@softeria/ms-365-mcp-server 0.128.1 → 0.129.0

package/README.md

@@ -297,7 +297,7 @@ Open WebUI supports MCP servers via HTTP transport with OAuth 2.1.
 
 3. Click **Register Client**.
 
-> **Note**: Dynamic client registration is enabled by default in HTTP mode. Use `--no-dynamic-registration` to disable it. If using a custom Azure Entra app, the platform type for your redirect URI depends on whether the app has a client secret: with a secret use "Web", without one use "Mobile and desktop applications" (never "Single-page application").
+> **Note**: Dynamic client registration is enabled by default in HTTP mode. Use `--no-dynamic-registration` (or set `MS365_MCP_DISABLE_DCR=true`) to disable it. If using a custom Azure Entra app, the platform type for your redirect URI depends on whether the app has a client secret: with a secret use "Web", without one use "Mobile and desktop applications" (never "Single-page application").
 
 **Quick test setup** using the default Azure app (ID `ms-365` and `localhost:8080` are pre-configured):
 

package/dist/__tests__/graph-tools.test.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { z } from "zod";
 vi.mock("../logger.js", () => ({
   default: {
@@ -530,7 +530,9 @@ describe("graph-tools", () => {
       registerGraphTools(server, graphClient);
       await server.tools.get("create-reply-draft").handler({
         messageId: "AAMk123",
-        body: { Message: { body: { contentType: "html", content: "<p>hi</p>" } } }
+        body: { Message: { body: { contentType: "html", content: "<p>hi</p>" } } },
+        confirm: true
+        // destructive POST — required by isDestructiveOperation gate
       });
       const [, options] = graphClient.graphRequest.mock.calls[0];
       const prefer = options.headers["Prefer"];
@@ -571,7 +573,9 @@ describe("graph-tools", () => {
       await server.tools.get("upload-file-content").handler({
         driveId: "drive123",
         driveItemId: "item456",
-        body: base64
+        body: base64,
+        confirm: true
+        // destructive PUT — required by isDestructiveOperation gate
       });
       const [path, options] = graphClient.graphRequest.mock.calls[0];
       expect(path).toBe("/drives/drive123/items/item456/content");
@@ -607,7 +611,9 @@ describe("graph-tools", () => {
       await server.tools.get("upload-file-content").handler({
         driveId: "d",
         driveItemId: "i",
-        body: Buffer.from("%PDF-1.4").toString("base64")
+        body: Buffer.from("%PDF-1.4").toString("base64"),
+        confirm: true
+        // destructive PUT — required by isDestructiveOperation gate
       });
       const [, options] = graphClient.graphRequest.mock.calls[0];
       expect(options.headers["Content-Type"]).toBe("application/pdf");
@@ -1267,4 +1273,247 @@ describe("graph-tools", () => {
       expect(server.tools.has("parse-teams-url")).toBe(true);
     });
   });
+  describe("destructive operations require confirm: true", () => {
+    const prevRequireConfirm = process.env.MS365_MCP_REQUIRE_CONFIRM;
+    beforeEach(() => {
+      process.env.MS365_MCP_REQUIRE_CONFIRM = "true";
+    });
+    afterEach(() => {
+      if (prevRequireConfirm === void 0) delete process.env.MS365_MCP_REQUIRE_CONFIRM;
+      else process.env.MS365_MCP_REQUIRE_CONFIRM = prevRequireConfirm;
+    });
+    it("rejects DELETE without confirm: true and does NOT call Graph", async () => {
+      const endpoint = makeEndpoint({
+        method: "delete",
+        path: "/me/messages/:message-id",
+        alias: "delete-mail-message"
+      });
+      const config = makeConfig({
+        pathPattern: "/me/messages/{message-id}",
+        method: "delete",
+        toolName: "delete-mail-message"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("delete-mail-message");
+      const result = await tool.handler({ messageId: "abc" });
+      expect(graphClient.graphRequest).not.toHaveBeenCalled();
+      expect(result.isError).toBe(true);
+      const payload = JSON.parse(result.content[0].text);
+      expect(payload.error).toBe("confirmation_required");
+      expect(payload.tool).toBe("delete-mail-message");
+      expect(payload.destructive).toBe(true);
+    });
+    it("allows DELETE when confirm: true is passed", async () => {
+      const endpoint = makeEndpoint({
+        method: "delete",
+        path: "/me/messages/:message-id",
+        alias: "delete-mail-message"
+      });
+      const config = makeConfig({
+        pathPattern: "/me/messages/{message-id}",
+        method: "delete",
+        toolName: "delete-mail-message"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ status: 204 }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("delete-mail-message");
+      await tool.handler({ messageId: "abc", confirm: true });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
+    it("does NOT send `confirm` to Graph as a query/body parameter", async () => {
+      const endpoint = makeEndpoint({
+        method: "post",
+        path: "/me/sendMail",
+        alias: "send-mail",
+        parameters: [{ name: "message", type: "Body", schema: z.any() }]
+      });
+      const config = makeConfig({
+        pathPattern: "/me/sendMail",
+        method: "post",
+        toolName: "send-mail"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ status: 202 }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("send-mail");
+      await tool.handler({ message: { subject: "hi" }, confirm: true });
+      const [url, opts] = graphClient.graphRequest.mock.calls[0];
+      expect(url).not.toContain("confirm");
+      const body = JSON.parse(opts.body);
+      expect(body).not.toHaveProperty("confirm");
+    });
+    it("allows GET (read-only) regardless of confirm", async () => {
+      const endpoint = makeEndpoint();
+      const config = makeConfig();
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ value: [] }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("test-tool");
+      await tool.handler({});
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
+    it("allows POST endpoints flagged readOnly without confirm (e.g. find-meeting-times)", async () => {
+      const endpoint = makeEndpoint({
+        method: "post",
+        path: "/me/findMeetingTimes",
+        alias: "find-meeting-times"
+      });
+      const config = makeConfig({
+        pathPattern: "/me/findMeetingTimes",
+        method: "post",
+        toolName: "find-meeting-times",
+        readOnly: true
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ meetingTimeSuggestions: [] }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("find-meeting-times");
+      await tool.handler({});
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
+    it("does NOT gate when MS365_MCP_REQUIRE_CONFIRM is unset (opt-in, off by default)", async () => {
+      delete process.env.MS365_MCP_REQUIRE_CONFIRM;
+      const endpoint = makeEndpoint({
+        method: "delete",
+        path: "/me/messages/:message-id",
+        alias: "delete-mail-message"
+      });
+      const config = makeConfig({
+        pathPattern: "/me/messages/{message-id}",
+        method: "delete",
+        toolName: "delete-mail-message"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ status: 204 }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("delete-mail-message");
+      await tool.handler({ messageId: "abc" });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
+    it("does NOT gate when MS365_MCP_REQUIRE_CONFIRM=false (explicit off)", async () => {
+      process.env.MS365_MCP_REQUIRE_CONFIRM = "false";
+      const endpoint = makeEndpoint({
+        method: "delete",
+        path: "/me/messages/:message-id",
+        alias: "delete-mail-message"
+      });
+      const config = makeConfig({
+        pathPattern: "/me/messages/{message-id}",
+        method: "delete",
+        toolName: "delete-mail-message"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ status: 204 }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("delete-mail-message");
+      await tool.handler({ messageId: "abc" });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
+    it("rejects `confirm: false` as not equal to true", async () => {
+      const endpoint = makeEndpoint({
+        method: "patch",
+        path: "/me/messages/:message-id",
+        alias: "update-mail-message"
+      });
+      const config = makeConfig({
+        pathPattern: "/me/messages/{message-id}",
+        method: "patch",
+        toolName: "update-mail-message"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("update-mail-message");
+      const result = await tool.handler({ messageId: "abc", confirm: false });
+      expect(graphClient.graphRequest).not.toHaveBeenCalled();
+      expect(result.isError).toBe(true);
+    });
+    it("exposes confirm in the schema only for destructive tools", async () => {
+      mockEndpoints.push(makeEndpoint());
+      mockEndpointsJson = [makeConfig()];
+      mockEndpoints.push(
+        makeEndpoint({ method: "delete", alias: "destructive-tool", path: "/me/items/:item-id" })
+      );
+      mockEndpointsJson.push(
+        makeConfig({
+          method: "delete",
+          toolName: "destructive-tool",
+          pathPattern: "/me/items/{item-id}"
+        })
+      );
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, createMockGraphClient());
+      expect(server.tools.get("test-tool").schema).not.toHaveProperty("confirm");
+      expect(server.tools.get("destructive-tool").schema).toHaveProperty("confirm");
+    });
+  });
+  describe("isDestructiveOperation", () => {
+    it("returns true for POST, PATCH, PUT, DELETE", async () => {
+      const { isDestructiveOperation } = await loadModule();
+      expect(isDestructiveOperation("POST", void 0)).toBe(true);
+      expect(isDestructiveOperation("PATCH", void 0)).toBe(true);
+      expect(isDestructiveOperation("PUT", void 0)).toBe(true);
+      expect(isDestructiveOperation("DELETE", void 0)).toBe(true);
+    });
+    it("is case-insensitive", async () => {
+      const { isDestructiveOperation } = await loadModule();
+      expect(isDestructiveOperation("delete", void 0)).toBe(true);
+      expect(isDestructiveOperation("Patch", void 0)).toBe(true);
+    });
+    it("returns false for GET / HEAD / OPTIONS", async () => {
+      const { isDestructiveOperation } = await loadModule();
+      expect(isDestructiveOperation("GET", void 0)).toBe(false);
+      expect(isDestructiveOperation("HEAD", void 0)).toBe(false);
+      expect(isDestructiveOperation("OPTIONS", void 0)).toBe(false);
+    });
+    it("returns false for POST endpoints flagged readOnly", async () => {
+      const { isDestructiveOperation } = await loadModule();
+      expect(isDestructiveOperation("POST", { readOnly: true })).toBe(false);
+    });
+    it("still returns true for PATCH/DELETE even if config.readOnly is set (should not happen but defensive)", async () => {
+      const { isDestructiveOperation } = await loadModule();
+      expect(isDestructiveOperation("PATCH", { readOnly: true })).toBe(true);
+      expect(isDestructiveOperation("DELETE", { readOnly: true })).toBe(true);
+    });
+  });
 });

