@softeria/ms-365-mcp-server 0.129.0 → 0.130.0

package/dist/__tests__/graph-tools.test.js

@@ -62,7 +62,7 @@ function makeConfig(overrides = {}) {
     ...overrides
   };
 }
-function createMockGraphClient(responses) {
+function createMockGraphClient(responses, outputFormat = "json") {
   const responseQueue = [...responses || []];
   return {
     graphRequest: vi.fn().mockImplementation(async () => {
@@ -72,7 +72,12 @@ function createMockGraphClient(responses) {
       return {
         content: [{ type: "text", text: JSON.stringify({ value: [] }) }]
       };
-    })
+    }),
+    // Fake serialize: prefix the JSON in toon mode so a test can tell the merged
+    // body went through serialize() and not a plain JSON.stringify.
+    serialize: vi.fn().mockImplementation(
+      (data) => outputFormat === "toon" ? `TOON:${JSON.stringify(data)}` : JSON.stringify(data)
+    )
   };
 }
 async function loadModule() {
@@ -161,6 +166,61 @@ describe("graph-tools", () => {
       expect(parsed.value.map((v) => v.id)).toEqual(["1", "2", "3"]);
       expect(parsed["@odata.nextLink"]).toBeUndefined();
     });
+    it("merges all pages under --toon and encodes the combined result once (#560)", async () => {
+      const endpoint = makeEndpoint();
+      const config = makeConfig();
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient(
+        [
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "1" }, { id: "2" }],
+                  "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?$skip=2"
+                })
+              }
+            ]
+          },
+          {
+            content: [{ type: "text", text: JSON.stringify({ value: [{ id: "3" }] }) }]
+          }
+        ],
+        "toon"
+      );
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const tool = server.tools.get("test-tool");
+      const result = await tool.handler({ fetchAllPages: true });
+      for (const call of graphClient.graphRequest.mock.calls) {
+        expect(call[1]?.forceJsonOutput).toBe(true);
+      }
+      expect(graphClient.serialize).toHaveBeenCalledTimes(1);
+      expect(result.content[0].text.startsWith("TOON:")).toBe(true);
+      const parsed = JSON.parse(result.content[0].text.slice("TOON:".length));
+      expect(parsed.value.map((v) => v.id)).toEqual(["1", "2", "3"]);
+      expect(parsed["@odata.nextLink"]).toBeUndefined();
+    });
+    it("does not inject value:[] when fetchAllPages hits a single-object (non-collection) GET", async () => {
+      const endpoint = makeEndpoint();
+      const config = makeConfig();
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ id: "abc", displayName: "Solo" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const result = await server.tools.get("test-tool").handler({ fetchAllPages: true });
+      const parsed = JSON.parse(result.content[0].text);
+      expect(parsed).toEqual({ id: "abc", displayName: "Solo" });
+      expect(parsed.value).toBeUndefined();
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
     it("should stop at 100 page limit", async () => {
       const endpoint = makeEndpoint();
       const config = makeConfig();
@@ -712,6 +772,27 @@ describe("graph-tools", () => {
       expect(payload.size).toBe(12727);
       expect(payload.contentType).toBe("application/pdf");
     });
+    it("forces a JSON body on the metadata request so it works under --toon (#560)", async () => {
+      mockEndpoints.length = 0;
+      mockEndpointsJson = [];
+      const graphClient = {
+        graphRequest: vi.fn().mockResolvedValue({
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ "@microsoft.graph.downloadUrl": "https://dl.example/x" })
+            }
+          ]
+        })
+      };
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const result = await server.tools.get("get-download-url").handler({ target: "/drives/d1/items/item1/content" });
+      const [, opts] = graphClient.graphRequest.mock.calls[0];
+      expect(opts?.forceJsonOutput).toBe(true);
+      expect(JSON.parse(result.content[0].text).downloadUrl).toBe("https://dl.example/x");
+    });
     it("rejects query-shaped targets instead of silently changing request semantics", async () => {
       mockEndpoints.length = 0;
       mockEndpointsJson = [];

