@softeria/ms-365-mcp-server 0.135.0 → 0.137.0

package/.env.example

@@ -1,5 +1,10 @@
 # Microsoft 365 OAuth Configuration
 # Create an Azure AD app registration and get these values:
+#
+# NOTE: .env is read from the directory the server is started in, which the MCP
+# client picks. Only the four variables below are read from it. Everything else
+# (token cache paths, the auth-cache command, Key Vault, logging, HTTP settings)
+# must be set in your shell or MCP client config.
 
 # Your Azure AD App Registration Client ID
 MS365_MCP_CLIENT_ID=your-azure-ad-app-client-id-here
@@ -38,7 +43,8 @@ MS365_MCP_TENANT_ID=common
 # When set, secrets are fetched from Azure Key Vault instead of environment variables.
 # This is useful for production deployments, especially with Azure Container Apps.
 #
-# MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
+# Not read from .env - export MS365_MCP_KEYVAULT_URL in the environment instead:
+#   export MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
 #
 # Key Vault secret names (store these in your Key Vault):
 #   - ms365-mcp-client-id     (required)
@@ -58,8 +64,10 @@ MS365_MCP_TENANT_ID=common
 # -------------------------------------------------------------------
 # Headless local-MSAL deployments can store token-cache and selected-account
 # metadata with a provider-neutral executable wrapper. The value is a real
-# executable path, not a shell command string; put any provider-specific args
-# inside the wrapper script.
+# executable path (absolute), not a shell command string; put any
+# provider-specific args inside the wrapper script.
 #
-# MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
-# MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000
+# This one starts a process, so it is deliberately NOT read from .env. Export it
+# in the environment that launches the server:
+#   export MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
+#   export MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000

package/README.md

@@ -440,6 +440,11 @@ registration:
 
 With these configured, the server will use your custom Azure app instead of the built-in one.
 
+> **Note**: `.env` is read from the directory the server is started in, and the MCP client decides what
+> that is. Only `MS365_MCP_CLIENT_ID`, `MS365_MCP_CLIENT_SECRET`, `MS365_MCP_TENANT_ID` and
+> `MS365_MCP_CLOUD_TYPE` are read from it. Every other variable listed above must be set in your shell
+> or MCP client config; anything else found in a `.env` is ignored with a warning on stderr.
+
 #### 3. Bring Your Own Token (BYOT)
 
 If you are running ms-365-mcp-server as part of a larger system that manages Microsoft OAuth tokens externally, you can