package/dist/auth.js

@@ -31,6 +31,36 @@ function createMsalConfig(secrets) {
     }
   };
 }
+function buildDiskCoherencyCachePlugin(storage) {
+  return {
+    beforeCacheAccess: async (context) => {
+      try {
+        const cacheRaw = await storage.load("token-cache");
+        if (cacheRaw) {
+          context.tokenCache.deserialize(unwrapCache(cacheRaw).data);
+        }
+      } catch (error) {
+        logger.error(`Error reloading token cache: ${error.message}`);
+        if (storage.failClosed) {
+          throw error;
+        }
+      }
+    },
+    afterCacheAccess: async (context) => {
+      if (!context.cacheHasChanged) {
+        return;
+      }
+      try {
+        await storage.save("token-cache", wrapCache(context.tokenCache.serialize()));
+      } catch (error) {
+        logger.error(`Error saving token cache: ${error.message}`);
+        if (storage.failClosed) {
+          throw error;
+        }
+      }
+    }
+  };
+}
 const SCOPE_HIERARCHY = {
   "Mail.ReadWrite": ["Mail.Read"],
   "Calendars.ReadWrite": ["Calendars.Read"],
@@ -312,8 +342,15 @@ function consumersAuthorityHint(error, account, authority) {
 class AuthManager {
   constructor(config, scopes = [], expectedAccount, storage) {
     logger.info(`And scopes are ${scopes.join(", ")}`, scopes);
-    this.config = config;
     this.scopes = scopes;
+    this.storage = storage ?? new DefaultTokenCacheStorage();
+    this.config = {
+      ...config,
+      cache: {
+        ...config.cache,
+        cachePlugin: buildDiskCoherencyCachePlugin(this.storage)
+      }
+    };
     this.msalApp = new PublicClientApplication(this.config);
     this.accessToken = null;
     this.tokenExpiry = null;
@@ -323,7 +360,6 @@ class AuthManager {
     this.expectedHomeAccountId = this.normalizeExpectedHomeAccountId(
       expectedAccount?.expectedHomeAccountId
     );
-    this.storage = storage ?? new DefaultTokenCacheStorage();
     const oauthTokenFromEnv = process.env.MS365_MCP_OAUTH_TOKEN;
     this.oauthToken = oauthTokenFromEnv ?? null;
     this.isOAuthMode = oauthTokenFromEnv != null;
@@ -367,17 +403,6 @@ class AuthManager {
       }
     }
   }
-  async saveTokenCache() {
-    try {
-      const stamped = wrapCache(this.msalApp.getTokenCache().serialize());
-      await this.storage.save("token-cache", stamped);
-    } catch (error) {
-      logger.error(`Error saving token cache: ${error.message}`);
-      if (this.storage.failClosed) {
-        throw error;
-      }
-    }
-  }
   async saveSelectedAccount() {
     try {
       const stamped = wrapCache(JSON.stringify({ accountId: this.selectedAccountId }));
@@ -491,7 +516,10 @@ class AuthManager {
       try {
         await this.msalApp.getTokenCache().removeAccount(account);
       } catch (error) {
-        logger.warn(`Failed to remove unexpected account from cache: ${error.message}`);
+        logger.error(`Failed to remove unexpected account from cache: ${error.message}`);
+        throw new Error(
+          `Authenticated Microsoft account '${this.describeAccount(account)}' does not match expected Microsoft account '${this.expectedAccountLabel()}', and it could not be removed from the token cache (${error.message}). Its tokens may remain persisted - run --logout to clear the cache, then re-login.`
+        );
       }
       throw new Error(
         `Authenticated Microsoft account '${this.describeAccount(account)}' does not match expected Microsoft account '${this.expectedAccountLabel()}'. Login was not persisted.`
@@ -522,7 +550,6 @@ class AuthManager {
         const response = await this.msalApp.acquireTokenSilent(silentRequest);
         this.accessToken = response.accessToken;
         this.tokenExpiry = response.expiresOn ? new Date(response.expiresOn).getTime() : null;
-        await this.saveTokenCache();
         return this.accessToken;
       } catch (error) {
         const hint = consumersAuthorityHint(error, currentAccount, this.config.auth.authority);
@@ -584,7 +611,6 @@ class AuthManager {
         await this.saveSelectedAccount();
         logger.info(`Auto-selected new account: ${response.account.username}`);
       }
-      await this.saveTokenCache();
       return this.accessToken;
     } catch (error) {
       logger.error(`Error in device code flow: ${error.message}`);
@@ -626,7 +652,6 @@ class AuthManager {
         await this.saveSelectedAccount();
         logger.info(`Auto-selected new account: ${response.account.username}`);
       }
-      await this.saveTokenCache();
       return this.accessToken;
     } catch (error) {
       logger.error(`Error in interactive browser flow: ${error.message}`);
@@ -842,7 +867,6 @@ class AuthManager {
     };
     try {
       const response = await this.msalApp.acquireTokenSilent(silentRequest);
-      await this.saveTokenCache();
       return response.accessToken;
     } catch (error) {
       const hint = consumersAuthorityHint(error, targetAccount, this.config.auth.authority);
@@ -858,6 +882,7 @@ class AuthManager {
 var auth_default = AuthManager;
 export {
   buildAllowedScopeDiagnostics,
+  buildDiskCoherencyCachePlugin,
   buildScopeDiagnostics,
   buildScopesFromEndpoints,
   collapseScopeHierarchy,

package/dist/cli.js

@@ -40,7 +40,7 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
   "Enable OAuth Dynamic Client Registration endpoint (kept for backwards compatibility, now enabled by default in HTTP mode)"
 ).option(
   "--no-dynamic-registration",
-  "Disable OAuth Dynamic Client Registration endpoint in HTTP mode"
+  "Disable OAuth Dynamic Client Registration endpoint in HTTP mode. Equivalent env var: MS365_MCP_DISABLE_DCR=true."
 ).option(
   "--auth-browser",
   "Use browser-based interactive OAuth flow instead of device code for stdio mode. Opens system browser with localhost callback for seamless sign-in."
@@ -158,7 +158,8 @@ function parseArgs() {
     options.toon = true;
   }
   if (options.http) {
-    if (options.dynamicRegistration === false) {
+    const dcrDisabledByEnv = process.env.MS365_MCP_DISABLE_DCR === "true" || process.env.MS365_MCP_DISABLE_DCR === "1";
+    if (options.dynamicRegistration === false || dcrDisabledByEnv) {
       options.enableDynamicRegistration = false;
     } else {
       options.enableDynamicRegistration = true;

