@softeria/ms-365-mcp-server 0.134.5 → 0.135.0

package/README.md

@@ -149,6 +149,21 @@ CLI value takes precedence over `MS365_MCP_ALLOWED_SCOPES`; if neither is set, t
 
 Scope coverage is hierarchy-aware: for example, `Mail.ReadWrite` covers tools that require `Mail.Read`, and `Files.ReadWrite.All` covers tools that require `Files.Read`.
 
+SharePoint supports two enterprise permission models:
+
+- Broad tenant scopes such as `Sites.Read.All`, `Sites.ReadWrite.All`, and `Sites.Manage.All`.
+- Microsoft Graph `Sites.Selected`, where SharePoint site access is granted to the app on specific site collections and Graph evaluates the signed-in user's own permissions at request time.
+
+The default org-mode behavior continues to request the broad SharePoint scopes used by existing deployments. Enterprises that want selected-site SharePoint access can set an allowlist containing `Sites.Selected` instead of broad `Sites.*.All` scopes. Direct site/list/item tools that target an explicit SharePoint site can run with `Sites.Selected`; tenant-wide SharePoint discovery and search tools still require broad SharePoint scopes.
+
+```bash
+npx @softeria/ms-365-mcp-server \
+  --org-mode \
+  --read-only \
+  --enabled-tools 'sharepoint|site|drive|planner' \
+  --allowed-scopes 'User.Read Files.Read Notes.Read Tasks.Read Sites.Selected'
+```
+
 In HTTP mode, OAuth discovery advertises the effective filtered permissions so clients request the same consent surface. On-Behalf-Of mode (`--obo`) still advertises `api://<clientId>/access_as_user` for protected-resource metadata; `--allowed-scopes` does not override OBO.
 
