievalHits: [{ webUrl, extracts: [{ text, relevanceScore }], resourceType, resourceMetadata, sensitivityLabel? }] }. Work/school accounts only (personal accounts are not supported); needs delegated Files.Read.All + Sites.Read.All (SharePoint/OneDrive) or ExternalItem.Read.All (Copilot connectors)."
+    "llmTip": "Semantic/hybrid search over Microsoft 365 content via the Copilot Retrieval API. Grounds a natural-language query against the same hybrid index that powers Microsoft 365 Copilot and returns permission-trimmed text extracts with their source URLs — unlike search-query/search-onedrive-files/search-sharepoint-sites, which are lexical KQL. Prefer this for paraphrase/intent queries (e.g. resolving an informal project nickname, or matching 'packaging requirements' against text that never uses that phrase). Pass the request fields nested under a 'body' object: { queryString, dataSource, filterExpression?, resourceMetadata?, maximumNumberOfResults? }. Returns { retrievalHits: [{ webUrl, extracts: [{ text, relevanceScore }], resourceType, resourceMetadata, sensitivityLabel? }] }. Work/school accounts only (personal accounts are not supported). dataSource 'sharePoint'/'oneDriveBusiness' need delegated Files.Read.All + Sites.Read.All (requested by default); dataSource 'externalItem' (Copilot connectors) needs ExternalItem.Read.All, which is not requested by default - add it with --extra-scopes ExternalItem.Read.All."
   },
   {
     "pathPattern": "/me/onlineMeetings",

package/dist/graph-tools.js

@@ -2,8 +2,8 @@ import { randomUUID } from "crypto";
 import logger from "./logger.js";
 import { auditLog, getUserIdentityForAudit } from "./audit-log.js";
 import {
-  getEndpointRequiredScopes,
-  getMissingAllowedScopes,
+  getEndpointScopeGroups,
+  getMissingAllowedScopesForGroups,
   parseAllowedScopes
 } from "./auth.js";
 import { api } from "./generated/client.js";
@@ -294,6 +294,9 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         const encodedValue = encodeURIComponent(paramValue).replace(/%3D/g, "=");
         path2 = path2.replace(`{${paramName}}`, encodedValue).replace(`:${paramName}`, encodedValue).replace(`{${camelCaseParamName}}`, encodedValue).replace(`:${camelCaseParamName}`, encodedValue);
         logger.info(`Path param fallback: replaced :${camelCaseParamName} with encoded value`);
+      } else if (isOdataParam) {
+        queryParams[fixedParamName] = `${paramValue}`;
+        logger.info(`OData param fallback: forwarded ${fixedParamName}=${paramValue}`);
       }
     }
     clampTopQueryParam(queryParams);
@@ -522,8 +525,10 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
       skippedCount++;
       continue;
     }
-    const requiredScopes = getEndpointRequiredScopes(endpointConfig, orgMode);
-    const missingScopes = allowedScopes !== void 0 && !endpointConfig ? ["endpoint scope metadata"] : getMissingAllowedScopes(requiredScopes, allowedScopes);
+    const missingScopes = allowedScopes !== void 0 && !endpointConfig ? ["endpoint scope metadata"] : getMissingAllowedScopesForGroups(
+      getEndpointScopeGroups(endpointConfig, orgMode),
+      allowedScopes
+    );
     if (missingScopes.length > 0) {
       disabledByAllowedScopes.push({ toolName: tool.alias, missingScopes });
       skippedCount++;
@@ -674,8 +679,8 @@ function buildToolsRegistry(readOnly, orgMode, enabledToolsRegex, allowedScopesV
     if (enabledToolsRegex && !enabledToolsRegex.test(tool.alias)) {
       continue;
     }
-    const missingScopes = allowedScopes !== void 0 && !endpointConfig ? ["endpoint scope metadata"] : getMissingAllowedScopes(
-      getEndpointRequiredScopes(endpointConfig, orgMode),
+    const missingScopes = allowedScopes !== void 0 && !endpointConfig ? ["endpoint scope metadata"] : getMissingAllowedScopesForGroups(
+      getEndpointScopeGroups(endpointConfig, orgMode),
       allowedScopes
     );
     if (missingScopes.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.123.0",
+  "version": "0.124.1",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -1748,7 +1748,7 @@
     "toolName": "copilot-retrieve",
     "presets": ["search", "work"],
     "readOnly": true,
-    "workScopes": ["Files.Read.All", "Sites.Read.All", "ExternalItem.Read.All"],
+    "workScopes": [["Files.Read.All", "Sites.Read.All"], ["ExternalItem.Read.All"]],
     "requestBodySchema": {
       "type": "object",
       "required": ["queryString", "dataSource"],
@@ -1782,7 +1782,7 @@
         }
       }
     },
-    "llmTip": "Semantic/hybrid search over Microsoft 365 content via the Copilot Retrieval API. Grounds a natural-language query against the same hybrid index that powers Microsoft 365 Copilot and returns permission-trimmed text extracts with their source URLs — unlike search-query/search-onedrive-files/search-sharepoint-sites, which are lexical KQL. Prefer this for paraphrase/intent queries (e.g. resolving an informal project nickname, or matching 'packaging requirements' against text that never uses that phrase). Pass the request fields nested under a 'body' object: { queryString, dataSource, filterExpression?, resourceMetadata?, maximumNumberOfResults? }. Returns { retrievalHits: [{ webUrl, extracts: [{ text, relevanceScore }], resourceType, resourceMetadata, sensitivityLabel? }] }. Work/school accounts only (personal accounts are not supported); needs delegated Files.Read.All + Sites.Read.All (SharePoint/OneDrive) or ExternalItem.Read.All (Copilot connectors)."
+    "llmTip": "Semantic/hybrid search over Microsoft 365 content via the Copilot Retrieval API. Grounds a natural-language query against the same hybrid index that powers Microsoft 365 Copilot and returns permission-trimmed text extracts with their source URLs — unlike search-query/search-onedrive-files/search-sharepoint-sites, which are lexical KQL. Prefer this for paraphrase/intent queries (e.g. resolving an informal project nickname, or matching 'packaging requirements' against text that never uses that phrase). Pass the request fields nested under a 'body' object: { queryString, dataSource, filterExpression?, resourceMetadata?, maximumNumberOfResults? }. Returns { retrievalHits: [{ webUrl, extracts: [{ text, relevanceScore }], resourceType, resourceMetadata, sensitivityLabel? }] }. Work/school accounts only (personal accounts are not supported). dataSource 'sharePoint'/'oneDriveBusiness' need delegated Files.Read.All + Sites.Read.All (requested by default); dataSource 'externalItem' (Copilot connectors) needs ExternalItem.Read.All, which is not requested by default - add it with --extra-scopes ExternalItem.Read.All."
   },
   {
     "pathPattern": "/me/onlineMeetings",