package/dist/endpoints.json

@@ -1766,6 +1766,7 @@
     "method": "post",
     "toolName": "search-query",
     "presets": ["personal", "search", "work"],
+    "readOnly": true,
     "workScopes": [
       "Mail.Read",
       "Calendars.Read",
@@ -1976,6 +1977,7 @@
     "method": "post",
     "toolName": "get-presences-by-user-id",
     "presets": ["teams", "work"],
+    "readOnly": true,
     "workScopes": ["Presence.Read.All"],
     "contentType": "application/json",
     "llmTip": "Gets presence for multiple users in a single call. Body: { ids: ['user-id-1', 'user-id-2', ...] }. Returns array of presence objects. More efficient than calling get-user-presence for each user. Maximum 650 user IDs per request."
@@ -2259,6 +2261,7 @@
     "method": "post",
     "toolName": "get-mail-tips",
     "presets": ["mail", "outlook", "personal"],
+    "readOnly": true,
     "scopes": ["Mail.Read"],
     "contentType": "application/json",
     "llmTip": "Looks up MailTips for one or more recipients before sending an email — answers 'is this person on auto-reply / OOF?', 'will my email exceed their mailbox quota?', 'are they an external recipient?', 'is this a mailbox or distribution list?'. Body: { EmailAddresses: ['user@contoso.com', ...], MailTipsOptions: 'automaticReplies, mailboxFullStatus, customMailTip, externalMemberCount, totalMemberCount, maxMessageSize, deliveryRestriction, moderationStatus, recipientScope, recipientSuggestions' (comma-separated subset) }. Returns mailTips per recipient with the requested fields populated. Use this to short-circuit urgent emails when a recipient is OOF, or to warn before fanning out to a large DL."
@@ -2429,6 +2432,7 @@
     "method": "post",
     "toolName": "get-onenote-notebook-from-web-url",
     "presets": ["onenote", "personal"],
+    "readOnly": true,
     "workScopes": ["Notes.Read"],
     "contentType": "application/json",
     "llmTip": "Resolves a OneNote notebook from its web URL (the link a user copies from OneNote / SharePoint / Teams). Body: { webUrl: 'https://...' }. Returns a notebook object with id, displayName, sectionsUrl, sectionGroupsUrl, and isShared — you can then list its sections via list-onenote-notebook-sections. Accepts user notebooks, group notebooks, and SharePoint-hosted team notebooks. Personal Microsoft accounts are not supported."