package/dist/__tests__/graph-tools.test.js

@@ -89,6 +89,10 @@ async function loadModule() {
   const mod = await import("../graph-tools.js");
   return mod;
 }
+async function spyOnAuditLogger() {
+  const { __testing } = await import("../audit-log.js");
+  return vi.spyOn(__testing.auditLogger, "info").mockImplementation(() => __testing.auditLogger);
+}
 function createMockServer() {
   const tools = /* @__PURE__ */ new Map();
   return {
@@ -139,6 +143,234 @@ describe("graph-tools", () => {
       expect(url).toContain("$count=true");
     });
   });
+  describe("audit target resources", () => {
+    it("adds target_resource to generated Graph tool audit events", async () => {
+      const endpoint = makeEndpoint({
+        alias: "get-drive-item",
+        path: "/drives/:driveId/items/:driveItemId",
+        parameters: [
+          { name: "driveId", type: "Path", schema: z.string() },
+          { name: "driveItemId", type: "Path", schema: z.string() }
+        ]
+      });
+      const config = makeConfig({
+        toolName: "get-drive-item",
+        pathPattern: "/drives/{drive-id}/items/{driveItem-id}",
+        scopes: ["Files.Read"]
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ id: "item-2" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const auditSpy = await spyOnAuditLogger();
+      await server.tools.get("get-drive-item").handler({
+        driveId: "drive-1",
+        driveItemId: "item-2"
+      });
+      expect(auditSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          event: "tool.call",
+          tool: "get-drive-item",
+          status: "success",
+          target_resource: {
+            type: "drive_item",
+            id: "/drives/drive-1/items/item-2"
+          }
+        })
+      );
+      auditSpy.mockRestore();
+    });
+    it("adds target_resource to failed generated Graph tool audit events", async () => {
+      const endpoint = makeEndpoint({
+        alias: "get-drive-item",
+        path: "/drives/:driveId/items/:driveItemId",
+        parameters: [
+          { name: "driveId", type: "Path", schema: z.string() },
+          { name: "driveItemId", type: "Path", schema: z.string() }
+        ]
+      });
+      const config = makeConfig({
+        toolName: "get-drive-item",
+        pathPattern: "/drives/{drive-id}/items/{driveItem-id}",
+        scopes: ["Files.Read"]
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient();
+      graphClient.graphRequest.mockRejectedValueOnce(
+        Object.assign(new Error("Forbidden"), { status: 403 })
+      );
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(
+        server,
+        graphClient
+      );
+      const auditSpy = await spyOnAuditLogger();
+      const result = await server.tools.get("get-drive-item").handler({
+        driveId: "drive-1",
+        driveItemId: "item-2"
+      });
+      expect(result.isError).toBe(true);
+      expect(auditSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          event: "tool.call",
+          tool: "get-drive-item",
+          status: "error",
+          error_code: 403,
+          target_resource: {
+            type: "drive_item",
+            id: "/drives/drive-1/items/item-2"
+          }
+        })
+      );
+      auditSpy.mockRestore();
+    });
+    it("derives target_resource from generic ID path parameters", async () => {
+      const endpoint = makeEndpoint({
+        alias: "get-mail-message",
+        path: "/me/messages/:messageId",
+        parameters: [{ name: "messageId", type: "Path", schema: z.string() }]
+      });
+      const config = makeConfig({
+        toolName: "get-mail-message",
+        pathPattern: "/me/messages/{message-id}"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ id: "message-1" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const auditSpy = await spyOnAuditLogger();
+      await server.tools.get("get-mail-message").handler({
+        messageId: "message-1"
+      });
+      expect(auditSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          event: "tool.call",
+          tool: "get-mail-message",
+          status: "success",
+          target_resource: {
+            type: "message",
+            id: "/me/messages/message-1"
+          }
+        })
+      );
+      auditSpy.mockRestore();
+    });
+    it("omits target_resource when an ID path parameter is missing", async () => {
+      const endpoint = makeEndpoint({
+        alias: "get-drive-item",
+        path: "/drives/:driveId/items/:driveItemId",
+        parameters: [
+          { name: "driveId", type: "Path", schema: z.string() },
+          { name: "driveItemId", type: "Path", schema: z.string() }
+        ]
+      });
+      const config = makeConfig({
+        toolName: "get-drive-item",
+        pathPattern: "/drives/{drive-id}/items/{driveItem-id}",
+        scopes: ["Files.Read"]
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ id: "item-2" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const auditSpy = await spyOnAuditLogger();
+      await server.tools.get("get-drive-item").handler({
+        driveId: "drive-1"
+      });
+      const [payload] = auditSpy.mock.calls[0];
+      expect(payload).toMatchObject({
+        event: "tool.call",
+        tool: "get-drive-item",
+        status: "success"
+      });
+      expect(payload).not.toHaveProperty("target_resource");
+      auditSpy.mockRestore();
+    });
+    it("omits SharePoint path parameters from target_resource", async () => {
+      const endpoint = makeEndpoint({
+        alias: "get-sharepoint-site-by-path",
+        path: "/sites/:siteId/getByPath(path=':path')",
+        parameters: [
+          { name: "siteId", type: "Path", schema: z.string() },
+          { name: "path", type: "Path", schema: z.string() }
+        ]
+      });
+      const config = makeConfig({
+        toolName: "get-sharepoint-site-by-path",
+        pathPattern: "/sites/{site-id}:/{path}",
+        scopes: [["Sites.Read.All"], ["Sites.Selected"]]
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ id: "site-1" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const auditSpy = await spyOnAuditLogger();
+      await server.tools.get("get-sharepoint-site-by-path").handler({
+        siteId: "contoso.sharepoint.com",
+        path: "/sites/Finance"
+      });
+      expect(auditSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          event: "tool.call",
+          tool: "get-sharepoint-site-by-path",
+          status: "success",
+          target_resource: {
+            type: "site",
+            id: "/sites/contoso.sharepoint.com"
+          }
+        })
+      );
+      const [payload] = auditSpy.mock.calls[0];
+      expect(JSON.stringify(payload)).not.toContain("Finance");
+      auditSpy.mockRestore();
+    });
+    it("omits target_resource for generated broad list/search audit events", async () => {
+      const endpoint = makeEndpoint({
+        alias: "list-mail-messages",
+        path: "/me/messages"
+      });
+      const config = makeConfig({
+        toolName: "list-mail-messages",
+        pathPattern: "/me/messages"
+      });
+      mockEndpoints.push(endpoint);
+      mockEndpointsJson = [config];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ value: [] }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const auditSpy = await spyOnAuditLogger();
+      await server.tools.get("list-mail-messages").handler({ search: "budget" });
+      const [payload] = auditSpy.mock.calls[0];
+      expect(payload).toMatchObject({
+        event: "tool.call",
+        tool: "list-mail-messages",
+        status: "success"
+      });
+      expect(payload).not.toHaveProperty("target_resource");
+      auditSpy.mockRestore();
+    });
+  });
   describe("fetchAllPages pagination", () => {
     it("should follow @odata.nextLink and combine results", async () => {
       const endpoint = makeEndpoint();