package/dist/endpoints.json

@@ -1393,6 +1393,13 @@
     "presets": ["teams", "work"],
     "workScopes": ["ChatMessage.Read"]
   },
+  {
+    "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}",
+    "method": "patch",
+    "toolName": "update-chat-message",
+    "presets": ["teams", "work"],
+    "workScopes": ["Chat.ReadWrite"]
+  },
   {
     "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}/hostedContents",
     "method": "get",
@@ -1472,6 +1479,13 @@
     "presets": ["teams", "work"],
     "workScopes": ["ChannelMessage.Read.All"]
   },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}",
+    "method": "patch",
+    "toolName": "update-channel-message",
+    "presets": ["teams", "work"],
+    "workScopes": ["ChannelMessage.ReadWrite"]
+  },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents",
     "method": "get",
@@ -1503,6 +1517,13 @@
     "presets": ["teams", "work"],
     "workScopes": ["ChannelMessage.Read.All"]
   },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/replies/{chatMessage-id1}",
+    "method": "patch",
+    "toolName": "update-channel-message-reply",
+    "presets": ["teams", "work"],
+    "workScopes": ["ChannelMessage.ReadWrite"]
+  },
   {
     "pathPattern": "/teams/{team-id}/members",
     "method": "post",

package/dist/generated/client.js

@@ -1613,7 +1613,7 @@ const microsoft_graph_group = z.object({
     "Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
   ).nullish(),
   assignedLabels: z.array(microsoft_graph_assignedLabel).describe(
-    "The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group. Requires $select to retrieve. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role."
+    "The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group or a cloud security group. Requires a Microsoft Entra ID P1 license. Requires $select to retrieve. This property can be specified during group creation or update. However, for cloud security groups, it's immutable once set. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role. See Key differences from Microsoft 365 group labeling to learn more about managing this property for Microsoft 365 vs. cloud security groups."
   ).optional(),
   assignedLicenses: z.array(microsoft_graph_assignedLicense).describe(
     "The licenses that are assigned to the group. Requires $select to retrieve. Supports $filter (eq). Read-only."
@@ -5497,6 +5497,22 @@ const endpoints = makeApi([
     ],
     response: z.void()
   },
+  {
+    method: "patch",
+    path: "/chats/:chatId/messages/:chatMessageId",
+    alias: "update-chat-message",
+    description: `Update the navigation property messages in chats`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property values`,
+        type: "Body",
+        schema: microsoft_graph_chatMessage
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/chats/:chatId/messages/:chatMessageId/hostedContents",
@@ -6871,7 +6887,7 @@ You can search within a folder hierarchy, a whole drive, or files shared with th
             "Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
           ).nullish(),
           assignedLabels: z.array(microsoft_graph_assignedLabel).describe(
-            "The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group. Requires $select to retrieve. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role."
+            "The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group or a cloud security group. Requires a Microsoft Entra ID P1 license. Requires $select to retrieve. This property can be specified during group creation or update. However, for cloud security groups, it's immutable once set. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role. See Key differences from Microsoft 365 group labeling to learn more about managing this property for Microsoft 365 vs. cloud security groups."
           ).optional(),
           assignedLicenses: z.array(microsoft_graph_assignedLicense).describe(
             "The licenses that are assigned to the group. Requires $select to retrieve. Supports $filter (eq). Read-only."
@@ -6982,7 +6998,7 @@ You can create or update the following types of group: By default, this operatio
             "Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID})."
           ).nullish(),
           assignedLabels: z.array(microsoft_graph_assignedLabel).describe(
-            "The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group. Requires $select to retrieve. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role."
+            "The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group or a cloud security group. Requires a Microsoft Entra ID P1 license. Requires $select to retrieve. This property can be specified during group creation or update. However, for cloud security groups, it's immutable once set. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role. See Key differences from Microsoft 365 group labeling to learn more about managing this property for Microsoft 365 vs. cloud security groups."
           ).optional(),
           assignedLicenses: z.array(microsoft_graph_assignedLicense).describe(
             "The licenses that are assigned to the group. Requires $select to retrieve. Supports $filter (eq). Read-only."
@@ -14109,6 +14125,24 @@ To monitor future changes, call the delta API by using the @odata.deltaLink in t
     ],
     response: z.void()
   },
+  {
+    method: "patch",
+    path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId",
+    alias: "update-channel-message",
+    description: `Update a chatMessage object. 
+Except for the policyViolation property, all properties of a chatMessage can be updated in delegated permissions scenarios.
+Only the policyViolation property of a chatMessage can be updated in application permissions scenarios. The update only works for chats where members are Microsoft Teams users. If one of the participants is using Skype, the operation fails. This method doesn't support federation. Only the user in the tenant who sent the message can perform data loss prevention (DLP) updates on the specified chat message.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property values`,
+        type: "Body",
+        schema: microsoft_graph_chatMessage
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId/hostedContents",
@@ -14225,6 +14259,22 @@ To monitor future changes, call the delta API by using the @odata.deltaLink in t
     ],
     response: z.void()
   },
+  {
+    method: "patch",
+    path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId/replies/:chatMessageId1",
+    alias: "update-channel-message-reply",
+    description: `Update the navigation property replies in teams`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property values`,
+        type: "Body",
+        schema: microsoft_graph_chatMessage
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "post",
     path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId/setReaction",