package/dist/generated/client.js

@@ -291,7 +291,7 @@ const microsoft_graph_chatMessage = z.lazy(
     deletedDateTime: z.string().regex(
       /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
     ).datetime({ offset: true }).describe(
-      "Read only. Timestamp at which the chat message was deleted, or null if not deleted."
+      "Read-only. Timestamp at which the chat message was deleted, or null if not deleted."
     ).nullish(),
     etag: z.string().describe("Read-only. Version number of the chat message.").nullish(),
     eventDetail: microsoft_graph_eventMessageDetail.optional(),
@@ -300,12 +300,12 @@ const microsoft_graph_chatMessage = z.lazy(
     lastEditedDateTime: z.string().regex(
       /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
     ).datetime({ offset: true }).describe(
-      "Read only. Timestamp when edits to the chat message were made. Triggers an 'Edited' flag in the Teams UI. If no edits are made the value is null."
+      "Read-only. Timestamp when edits to the chat message were made. Triggers an 'Edited' flag in the Teams UI. If no edits are made the value is null."
     ).nullish(),
     lastModifiedDateTime: z.string().regex(
       /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
     ).datetime({ offset: true }).describe(
-      "Read only. Timestamp when the chat message is created (initial setting) or modified, including when a reaction is added or removed."
+      "Read-only. Timestamp when the chat message is created (initial setting) or modified, including when a reaction is added or removed."
     ).nullish(),
     locale: z.string().describe("Locale of the chat message set by the client. Always set to en-us.").optional(),
     mentions: z.array(microsoft_graph_chatMessageMention).describe(
@@ -373,7 +373,7 @@ const microsoft_graph_targetedChatMessage = z.object({
   lastModifiedDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
-    "Read only. Timestamp when the chat message is created (initial setting) or modified, including when a reaction is added or removed."
+    "Read-only. Timestamp when the chat message is created (initial setting) or modified, including when a reaction is added or removed."
   ).nullish(),
   body: microsoft_graph_itemBody.optional(),
   subject: z.string().describe("The subject of the chat message, in plaintext.").nullish(),
@@ -385,14 +385,14 @@ const microsoft_graph_targetedChatMessage = z.object({
   deletedDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
-    "Read only. Timestamp at which the chat message was deleted, or null if not deleted."
+    "Read-only. Timestamp at which the chat message was deleted, or null if not deleted."
   ).nullish(),
   etag: z.string().describe("Read-only. Version number of the chat message.").nullish(),
   eventDetail: microsoft_graph_eventMessageDetail.optional(),
   lastEditedDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
-    "Read only. Timestamp when edits to the chat message were made. Triggers an 'Edited' flag in the Teams UI. If no edits are made the value is null."
+    "Read-only. Timestamp when edits to the chat message were made. Triggers an 'Edited' flag in the Teams UI. If no edits are made the value is null."
   ).nullish(),
   locale: z.string().describe("Locale of the chat message set by the client. Always set to en-us.").optional(),
   mentions: z.array(microsoft_graph_chatMessageMention).describe(
@@ -675,7 +675,7 @@ const microsoft_graph_user = z.object({
     "The state or province in the user's address. Maximum length is 128 characters. Requires $select to retrieve. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values)."
   ).nullish(),
   userPrincipalName: z.string().describe(
-    "The user principal name (UPN) of the user. The UPN is an Internet-style sign-in name for the user based on the Internet standard RFC 822. By convention, this value should map to the user's email name. The general format is alias@domain, where the domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.NOTE: This property can't contain accent characters. Only the following characters are allowed A - Z, a - z, 0 - 9, ' . - _ ! # ^ ~. For the complete list of allowed characters, see username policies. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, endsWith) and $orderby."
+    "The user principal name (UPN) of the user. The UPN is an Internet-style sign-in name for the user based on the Internet standard RFC 822. By convention, this value should map to the user's email name. The general format is alias@domain, where the domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.NOTE: This property can't contain accent characters. Only the following characters are allowed A - Z, a - z, 0 - 9, ' . - _ ! # ^ ~. For the complete list of allowed characters, see username policies. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, endsWith) and $orderby. This property is subject to sensitive action restrictions; only specific privileged administrator roles can update it."
   ).nullish(),
   deletedDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
@@ -686,7 +686,7 @@ const microsoft_graph_user = z.object({
     "A freeform text entry field for the user to describe themselves. Requires $select to retrieve."
   ).nullish(),
   accountEnabled: z.boolean().describe(
-    "true if the account is enabled; otherwise, false. This property is required when a user is created. Requires $select to retrieve. Supports $filter (eq, ne, not, and in)."
+    "true if the account is enabled; otherwise, false. This property is required when a user is created. Requires $select to retrieve. Supports $filter (eq, ne, not, and in). This property is subject to sensitive action restrictions; only specific privileged administrator roles can update it."
   ).nullish(),
   ageGroup: z.string().describe(
     "Sets the age group of the user. Allowed values: null, Minor, NotAdult, and Adult. For more information, see legal age group property definitions. Requires $select to retrieve. Supports $filter (eq, ne, not, and in)."
@@ -704,7 +704,7 @@ const microsoft_graph_user = z.object({
     "The birthday of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. Requires $select to retrieve."
   ).optional(),
   businessPhones: z.array(z.string()).describe(
-    "The telephone numbers for the user. NOTE: Although it's a string collection, only one number can be set for this property. Read-only for users synced from the on-premises directory. Returned by default. Supports $filter (eq, not, ge, le, startsWith)."
+    "The telephone numbers for the user. NOTE: Although it's a string collection, only one number can be set for this property. Read-only for users synced from the on-premises directory. Returned by default. Supports $filter (eq, not, ge, le, startsWith). This property is subject to sensitive action restrictions; only specific privileged administrator roles can update it."
   ).optional(),
   city: z.string().describe(
     "The city where the user is located. Maximum length is 128 characters. Requires $select to retrieve. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values)."
@@ -1578,6 +1578,13 @@ const microsoft_graph_workbookRange = z.object({
   worksheet: microsoft_graph_workbookWorksheet.optional()
 }).passthrough();
 const create_excel_table_Body = z.object({ address: z.string().nullable(), hasHeaders: z.boolean().default(false) }).partial().passthrough();
+const microsoft_graph_groupAccessType = z.enum([
+  "none",
+  "private",
+  "secret",
+  "public",
+  "unknownFutureValue"
+]);
 const microsoft_graph_assignedLabel = z.object({
   displayName: z.string().describe("The display name of the label. Read-only.").nullish(),
   labelId: z.string().describe("The unique identifier of the label.").nullish()
@@ -1601,6 +1608,7 @@ const microsoft_graph_group = z.object({
   ).datetime({ offset: true }).describe(
     "Date and time when this object was deleted. Always null when the object hasn't been deleted."
   ).nullish(),
+  accessType: microsoft_graph_groupAccessType.optional(),
   allowExternalSenders: z.boolean().describe(
     "Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
   ).nullish(),
@@ -1640,6 +1648,9 @@ const microsoft_graph_group = z.object({
   isAssignableToRole: z.boolean().describe(
     "Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true, visibility must be Hidden, and the group can't be a dynamic group (that is, groupTypes can't contain DynamicMembership). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignmentsUsing this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports $filter (eq, ne, not)."
   ).nullish(),
+  isFavorite: z.boolean().describe(
+    "Indicates whether the user marked the group as favorite. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
+  ).nullish(),
   isManagementRestricted: z.boolean().describe(
     "Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is null and the default behavior is false. Read-only.  To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Requires $select to retrieve."
   ).nullish(),
@@ -1652,12 +1663,6 @@ const microsoft_graph_group = z.object({
   ).nullish(),
   mailEnabled: z.boolean().describe(
     "Specifies whether the group is mail-enabled. Required. Returned by default. Supports $filter (eq, ne, not)."
-  ).nullish(),
-  mailNickname: z.string().describe(
-    "The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: @ () / [] ' ; : <> , SPACE. Required. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values)."