package/dist/audit-target-resource.js

@@ -0,0 +1,75 @@
+const CONTROL_PARAM_NAMES = /* @__PURE__ */ new Set([
+  "account",
+  "confirm",
+  "fetchAllPages",
+  "includeHeaders",
+  "excludeResponse",
+  "timezone",
+  "expandExtendedProperties"
+]);
+function toCamelCase(name) {
+  return name.replace(/-([a-zA-Z])/g, (_, c) => c.toUpperCase());
+}
+function toKebabCase(name) {
+  return name.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);
+}
+function toSnakeCase(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "").toLowerCase();
+}
+function valueForPlaceholder(placeholderName, params) {
+  const candidates = [placeholderName, toCamelCase(placeholderName), toKebabCase(placeholderName)];
+  for (const candidate of candidates) {
+    if (CONTROL_PARAM_NAMES.has(candidate)) continue;
+    const value = params[candidate];
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      return encodeURIComponent(String(value)).replace(/%3D/g, "=");
+    }
+  }
+  return void 0;
+}
+function resolveGraphPathForAudit(pathPattern, params = {}) {
+  if (!pathPattern) return void 0;
+  let resolvedPath = pathPattern;
+  resolvedPath = resolvedPath.replace(/:([A-Za-z][A-Za-z0-9-]*)/g, (match, name) => {
+    return valueForPlaceholder(name, params) ?? match;
+  });
+  resolvedPath = resolvedPath.replace(/\{([^}]+)\}/g, (match, name) => {
+    return valueForPlaceholder(name, params) ?? match;
+  });
+  if (/:([A-Za-z][A-Za-z0-9-]*)|\{[^}]+\}/.test(resolvedPath)) {
+    return void 0;
+  }
+  return resolvedPath.startsWith("/") ? resolvedPath : `/${resolvedPath}`;
+}
+function idPlaceholderBase(name) {
+  const base = name.replace(/[-_]?id\d*$/i, "");
+  if (base === name || base.length === 0) return void 0;
+  return base;
+}
+function deriveTargetResource(input) {
+  const pathPattern = input.pathPattern;
+  if (!pathPattern) return void 0;
+  const placeholderPattern = /\{([^}]+)\}|:([A-Za-z][A-Za-z0-9-]*)/g;
+  let lastTarget;
+  for (const match of pathPattern.matchAll(placeholderPattern)) {
+    const name = match[1] ?? match[2];
+    const base = idPlaceholderBase(name);
+    if (!base) continue;
+    lastTarget = {
+      base,
+      end: match.index + match[0].length
+    };
+  }
+  if (!lastTarget) return void 0;
+  const targetPattern = pathPattern.slice(0, lastTarget.end);
+  const id = resolveGraphPathForAudit(targetPattern, input.params ?? {});
+  if (!id) return void 0;
+  return {
+    type: toSnakeCase(lastTarget.base),
+    id
+  };
+}
+export {
+  deriveTargetResource,
+  resolveGraphPathForAudit
+};