package/dist/graph-client.js

@@ -133,11 +133,25 @@ class GraphClient {
     }
     return JSON.stringify(data, null, pretty ? 2 : void 0);
   }
+  /**
+   * Encode a value in the configured format (json/toon). The fetchAllPages merge
+   * uses this to encode the combined result once, after parsing pages as JSON (#560).
+   * Compact by default like JSON.stringify, so JSON-mode output is byte-identical.
+   */
+  serialize(data, pretty = false) {
+    return this.serializeData(data, this.outputFormat, pretty);
+  }
   async graphRequest(endpoint, options = {}) {
     try {
       logger.info(`Calling ${endpoint} with options: ${JSON.stringify(options)}`);
       const result = await this.makeRequest(endpoint, options);
-      return this.formatJsonResponse(result, options.rawResponse, options.excludeResponse);
+      const outputFormat = options.forceJsonOutput ? "json" : this.outputFormat;
+      return this.formatJsonResponse(
+        result,
+        options.rawResponse,
+        options.excludeResponse,
+        outputFormat
+      );
     } catch (error) {
       logger.error(`Error in Graph API request: ${error}`);
       return {
@@ -146,10 +160,10 @@ class GraphClient {
       };
     }
   }
-  formatJsonResponse(data, rawResponse = false, excludeResponse = false) {
+  formatJsonResponse(data, rawResponse = false, excludeResponse = false, outputFormat = this.outputFormat) {
     if (excludeResponse) {
       return {
-        content: [{ type: "text", text: this.serializeData({ success: true }, this.outputFormat) }]
+        content: [{ type: "text", text: this.serializeData({ success: true }, outputFormat) }]
       };
     }
     if (data && typeof data === "object" && "_headers" in data) {
@@ -163,17 +177,13 @@ class GraphClient {
       }
       if (rawResponse) {
         return {
-          content: [
-            { type: "text", text: this.serializeData(responseData.data, this.outputFormat) }
-          ],
+          content: [{ type: "text", text: this.serializeData(responseData.data, outputFormat) }],
           _meta: meta
         };
       }
       if (responseData.data === null || responseData.data === void 0) {
         return {
-          content: [
-            { type: "text", text: this.serializeData({ success: true }, this.outputFormat) }
-          ],
+          content: [{ type: "text", text: this.serializeData({ success: true }, outputFormat) }],
           _meta: meta
         };
       }
@@ -191,19 +201,19 @@ class GraphClient {
       removeODataProps2(responseData.data);
       return {
         content: [
-          { type: "text", text: this.serializeData(responseData.data, this.outputFormat, true) }
+          { type: "text", text: this.serializeData(responseData.data, outputFormat, true) }
         ],
         _meta: meta
       };
     }
     if (rawResponse) {
       return {
-        content: [{ type: "text", text: this.serializeData(data, this.outputFormat) }]
+        content: [{ type: "text", text: this.serializeData(data, outputFormat) }]
       };
     }
     if (data === null || data === void 0) {
       return {
-        content: [{ type: "text", text: this.serializeData({ success: true }, this.outputFormat) }]
+        content: [{ type: "text", text: this.serializeData({ success: true }, outputFormat) }]
       };
     }
     const removeODataProps = (obj) => {
@@ -219,7 +229,7 @@ class GraphClient {
     };
     removeODataProps(data);
     return {
-      content: [{ type: "text", text: this.serializeData(data, this.outputFormat, true) }]
+      content: [{ type: "text", text: this.serializeData(data, outputFormat, true) }]
     };
   }
 }