-  ).nullish(),
-  membershipRule: z.string().describe(
-    "The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith)."
   ).nullish()
 }).passthrough().passthrough();
 const microsoft_graph_groupCollectionResponse = z.object({
@@ -2895,7 +2900,7 @@ const microsoft_graph_channel = z.lazy(
     id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
     createdDateTime: z.string().regex(
       /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
-    ).datetime({ offset: true }).describe("Read only. Timestamp at which the channel was created.").nullish(),
+    ).datetime({ offset: true }).describe("Read-only. Timestamp at which the channel was created.").nullish(),
     description: z.string().describe("Optional textual description for the channel.").nullish(),
     displayName: z.string().describe(
       "Channel name as it will appear to the user in Microsoft Teams. The maximum length is 50 characters."
@@ -3007,7 +3012,7 @@ const microsoft_graph_team = z.lazy(
     ).nullish(),
     allChannels: z.array(microsoft_graph_channel).describe("List of channels either hosted in or shared with the team (incoming channels).").optional(),
     channels: z.array(microsoft_graph_channel).describe("The collection of channels and messages associated with the team.").optional(),
-    group: microsoft_graph_group.describe("[Note: Simplified from 75 properties to 25 most common ones]").optional(),
+    group: microsoft_graph_group.describe("[Note: Simplified from 80 properties to 25 most common ones]").optional(),
     incomingChannels: z.array(microsoft_graph_channel).describe("List of channels shared with the team.").optional(),
     installedApps: z.array(microsoft_graph_teamsAppInstallation).describe("The apps installed in this team.").optional(),
     members: z.array(microsoft_graph_conversationMember).describe("Members and owners of the team.").optional(),
@@ -4973,6 +4978,7 @@ const schemas = {
   microsoft_graph_workbookRangeFormat,
   microsoft_graph_workbookRange,
   create_excel_table_Body,
+  microsoft_graph_groupAccessType,
   microsoft_graph_assignedLabel,
   microsoft_graph_licenseProcessingState,
   microsoft_graph_group,
@@ -6860,6 +6866,7 @@ You can search within a folder hierarchy, a whole drive, or files shared with th
           ).datetime({ offset: true }).describe(
             "Date and time when this object was deleted. Always null when the object hasn't been deleted."
           ).nullish(),
+          accessType: microsoft_graph_groupAccessType.optional(),
           allowExternalSenders: z.boolean().describe(
             "Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
           ).nullish(),
@@ -6899,6 +6906,9 @@ You can search within a folder hierarchy, a whole drive, or files shared with th
           isAssignableToRole: z.boolean().describe(
             "Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true, visibility must be Hidden, and the group can't be a dynamic group (that is, groupTypes can't contain DynamicMembership). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignmentsUsing this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports $filter (eq, ne, not)."
           ).nullish(),
+          isFavorite: z.boolean().describe(
+            "Indicates whether the user marked the group as favorite. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
+          ).nullish(),
           isManagementRestricted: z.boolean().describe(
             "Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is null and the default behavior is false. Read-only.  To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Requires $select to retrieve."
           ).nullish(),
@@ -6911,12 +6921,6 @@ You can search within a folder hierarchy, a whole drive, or files shared with th
           ).nullish(),
           mailEnabled: z.boolean().describe(
             "Specifies whether the group is mail-enabled. Required. Returned by default. Supports $filter (eq, ne, not)."
-          ).nullish(),
-          mailNickname: z.string().describe(
-            "The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: @ () / [] ' ; : <> , SPACE. Required. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values)."
-          ).nullish(),
-          membershipRule: z.string().describe(
-            "The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith)."
           ).nullish()
         }).passthrough().passthrough()
       }
@@ -6973,6 +6977,7 @@ You can create or update the following types of group: By default, this operatio
           ).datetime({ offset: true }).describe(
             "Date and time when this object was deleted. Always null when the object hasn't been deleted."
           ).nullish(),
+          accessType: microsoft_graph_groupAccessType.optional(),
           allowExternalSenders: z.boolean().describe(
             "Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
           ).nullish(),
@@ -7012,6 +7017,9 @@ You can create or update the following types of group: By default, this operatio
           isAssignableToRole: z.boolean().describe(
             "Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true, visibility must be Hidden, and the group can't be a dynamic group (that is, groupTypes can't contain DynamicMembership). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignmentsUsing this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports $filter (eq, ne, not)."
           ).nullish(),
+          isFavorite: z.boolean().describe(
+            "Indicates whether the user marked the group as favorite. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
+          ).nullish(),
           isManagementRestricted: z.boolean().describe(
             "Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is null and the default behavior is false. Read-only.  To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Requires $select to retrieve."
           ).nullish(),
@@ -7024,12 +7032,6 @@ You can create or update the following types of group: By default, this operatio
           ).nullish(),
           mailEnabled: z.boolean().describe(
             "Specifies whether the group is mail-enabled. Required. Returned by default. Supports $filter (eq, ne, not)."
-          ).nullish(),
-          mailNickname: z.string().describe(
-            "The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: @ () / [] ' ; : <> , SPACE. Required. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values)."
-          ).nullish(),
-          membershipRule: z.string().describe(
-            "The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith)."
           ).nullish()
         }).passthrough().passthrough()
       }
@@ -9320,7 +9322,7 @@ be returned for more than one recipient at one time. The requested MailTips are
     method: "get",
     path: "/me/inferenceClassification/overrides",
     alias: "list-focused-inbox-overrides",
-    description: `Get the overrides that a user has set up to always classify messages from certain senders in specific ways. Each override corresponds to an SMTP address of a sender. Initially, a user does not have any overrides.`,
+    description: `Get the overrides that a user has set up to always classify messages from certain senders in specific ways. Each override corresponds to an SMTP address of a sender. Initially, a user doesn't have any overrides.`,
     requestFormat: "json",
     parameters: [
       {
@@ -9555,7 +9557,7 @@ the new SMTP address is the only way to 'update' the override for this sender.`,
     method: "get",
     path: "/me/mailFolders",
     alias: "list-mail-folders",
-    description: `Get the mail folder collection directly under the root folder of the signed-in user. The returned collection includes any mail search folders directly under the root. By default, this operation does not return hidden folders. Use a query parameter includeHiddenFolders to include them in the response. This operation does not return all mail folders in a mailbox, only the child folders of the root folder. To return all mail folders in a mailbox, each child folder must be traversed separately.`,
+    description: `Get the mail folder collection directly under the root folder of the signed-in user. The returned collection includes any mail search folders directly under the root. By default, this operation doesn't return hidden folders. Use a query parameter includeHiddenFolders to include them in the response. This operation doesn't return all mail folders in a mailbox, only the child folders of the root folder. To return all mail folders in a mailbox, each child folder must be traversed separately.`,
     requestFormat: "json",
     parameters: [
       {
@@ -9658,7 +9660,7 @@ the new SMTP address is the only way to 'update' the override for this sender.`,
     path: "/me/mailFolders/:mailFolderId/childFolders",
     alias: "list-mail-child-folders",
     description: `Get the folder collection under the specified folder. You can use the .../me/mailFolders shortcut to get the top-level
-folder collection and navigate to another folder. By default, this operation does not return hidden folders. Use a query parameter includeHiddenFolders to include them in the response.`,
+folder collection and navigate to another folder. By default, this operation doesn't return hidden folders. Use a query parameter includeHiddenFolders to include them in the response.`,
     requestFormat: "json",
     parameters: [
       {