 ### Requesting extra scopes

package/dist/endpoints.json

@@ -1811,56 +1811,56 @@
     "method": "get",
     "toolName": "get-sharepoint-site",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/drives",
     "method": "get",
     "toolName": "list-sharepoint-site-drives",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/drives/{drive-id}",
     "method": "get",
     "toolName": "get-sharepoint-site-drive-by-id",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/items",
     "method": "get",
     "toolName": "list-sharepoint-site-items",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/items/{baseItem-id}",
     "method": "get",
     "toolName": "get-sharepoint-site-item",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/lists",
     "method": "get",
     "toolName": "list-sharepoint-site-lists",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/lists/{list-id}",
     "method": "get",
     "toolName": "get-sharepoint-site-list",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/lists/{list-id}/items",
     "method": "get",
     "toolName": "list-sharepoint-site-list-items",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Add $expand=fields to include actual column values. Without it, only metadata is returned."
   },
   {
@@ -1868,7 +1868,7 @@
     "method": "get",
     "toolName": "get-sharepoint-site-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Add $expand=fields to include actual column values. Without it, only metadata is returned."
   },
   {
@@ -1876,7 +1876,7 @@
     "method": "post",
     "toolName": "create-sharepoint-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.ReadWrite.All"],
+    "workScopes": [["Sites.ReadWrite.All"], ["Sites.Selected"]],
     "llmTip": "Creates a new item in a SharePoint list. Body: { fields: { Title: 'Item name', ColumnName: 'value', ... } }. Use list-sharepoint-site-lists to find the list ID and get-sharepoint-site-list to discover available columns."
   },
   {
@@ -1884,7 +1884,7 @@
     "method": "patch",
     "toolName": "update-sharepoint-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.ReadWrite.All"],
+    "workScopes": [["Sites.ReadWrite.All"], ["Sites.Selected"]],
     "llmTip": "Updates fields on an existing list item. Body: { fields: { ColumnName: 'new value' } }. Send only the fields you want to change. Use $expand=fields on get-sharepoint-site-list-item to see current values first."
   },
   {
@@ -1892,7 +1892,7 @@
     "method": "delete",
     "toolName": "delete-sharepoint-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.ReadWrite.All"],
+    "workScopes": [["Sites.ReadWrite.All"], ["Sites.Selected"]],
     "llmTip": "Deletes a list item permanently. This cannot be undone — the item is moved to the site recycle bin."
   },
   {
@@ -1900,7 +1900,7 @@
     "method": "post",
     "toolName": "create-sharepoint-list",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Creates a new SharePoint list in a site. Body: { displayName: 'My List', description: 'Optional', list: { template: 'genericList' }, columns: [ { name: 'Status', text: {} }, { name: 'Due', dateTime: {} } ] }. Templates include genericList, documentLibrary, tasks, calendar, contacts, links, announcements, survey. Columns can be defined inline at creation; otherwise add them later via create-sharepoint-list-column. Use search-sharepoint-sites or get-sharepoint-site-by-path to find the site ID first."
   },
   {
@@ -1908,7 +1908,7 @@
     "method": "get",
     "toolName": "list-sharepoint-list-columns",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Lists column definitions for a SharePoint list. Returns each column's id, name, displayName, description, type indicator (text, number, choice, dateTime, person, lookup, boolean, calculated, hyperlinkOrPicture, etc.), required, indexed, hidden, readOnly. Use this to discover the schema before creating or updating list items."
   },
   {
@@ -1916,7 +1916,7 @@
     "method": "post",
     "toolName": "create-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Creates a new column on a SharePoint list. Body must include name and exactly one column type property: { name: 'Priority', text: {} } or { name: 'DueDate', dateTime: { format: 'dateOnly' } } or { name: 'Status', choice: { choices: ['Open','In Progress','Done'] } }. Other types: number, boolean, currency, hyperlinkOrPicture, personOrGroup, lookup, calculated. Optional: displayName, description, required, indexed, enforceUniqueValues."
   },
   {
@@ -1924,7 +1924,7 @@
     "method": "get",
     "toolName": "get-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Gets a specific column definition by ID, including its full type configuration (choices for choice columns, format for dateTime, etc.). Use list-sharepoint-list-columns first to find the column ID."
   },
   {
@@ -1932,7 +1932,7 @@
     "method": "patch",
     "toolName": "update-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Updates a column definition. Body: { displayName: 'New name', description: 'New description', required: true, ... }. The column type itself (text, choice, etc.) cannot be changed — only its metadata and per-type options (e.g. choices array for a choice column). Send only the fields you want to change."
   },
   {
@@ -1940,7 +1940,7 @@
     "method": "delete",
     "toolName": "delete-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Deletes a column from a SharePoint list. This is irreversible — all data stored in this column across every list item is lost. Confirm with the user before calling. Cannot delete built-in columns (Title, Created, Modified, etc.)."
   },
   {
@@ -1948,7 +1948,7 @@
     "method": "get",
     "toolName": "get-sharepoint-site-by-path",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "skipEncoding": ["path"],
     "llmTip": "Resolve a SharePoint site from its server-relative URL. site-id is the hostname (contoso.sharepoint.com) and path is the site path without a leading slash (sites/marketing, teams/hr). Returns the site object whose id feeds list-sharepoint-site-drives."
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.134.5",
+  "version": "0.135.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -1811,56 +1811,56 @@
     "method": "get",