package/dist/graph-tools.js

@@ -328,7 +328,10 @@ const UTILITY_TOOLS = [
           accountAccessToken = await authManager.getTokenForAccount(accountParam);
         }
         const response = await graphClient.graphRequest(itemPath, {
-          accessToken: accountAccessToken
+          accessToken: accountAccessToken,
+          // We JSON.parse the metadata below, so force JSON - under --toon it'd be
+          // TOON and the parse would fail, masking a real item as "no download url".
+          forceJsonOutput: true
         });
         if (response?.isError) {
           return response;
@@ -612,7 +615,6 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
     logger.info(
       `Making graph request to ${path2} with options: ${JSON.stringify(safeOptions)}${_redacted ? " [accessToken=REDACTED]" : ""}`
     );
-    let response = await graphClient.graphRequest(path2, options);
     const fetchAllPages = params.fetchAllPages === true;
     const paginationEnabled = paginationAllowed();
     if (fetchAllPages && !paginationEnabled) {
@@ -620,58 +622,69 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         "fetchAllPages requested but MS365_MCP_ALLOW_PAGINATION is disabled; returning first page only"
       );
     }
-    if (fetchAllPages && paginationEnabled && response?.content?.[0]?.text) {
+    const mergePages = fetchAllPages && paginationEnabled;
+    if (mergePages) {
+      options.forceJsonOutput = true;
+    }
+    let response = await graphClient.graphRequest(path2, options);
+    if (mergePages && response?.content?.[0]?.text) {
+      let combinedResponse;
       try {
-        let combinedResponse = JSON.parse(response.content[0].text);
-        let allItems = combinedResponse.value || [];
-        let nextLink = combinedResponse["@odata.nextLink"];
-        let pageCount = 1;
-        const maxPages = positiveIntFromEnv("MS365_MCP_MAX_PAGES", DEFAULT_MAX_PAGES);
-        const maxItems = positiveIntFromEnv("MS365_MCP_MAX_ITEMS", DEFAULT_MAX_ITEMS);
-        let deltaLink = combinedResponse["@odata.deltaLink"];
-        while (nextLink && pageCount < maxPages && allItems.length < maxItems) {
-          logger.info(`Fetching page ${pageCount + 1} from: ${nextLink}`);
-          const url = new URL(nextLink);
-          const nextPath = url.pathname.replace(/^\/(v1\.0|beta)/, "") + url.search;
-          const nextOptions = { ...options };
-          const nextResponse = await graphClient.graphRequest(nextPath, nextOptions);
-          if (nextResponse?.content?.[0]?.text) {
-            const nextJsonResponse = JSON.parse(nextResponse.content[0].text);
-            if (nextJsonResponse.value && Array.isArray(nextJsonResponse.value)) {
-              allItems = allItems.concat(nextJsonResponse.value);
-            }
-            nextLink = nextJsonResponse["@odata.nextLink"];
-            if (nextJsonResponse["@odata.deltaLink"]) {
-              deltaLink = nextJsonResponse["@odata.deltaLink"];
+        combinedResponse = JSON.parse(response.content[0].text);
+        const firstValue = combinedResponse.value;
+        if (Array.isArray(firstValue)) {
+          let allItems = firstValue;
+          let nextLink = combinedResponse["@odata.nextLink"];
+          let pageCount = 1;
+          const maxPages = positiveIntFromEnv("MS365_MCP_MAX_PAGES", DEFAULT_MAX_PAGES);
+          const maxItems = positiveIntFromEnv("MS365_MCP_MAX_ITEMS", DEFAULT_MAX_ITEMS);
+          let deltaLink = combinedResponse["@odata.deltaLink"];
+          while (nextLink && pageCount < maxPages && allItems.length < maxItems) {
+            logger.info(`Fetching page ${pageCount + 1} from: ${nextLink}`);
+            const url = new URL(nextLink);
+            const nextPath = url.pathname.replace(/^\/(v1\.0|beta)/, "") + url.search;
+            const nextOptions = { ...options };
+            const nextResponse = await graphClient.graphRequest(nextPath, nextOptions);
+            if (nextResponse?.content?.[0]?.text) {