package/dist/generated/client.js

@@ -844,8 +844,8 @@ const microsoft_graph_driveItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   audio: microsoft_graph_audio.optional(),
   bundle: microsoft_graph_bundle.optional(),
   cTag: z.string().describe(
@@ -2584,8 +2584,8 @@ const microsoft_graph_listItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   contentType: microsoft_graph_contentTypeInfo.optional(),
   deleted: microsoft_graph_deleted.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2593,7 +2593,7 @@ const microsoft_graph_listItem = z.object({
   documentSetVersions: z.array(microsoft_graph_documentSetVersion).describe("Version information for a document set version created by a user.").optional(),
   driveItem: microsoft_graph_driveItem.describe("[Note: Simplified from 45 properties to 25 most common ones]").optional(),
   fields: microsoft_graph_fieldValueSet.optional(),
-  permissions: z.array(microsoft_graph_permission).optional(),
+  permissions: z.array(microsoft_graph_permission).describe("The set of permissions for the item. Read-only. Nullable.").optional(),
   versions: z.array(microsoft_graph_listItemVersion).describe("The list of previous versions of the list item.").optional()
 }).passthrough();
 const microsoft_graph_longRunningOperationStatus = z.enum([
@@ -2706,8 +2706,8 @@ const microsoft_graph_list = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
     displayName: z.string().describe("The displayable title of the list.").nullish(),
     list: microsoft_graph_listInfo.optional(),
     sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2717,7 +2717,7 @@ const microsoft_graph_list = z.lazy(
     drive: microsoft_graph_drive.optional(),
     items: z.array(microsoft_graph_listItem).describe("All items contained in the list.").optional(),
     operations: z.array(microsoft_graph_richLongRunningOperation).describe("The collection of long-running operations on the list.").optional(),
-    permissions: z.array(microsoft_graph_permission).optional(),
+    permissions: z.array(microsoft_graph_permission).describe("The set of permissions for the item. Read-only. Nullable.").optional(),
     subscriptions: z.array(microsoft_graph_subscription).describe("The set of subscriptions on the list.").optional()
   }).passthrough()
 );
@@ -2739,8 +2739,8 @@ const microsoft_graph_drive = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
     driveType: z.string().describe(
       "Describes the type of drive represented by this resource. OneDrive personal drives return personal. OneDrive for Business returns business. SharePoint document libraries return documentLibrary. Read-only."
     ).nullish(),
@@ -3014,7 +3014,7 @@ const microsoft_graph_team = z.lazy(
     ).nullish(),
     allChannels: z.array(microsoft_graph_channel).describe("List of channels either hosted in or shared with the team (incoming channels).").optional(),
     channels: z.array(microsoft_graph_channel).describe("The collection of channels and messages associated with the team.").optional(),
-    group: microsoft_graph_group.describe("[Note: Simplified from 80 properties to 25 most common ones]").optional(),
+    group: microsoft_graph_group.describe("[Note: Simplified from 81 properties to 25 most common ones]").optional(),
     incomingChannels: z.array(microsoft_graph_channel).describe("List of channels shared with the team.").optional(),
     installedApps: z.array(microsoft_graph_teamsAppInstallation).describe("The apps installed in this team.").optional(),
     members: z.array(microsoft_graph_conversationMember).describe("Members and owners of the team.").optional(),
@@ -3586,6 +3586,13 @@ const microsoft_graph_chatInfo = z.object({
 const microsoft_graph_chatRestrictions = z.object({
   allowTextOnly: z.boolean().describe("Indicates whether only text is allowed in the meeting chat. Optional.").nullish()
 }).passthrough();
+const microsoft_graph_cloudVideoInteropInfo = z.object({
+  moreInfoWebUrl: z.string().describe("Provides other video teleconferencing (VTC) dial-in options. Read-only.").nullish(),
+  tenantKey: z.string().describe(
+    "The tenant key that is used to dial into the interactive voice response (IVR) of the partner CVI service."
+  ).nullish(),
+  videoTeleconferenceId: z.string().describe("The video teleconferencing ID. Read-only.").nullish()
+}).passthrough();
 const microsoft_graph_joinMeetingIdSettings = z.object({
   isPasscodeRequired: z.boolean().describe(
     "Indicates whether a passcode is required to join a meeting when using joinMeetingId. Optional."
@@ -3617,6 +3624,7 @@ const microsoft_graph_onlineMeeting = z.object({
   audioConferencing: microsoft_graph_audioConferencing.optional(),
   chatInfo: microsoft_graph_chatInfo.optional(),
   chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+  cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
   expiryDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
@@ -3625,8 +3633,7 @@ const microsoft_graph_onlineMeeting = z.object({
   isEndToEndEncryptionEnabled: z.boolean().describe("Indicates whether end-to-end encryption (E2EE) is enabled for the online meeting.").nullish(),
   isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
   joinInformation: microsoft_graph_itemBody.optional(),
-  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-  joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
 }).passthrough().passthrough();
 const microsoft_graph_onlineMeetingCollectionResponse = z.object({
   "@odata.count": z.number().int().nullable(),