package/dist/graph-tools.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "crypto";
 import logger from "./logger.js";
 import { auditLog, getUserIdentityForAudit } from "./audit-log.js";
+import { isDestructiveOperation } from "./lib/destructive-ops.js";
 import {
   getEndpointScopeGroups,
   getMissingAllowedScopesForGroups,
@@ -67,6 +68,9 @@ function paginationAllowed() {
   if (raw === void 0 || raw === "") return true;
   return !/^(0|false|no)$/i.test(raw.trim());
 }
+function isConfirmGateEnabled() {
+  return process.env.MS365_MCP_REQUIRE_CONFIRM === "true";
+}
 function formatDisabledToolsForLog(disabledTools) {
   const shown = disabledTools.slice(0, 20).map((tool) => `${tool.toolName} (missing: ${tool.missingScopes.join(", ")})`);
   const suffix = disabledTools.length > shown.length ? `, ... +${disabledTools.length - shown.length} more` : "";
@@ -390,6 +394,26 @@ function registerUtilityToolWithMcp(server, utility, ctx) {
 }
 async function executeGraphTool(tool, config, graphClient, params, authManager) {
   logger.info(`Tool ${tool.alias} called with params: ${JSON.stringify(params)}`);
+  if (isConfirmGateEnabled() && isDestructiveOperation(tool.method, config) && params.confirm !== true) {
+    logger.warn(
+      `Refusing destructive tool ${tool.alias} (${tool.method.toUpperCase()}): missing confirm: true`
+    );
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify({
+            error: "confirmation_required",
+            tool: tool.alias,
+            method: tool.method.toUpperCase(),
+            destructive: true,
+            message: 'This tool modifies user data. Re-call with parameter "confirm": true after the user has explicitly approved the operation.'
+          })
+        }
+      ],
+      isError: true
+    };
+  }
   const requestId = randomUUID();
   const startTime = Date.now();
   const upn = getUserIdentityForAudit(getRequestTokens()?.accessToken);
@@ -427,6 +451,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
     for (const [paramName, paramValue] of Object.entries(params)) {
       if ([
         "account",
+        "confirm",
         "fetchAllPages",
         "includeHeaders",
         "excludeResponse",
@@ -815,6 +840,12 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
     }
     paramSchema["includeHeaders"] = z.boolean().describe("Include response headers (including ETag) in the response metadata").optional();
     paramSchema["excludeResponse"] = z.boolean().describe("Exclude the full response body and only return success or failure indication").optional();
+    const destructive = isDestructiveOperation(tool.method, endpointConfig);
+    if (destructive) {
+      paramSchema["confirm"] = z.boolean().describe(
+        'For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly approved this action. When the gate is on, calls without confirm: true return { error: "confirmation_required" } without touching user data.'
+      ).optional();
+    }
     if (endpointConfig?.supportsTimezone) {
       paramSchema["timezone"] = z.string().describe(
         'IANA timezone name (e.g., "America/New_York", "Europe/London", "Asia/Tokyo") for calendar event times. If not specified, times are returned in UTC.'
@@ -843,7 +874,7 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
         {
           title: tool.alias,
           readOnlyHint: isReadOnlyTool,
-          destructiveHint: !isReadOnlyTool && ["POST", "PATCH", "DELETE"].includes(tool.method.toUpperCase()),
+          destructiveHint: destructive,
           openWorldHint: true
           // All tools call Microsoft Graph API
         },
@@ -1117,11 +1148,7 @@ function registerDiscoveryTools(server, graphClient, readOnly = false, orgMode =
     async ({ tool_name }) => {
       const entry = toolsRegistry.get(tool_name);
       if (entry) {
-        const schema = describeToolSchema(
-          entry.tool,
-          entry.config?.llmTip,
-          entry.config?.descriptionOverride
-        );
+        const schema = describeToolSchema(entry.tool, entry.config);
         return {
           content: [{ type: "text", text: JSON.stringify(schema, null, 2) }]
         };
@@ -1196,6 +1223,7 @@ export {
   UTILITY_TOOLS,
   buildDiscoverySearchIndex,
   buildToolsRegistry,
+  isDestructiveOperation,
   registerDiscoveryTools,
   registerGraphTools,
   scoreDiscoveryQuery