+              const nextJsonResponse = JSON.parse(nextResponse.content[0].text);
+              if (Array.isArray(nextJsonResponse.value)) {
+                allItems = allItems.concat(nextJsonResponse.value);
+              }
+              nextLink = nextJsonResponse["@odata.nextLink"];
+              if (nextJsonResponse["@odata.deltaLink"]) {
+                deltaLink = nextJsonResponse["@odata.deltaLink"];
+              }
+              pageCount++;
+            } else {
+              break;
             }
-            pageCount++;
-          } else {
-            break;
           }
-        }
-        if (pageCount >= maxPages) {
-          logger.warn(`Reached maximum page limit (${maxPages}) for pagination`);
-        }
-        if (allItems.length >= maxItems) {
-          logger.warn(
-            `Reached maximum item limit (${maxItems}) for pagination \u2014 truncated at ${allItems.length} items`
+          if (pageCount >= maxPages) {
+            logger.warn(`Reached maximum page limit (${maxPages}) for pagination`);
+          }
+          if (allItems.length >= maxItems) {
+            logger.warn(
+              `Reached maximum item limit (${maxItems}) for pagination \u2014 truncated at ${allItems.length} items`
+            );
+          }
+          combinedResponse.value = allItems;
+          if (combinedResponse["@odata.count"]) {
+            combinedResponse["@odata.count"] = allItems.length;
+          }
+          delete combinedResponse["@odata.nextLink"];
+          if (deltaLink) {
+            combinedResponse["@odata.deltaLink"] = deltaLink;
+          }
+          logger.info(
+            `Pagination complete: collected ${allItems.length} items across ${pageCount} pages`
           );
         }
-        combinedResponse.value = allItems;
-        if (combinedResponse["@odata.count"]) {
-          combinedResponse["@odata.count"] = allItems.length;
-        }
-        delete combinedResponse["@odata.nextLink"];
-        if (deltaLink) {
-          combinedResponse["@odata.deltaLink"] = deltaLink;
-        }
-        response.content[0].text = JSON.stringify(combinedResponse);
-        logger.info(
-          `Pagination complete: collected ${allItems.length} items across ${pageCount} pages`
-        );
       } catch (e) {
         logger.error(`Error during pagination: ${e}`);
       }
+      if (combinedResponse !== void 0) {
+        response.content[0].text = graphClient.serialize(combinedResponse);
+      }
     }
     if (response?.content?.[0]?.text) {
       const responseText = response.content[0].text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.129.0",
+  "version": "0.130.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -1393,6 +1393,13 @@
     "presets": ["teams", "work"],
     "workScopes": ["ChatMessage.Read"]
   },
+  {
+    "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}",
+    "method": "patch",
+    "toolName": "update-chat-message",
+    "presets": ["teams", "work"],
+    "workScopes": ["Chat.ReadWrite"]
+  },
   {
     "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}/hostedContents",
     "method": "get",
@@ -1472,6 +1479,13 @@
     "presets": ["teams", "work"],
     "workScopes": ["ChannelMessage.Read.All"]
   },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}",
+    "method": "patch",
+    "toolName": "update-channel-message",
+    "presets": ["teams", "work"],
+    "workScopes": ["ChannelMessage.ReadWrite"]
+  },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents",
     "method": "get",
@@ -1503,6 +1517,13 @@
     "presets": ["teams", "work"],
     "workScopes": ["ChannelMessage.Read.All"]
   },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/replies/{chatMessage-id1}",
+    "method": "patch",
+    "toolName": "update-channel-message-reply",
+    "presets": ["teams", "work"],
+    "workScopes": ["ChannelMessage.ReadWrite"]
+  },
   {
     "pathPattern": "/teams/{team-id}/members",
     "method": "post",