@@ -4549,8 +4556,8 @@ const microsoft_graph_baseItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional()
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional()
 }).passthrough();
 const microsoft_graph_site = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
@@ -4571,8 +4578,8 @@ const microsoft_graph_site = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   isPersonalSite: z.boolean().describe("Identifies whether the site is personal or not. Read-only.").nullish(),
   root: microsoft_graph_root.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -4692,6 +4699,7 @@ const microsoft_graph_virtualEventSession = z.object({
   audioConferencing: microsoft_graph_audioConferencing.optional(),
   chatInfo: microsoft_graph_chatInfo.optional(),
   chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+  cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
   expiryDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
@@ -4700,8 +4708,7 @@ const microsoft_graph_virtualEventSession = z.object({
   isEndToEndEncryptionEnabled: z.boolean().describe("Indicates whether end-to-end encryption (E2EE) is enabled for the online meeting.").nullish(),
   isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
   joinInformation: microsoft_graph_itemBody.optional(),
-  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-  joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
 }).passthrough().passthrough();
 const microsoft_graph_meetingAudience = z.enum(["everyone", "organization", "unknownFutureValue"]);
 const microsoft_graph_communicationsUserIdentity = z.object({
@@ -4723,10 +4730,14 @@ const microsoft_graph_virtualEventRegistrationQuestionBase = z.object({
 const microsoft_graph_virtualEventWebinarRegistrationConfiguration = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
   capacity: z.number().gte(-2147483648).lte(2147483647).describe("Total capacity of the virtual event.").nullish(),
+  isManualApprovalEnabled: z.boolean().describe(
+    "Indicates whether registrations require organizer approval before a participant is confirmed."
+  ).nullish(),
+  isWaitlistEnabled: z.boolean().describe(
+    "Indicates whether more registrants are automatically placed on a waitlist when capacity is reached."
+  ).nullish(),
   registrationWebUrl: z.string().describe("Registration URL of the virtual event.").nullish(),
-  questions: z.array(microsoft_graph_virtualEventRegistrationQuestionBase).describe("Registration questions.").optional(),
-  isManualApprovalEnabled: z.boolean().nullish(),
-  isWaitlistEnabled: z.boolean().nullish()
+  questions: z.array(microsoft_graph_virtualEventRegistrationQuestionBase).describe("Registration questions.").optional()
 }).passthrough();
 const microsoft_graph_virtualEventRegistrationQuestionAnswer = z.object({
   booleanValue: z.boolean().describe(
@@ -4783,6 +4794,7 @@ const microsoft_graph_virtualEventWebinar = z.object({
   externalEventInformation: z.array(microsoft_graph_virtualEventExternalInformation).describe(
     "The external information of a virtual event. Returned only for event organizers or coorganizers; otherwise, null."
   ).optional(),
+  isRegistrationRequired: z.boolean().describe("Indicates whether attendee registration is enabled for the virtual event.").nullish(),
   settings: microsoft_graph_virtualEventSettings.optional(),
   startDateTime: microsoft_graph_dateTimeTimeZone.optional(),
   status: microsoft_graph_virtualEventStatus.optional(),
@@ -5212,6 +5224,7 @@ const schemas = {
   microsoft_graph_audioConferencing,
   microsoft_graph_chatInfo,
   microsoft_graph_chatRestrictions,
+  microsoft_graph_cloudVideoInteropInfo,
   microsoft_graph_joinMeetingIdSettings,
   microsoft_graph_onlineMeeting,
   microsoft_graph_onlineMeetingCollectionResponse,
@@ -5865,8 +5878,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -5980,8 +5993,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -11185,6 +11198,7 @@ resource.`,
           audioConferencing: microsoft_graph_audioConferencing.optional(),
           chatInfo: microsoft_graph_chatInfo.optional(),
           chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+          cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
           expiryDateTime: z.string().regex(
             /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
           ).datetime({ offset: true }).describe(
@@ -11195,8 +11209,7 @@ resource.`,
           ).nullish(),
           isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
           joinInformation: microsoft_graph_itemBody.optional(),
-          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-          joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
         }).passthrough().passthrough()
       }
     ],
@@ -11257,6 +11270,7 @@ resource.`,
           audioConferencing: microsoft_graph_audioConferencing.optional(),
           chatInfo: microsoft_graph_chatInfo.optional(),
           chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+          cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
           expiryDateTime: z.string().regex(
             /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
           ).datetime({ offset: true }).describe(
@@ -11267,8 +11281,7 @@ resource.`,
           ).nullish(),
           isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
           joinInformation: microsoft_graph_itemBody.optional(),
-          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-          joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
         }).passthrough().passthrough()
       }
     ],