     "toolName": "get-sharepoint-site",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/drives",
     "method": "get",
     "toolName": "list-sharepoint-site-drives",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/drives/{drive-id}",
     "method": "get",
     "toolName": "get-sharepoint-site-drive-by-id",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/items",
     "method": "get",
     "toolName": "list-sharepoint-site-items",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/items/{baseItem-id}",
     "method": "get",
     "toolName": "get-sharepoint-site-item",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/lists",
     "method": "get",
     "toolName": "list-sharepoint-site-lists",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/lists/{list-id}",
     "method": "get",
     "toolName": "get-sharepoint-site-list",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"]
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/sites/{site-id}/lists/{list-id}/items",
     "method": "get",
     "toolName": "list-sharepoint-site-list-items",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Add $expand=fields to include actual column values. Without it, only metadata is returned."
   },
   {
@@ -1868,7 +1868,7 @@
     "method": "get",
     "toolName": "get-sharepoint-site-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Add $expand=fields to include actual column values. Without it, only metadata is returned."
   },
   {
@@ -1876,7 +1876,7 @@
     "method": "post",
     "toolName": "create-sharepoint-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.ReadWrite.All"],
+    "workScopes": [["Sites.ReadWrite.All"], ["Sites.Selected"]],
     "llmTip": "Creates a new item in a SharePoint list. Body: { fields: { Title: 'Item name', ColumnName: 'value', ... } }. Use list-sharepoint-site-lists to find the list ID and get-sharepoint-site-list to discover available columns."
   },
   {
@@ -1884,7 +1884,7 @@
     "method": "patch",
     "toolName": "update-sharepoint-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.ReadWrite.All"],
+    "workScopes": [["Sites.ReadWrite.All"], ["Sites.Selected"]],
     "llmTip": "Updates fields on an existing list item. Body: { fields: { ColumnName: 'new value' } }. Send only the fields you want to change. Use $expand=fields on get-sharepoint-site-list-item to see current values first."
   },
   {
@@ -1892,7 +1892,7 @@
     "method": "delete",
     "toolName": "delete-sharepoint-list-item",
     "presets": ["work"],
-    "workScopes": ["Sites.ReadWrite.All"],
+    "workScopes": [["Sites.ReadWrite.All"], ["Sites.Selected"]],
     "llmTip": "Deletes a list item permanently. This cannot be undone — the item is moved to the site recycle bin."
   },
   {
@@ -1900,7 +1900,7 @@
     "method": "post",
     "toolName": "create-sharepoint-list",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Creates a new SharePoint list in a site. Body: { displayName: 'My List', description: 'Optional', list: { template: 'genericList' }, columns: [ { name: 'Status', text: {} }, { name: 'Due', dateTime: {} } ] }. Templates include genericList, documentLibrary, tasks, calendar, contacts, links, announcements, survey. Columns can be defined inline at creation; otherwise add them later via create-sharepoint-list-column. Use search-sharepoint-sites or get-sharepoint-site-by-path to find the site ID first."
   },
   {
@@ -1908,7 +1908,7 @@
     "method": "get",
     "toolName": "list-sharepoint-list-columns",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Lists column definitions for a SharePoint list. Returns each column's id, name, displayName, description, type indicator (text, number, choice, dateTime, person, lookup, boolean, calculated, hyperlinkOrPicture, etc.), required, indexed, hidden, readOnly. Use this to discover the schema before creating or updating list items."
   },
   {
@@ -1916,7 +1916,7 @@
     "method": "post",
     "toolName": "create-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Creates a new column on a SharePoint list. Body must include name and exactly one column type property: { name: 'Priority', text: {} } or { name: 'DueDate', dateTime: { format: 'dateOnly' } } or { name: 'Status', choice: { choices: ['Open','In Progress','Done'] } }. Other types: number, boolean, currency, hyperlinkOrPicture, personOrGroup, lookup, calculated. Optional: displayName, description, required, indexed, enforceUniqueValues."
   },
   {
@@ -1924,7 +1924,7 @@
     "method": "get",
     "toolName": "get-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "llmTip": "Gets a specific column definition by ID, including its full type configuration (choices for choice columns, format for dateTime, etc.). Use list-sharepoint-list-columns first to find the column ID."
   },
   {
@@ -1932,7 +1932,7 @@
     "method": "patch",
     "toolName": "update-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Updates a column definition. Body: { displayName: 'New name', description: 'New description', required: true, ... }. The column type itself (text, choice, etc.) cannot be changed — only its metadata and per-type options (e.g. choices array for a choice column). Send only the fields you want to change."
   },
   {
@@ -1940,7 +1940,7 @@
     "method": "delete",
     "toolName": "delete-sharepoint-list-column",
     "presets": ["work"],
-    "workScopes": ["Sites.Manage.All"],
+    "workScopes": [["Sites.Manage.All"], ["Sites.Selected"]],
     "llmTip": "Deletes a column from a SharePoint list. This is irreversible — all data stored in this column across every list item is lost. Confirm with the user before calling. Cannot delete built-in columns (Title, Created, Modified, etc.)."
   },
   {
@@ -1948,7 +1948,7 @@
     "method": "get",
     "toolName": "get-sharepoint-site-by-path",
     "presets": ["work"],
-    "workScopes": ["Sites.Read.All"],
+    "workScopes": [["Sites.Read.All"], ["Sites.Selected"]],
     "skipEncoding": ["path"],
     "llmTip": "Resolve a SharePoint site from its server-relative URL. site-id is the hostname (contoso.sharepoint.com) and path is the site path without a leading slash (sites/marketing, teams/hr). Returns the site object whose id feeds list-sharepoint-site-drives."
   },