package/dist/lib/destructive-ops.js

@@ -0,0 +1,9 @@
+function isDestructiveOperation(method, config) {
+  const upper = method.toUpperCase();
+  if (!["POST", "PATCH", "PUT", "DELETE"].includes(upper)) return false;
+  if (upper === "POST" && config?.readOnly) return false;
+  return true;
+}
+export {
+  isDestructiveOperation
+};

package/dist/lib/tool-schema.js

@@ -1,4 +1,5 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
+import { isDestructiveOperation } from "./destructive-ops.js";
 function unwrapOptional(schema) {
   const def = schema._def;
   const typeName = def?.typeName;
@@ -7,7 +8,7 @@ function unwrapOptional(schema) {
   }
   return { inner: schema, optional: false };
 }
-function describeToolSchema(tool, llmTip, descriptionOverride) {
+function describeToolSchema(tool, config) {
   const params = (tool.parameters ?? []).map((p) => {
     const { inner, optional } = unwrapOptional(p.schema);
     const isPath = p.type === "Path";
@@ -21,11 +22,21 @@ function describeToolSchema(tool, llmTip, descriptionOverride) {
       schema
     };
   });
+  if (isDestructiveOperation(tool.method, config)) {
+    params.push({
+      name: "confirm",
+      in: "Query",
+      required: false,
+      description: 'For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly approved this action. When the gate is on, calls without confirm: true return { error: "confirmation_required" } without touching user data.',
+      schema: { type: "boolean" }
+    });
+  }
+  const llmTip = config?.llmTip;
   return {
     name: tool.alias,
     method: tool.method.toUpperCase(),
     path: tool.path,
-    description: descriptionOverride ?? tool.description ?? "",
+    description: config?.descriptionOverride ?? tool.description ?? "",
     ...llmTip ? { llmTip } : {},
     parameters: params
   };