package/dist/graph-tools.js

@@ -20,6 +20,7 @@ import { TOOL_CATEGORIES } from "./tool-categories.js";
 import { getRequestTokens } from "./request-context.js";
 import { parseTeamsUrl } from "./lib/teams-url-parser.js";
 import { buildBM25Index, scoreQuery, tokenize } from "./lib/bm25.js";
+import { deriveTargetResource } from "./audit-target-resource.js";
 import { describeToolSchema, describeUtilityToolSchema } from "./lib/tool-schema.js";
 import {
   TOP_UNSUPPORTED_DELTA_TOOLS,
@@ -598,6 +599,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
   const startTime = Date.now();
   const upn = getUserIdentityForAudit(getRequestTokens()?.accessToken);
   const httpMethod = tool.method.toUpperCase();
+  let targetResource;
   try {
     const accountParam = params.account;
     const accountModeError = await checkAccountParamInBearerMode(accountParam, authManager);
@@ -815,6 +817,10 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
     if (accountAccessToken) {
       options.accessToken = accountAccessToken;
     }
+    targetResource = deriveTargetResource({
+      pathPattern: config?.pathPattern ?? tool.path,
+      params
+    });
     const { accessToken: _redacted, ...safeOptions } = options;
     logger.info(
       `Making graph request to ${path2} with options: ${JSON.stringify(safeOptions)}${_redacted ? " [accessToken=REDACTED]" : ""}`
@@ -915,7 +921,8 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       tool: tool.alias,
       http_method: httpMethod,
       status: response.isError ? "error" : "success",
-      duration_ms: Date.now() - startTime
+      duration_ms: Date.now() - startTime,
+      ...targetResource ? { target_resource: targetResource } : {}
     });
     return {
       content,
@@ -933,6 +940,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       http_method: httpMethod,
       status: "error",
       duration_ms: Date.now() - startTime,
+      ...targetResource ? { target_resource: targetResource } : {},
       error_type: err?.name || "Error",
       error_code: err?.status ?? err?.code
     });

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "dotenv/config";
+import { loadEnvFile } from "./load-env.js";
 import { parseArgs } from "./cli.js";
 import logger from "./logger.js";
 import AuthManager, { buildAllowedScopeDiagnostics, resolveAuthScopes } from "./auth.js";
@@ -33,6 +33,7 @@ process.on("uncaughtException", (err, origin) => {
 });
 async function main() {
   try {
+    loadEnvFile();
     const args = parseArgs();
     const includeWorkScopes = args.orgMode || false;
     if (includeWorkScopes) {

package/dist/load-env.js

@@ -0,0 +1,41 @@
+import { parse } from "dotenv";
+import fs from "node:fs";
+import path from "node:path";
+const ENV_FILE_ALLOWLIST = [
+  "MS365_MCP_CLIENT_ID",
+  "MS365_MCP_CLIENT_SECRET",
+  "MS365_MCP_TENANT_ID",
+  "MS365_MCP_CLOUD_TYPE"
+];
+function loadEnvFile(options = {}) {
+  const file = options.path ?? path.resolve(process.cwd(), ".env");
+  let fromFile = {};
+  try {
+    fromFile = parse(fs.readFileSync(file, "utf8"));
+  } catch {
+  }
+  const applied = [];
+  const ignored = [];
+  for (const [key, value] of Object.entries(fromFile)) {
+    if (!ENV_FILE_ALLOWLIST.includes(key)) {
+      ignored.push(key);
+      continue;
+    }
+    if (process.env[key] !== void 0) {
+      continue;
+    }
+    process.env[key] = value;
+    applied.push(key);
+  }
+  const ignoredOwn = ignored.filter((key) => key.startsWith("MS365_MCP_"));
+  if (ignoredOwn.length > 0) {
+    console.error(
+      `[ms365-mcp] Ignored ${ignoredOwn.length} variable(s) from .env: ${[...ignoredOwn].sort().join(", ")}. Only ${ENV_FILE_ALLOWLIST.join(", ")} are read from .env - set anything else in your shell or MCP client config.`
+    );
+  }
+  return { applied, ignored };
+}
+export {
+  ENV_FILE_ALLOWLIST,
+  loadEnvFile
+};

package/dist/token-cache-storage.js

@@ -289,6 +289,9 @@ function parseTimeoutMs(value) {
   return parsed;
 }
 async function assertCommandUsable(commandPath) {
+  if (!path.isAbsolute(commandPath)) {
+    throw new Error(`${AUTH_CACHE_COMMAND_ENV} must be an absolute path.`);
+  }
   let stats;
   try {
     stats = await fs.promises.stat(commandPath);

package/docs/deployment.md

@@ -213,7 +213,7 @@ The client automatically discovers OAuth endpoints and opens a browser for authe
 - **Tool filtering**: use `--enabled-tools <regex>` or `--preset <names>` to restrict available tools
 - **CORS**: configure `MS365_MCP_CORS_ORIGIN` to restrict allowed origins (defaults to `http://localhost:3000`); set explicitly when clients run on a different origin
 - **Disable Dynamic Client Registration**: when only a known client talks to the server, set `MS365_MCP_DISABLE_DCR=true` (or pass `--no-dynamic-registration`) to close the anonymous `/register` endpoint
-- **Structured audit log**: enabled by default. Every tool invocation emits one JSON line on stdout (captured by the container platform's log collector) and to `~/.ms-365-mcp-server/logs/audit.log` (mode `0o600`) with `{ event, request_id, user_principal_name, tool, http_method, status, duration_ms, error_type?, error_code? }`. The schema is intentionally narrow — tool parameters and Graph response bodies are NEVER recorded, and error messages are reduced to `error_type` / `error_code` so upstream library errors do not leak token fragments or query-string PII. Forms the "who accessed what, when" trail required for GDPR / HIPAA / PIPEDA / SOC 2 audit. Opt-out: `MS365_MCP_AUDIT_LOG=false`
+- **Structured audit log**: enabled by default. Every tool invocation emits one JSON line on stderr (captured by the container platform's log collector) and to `~/.ms-365-mcp-server/logs/audit.log` (mode `0o600`) with `{ event, request_id, user_principal_name, tool, http_method, status, duration_ms, target_resource?, error_type?, error_code? }`. When an audited generated Microsoft Graph tool targets a derivable resource through an ID-like path parameter such as `{message-id}` or `{driveItem-id}`, `target_resource` is `{ type, id }`, where `id` is the Graph path up to that resource ID. Later path parameters such as `{path}`, query values, tool parameters, returned content, and Graph response bodies are NEVER recorded, and error messages are reduced to `error_type` / `error_code` so upstream library errors do not leak token fragments or query-string PII. Forms the "who accessed what, when" trail required for GDPR / HIPAA / PIPEDA / SOC 2 audit. Opt-out: `MS365_MCP_AUDIT_LOG=false`
 - **Graph resilience**: every call to Microsoft Graph is wrapped with a fetch timeout (default 100 s via `MS365_MCP_GRAPH_TIMEOUT_MS`), retry-with-backoff on 429 / 503 / 504 / network errors (default 3 retries, full-jitter exponential backoff, honours `Retry-After`; 503 / 504 / network errors only retried for idempotent methods, 429 retried on all methods), and a process-wide circuit breaker that opens after 5 consecutive failures and cools down for 30 s (`MS365_MCP_GRAPH_CIRCUIT_THRESHOLD` / `MS365_MCP_GRAPH_CIRCUIT_COOLDOWN_MS`). Disable the breaker for trusted automation: `MS365_MCP_GRAPH_CIRCUIT_DISABLED=true`
 - **Confirm gate on destructive tools**: opt-in, **off by default**. Enable with `MS365_MCP_REQUIRE_CONFIRM=true`. When on, destructive tools (POST except `readOnly`, PATCH, PUT, DELETE — `delete-mail-message`, `send-mail`, `update-event`, etc.) return `{ "error": "confirmation_required" }` until the caller re-invokes them with `"confirm": true`. Mitigates accidental writes when an LLM misroutes a request or follows an injected instruction. Shipped opt-in so it is a non-breaking, additive layer that can coexist with client-side elicitation prompts (MCP Elicitation API) where the client supports them.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.135.0",
+  "version": "0.137.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",