package/docs/deployment.md

@@ -212,8 +212,10 @@ The client automatically discovers OAuth endpoints and opens a browser for authe
 - **Read-only mode**: use `--read-only` to disable all write operations (send, delete, update, create)
 - **Tool filtering**: use `--enabled-tools <regex>` or `--preset <names>` to restrict available tools
 - **CORS**: configure `MS365_MCP_CORS_ORIGIN` to restrict allowed origins (defaults to `http://localhost:3000`); set explicitly when clients run on a different origin
+- **Disable Dynamic Client Registration**: when only a known client talks to the server, set `MS365_MCP_DISABLE_DCR=true` (or pass `--no-dynamic-registration`) to close the anonymous `/register` endpoint
 - **Structured audit log**: enabled by default. Every tool invocation emits one JSON line on stdout (captured by the container platform's log collector) and to `~/.ms-365-mcp-server/logs/audit.log` (mode `0o600`) with `{ event, request_id, user_principal_name, tool, http_method, status, duration_ms, error_type?, error_code? }`. The schema is intentionally narrow — tool parameters and Graph response bodies are NEVER recorded, and error messages are reduced to `error_type` / `error_code` so upstream library errors do not leak token fragments or query-string PII. Forms the "who accessed what, when" trail required for GDPR / HIPAA / PIPEDA / SOC 2 audit. Opt-out: `MS365_MCP_AUDIT_LOG=false`
 - **Graph resilience**: every call to Microsoft Graph is wrapped with a fetch timeout (default 100 s via `MS365_MCP_GRAPH_TIMEOUT_MS`), retry-with-backoff on 429 / 503 / 504 / network errors (default 3 retries, full-jitter exponential backoff, honours `Retry-After`; 503 / 504 / network errors only retried for idempotent methods, 429 retried on all methods), and a process-wide circuit breaker that opens after 5 consecutive failures and cools down for 30 s (`MS365_MCP_GRAPH_CIRCUIT_THRESHOLD` / `MS365_MCP_GRAPH_CIRCUIT_COOLDOWN_MS`). Disable the breaker for trusted automation: `MS365_MCP_GRAPH_CIRCUIT_DISABLED=true`
+- **Confirm gate on destructive tools**: opt-in, **off by default**. Enable with `MS365_MCP_REQUIRE_CONFIRM=true`. When on, destructive tools (POST except `readOnly`, PATCH, PUT, DELETE — `delete-mail-message`, `send-mail`, `update-event`, etc.) return `{ "error": "confirmation_required" }` until the caller re-invokes them with `"confirm": true`. Mitigates accidental writes when an LLM misroutes a request or follows an injected instruction. Shipped opt-in so it is a non-breaking, additive layer that can coexist with client-side elicitation prompts (MCP Elicitation API) where the client supports them.
 
 ## Exposed Endpoints
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.128.1",
+  "version": "0.129.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -1766,6 +1766,7 @@
     "method": "post",
     "toolName": "search-query",
     "presets": ["personal", "search", "work"],
+    "readOnly": true,
     "workScopes": [
       "Mail.Read",
       "Calendars.Read",
@@ -1976,6 +1977,7 @@
     "method": "post",
     "toolName": "get-presences-by-user-id",
     "presets": ["teams", "work"],
+    "readOnly": true,
     "workScopes": ["Presence.Read.All"],
     "contentType": "application/json",
     "llmTip": "Gets presence for multiple users in a single call. Body: { ids: ['user-id-1', 'user-id-2', ...] }. Returns array of presence objects. More efficient than calling get-user-presence for each user. Maximum 650 user IDs per request."
@@ -2259,6 +2261,7 @@
     "method": "post",
     "toolName": "get-mail-tips",
     "presets": ["mail", "outlook", "personal"],
+    "readOnly": true,
     "scopes": ["Mail.Read"],
     "contentType": "application/json",
     "llmTip": "Looks up MailTips for one or more recipients before sending an email — answers 'is this person on auto-reply / OOF?', 'will my email exceed their mailbox quota?', 'are they an external recipient?', 'is this a mailbox or distribution list?'. Body: { EmailAddresses: ['user@contoso.com', ...], MailTipsOptions: 'automaticReplies, mailboxFullStatus, customMailTip, externalMemberCount, totalMemberCount, maxMessageSize, deliveryRestriction, moderationStatus, recipientScope, recipientSuggestions' (comma-separated subset) }. Returns mailTips per recipient with the requested fields populated. Use this to short-circuit urgent emails when a recipient is OOF, or to warn before fanning out to a large DL."
@@ -2429,6 +2432,7 @@
     "method": "post",
     "toolName": "get-onenote-notebook-from-web-url",
     "presets": ["onenote", "personal"],
+    "readOnly": true,
     "workScopes": ["Notes.Read"],
     "contentType": "application/json",
     "llmTip": "Resolves a OneNote notebook from its web URL (the link a user copies from OneNote / SharePoint / Teams). Body: { webUrl: 'https://...' }. Returns a notebook object with id, displayName, sectionsUrl, sectionGroupsUrl, and isShared — you can then list its sections via list-onenote-notebook-sections. Accepts user notebooks, group notebooks, and SharePoint-hosted team notebooks. Personal Microsoft accounts are not supported."