@softeria/ms-365-mcp-server 0.136.0 → 0.137.0

package/.env.example

@@ -1,5 +1,10 @@
 # Microsoft 365 OAuth Configuration
 # Create an Azure AD app registration and get these values:
+#
+# NOTE: .env is read from the directory the server is started in, which the MCP
+# client picks. Only the four variables below are read from it. Everything else
+# (token cache paths, the auth-cache command, Key Vault, logging, HTTP settings)
+# must be set in your shell or MCP client config.
 
 # Your Azure AD App Registration Client ID
 MS365_MCP_CLIENT_ID=your-azure-ad-app-client-id-here
@@ -38,7 +43,8 @@ MS365_MCP_TENANT_ID=common
 # When set, secrets are fetched from Azure Key Vault instead of environment variables.
 # This is useful for production deployments, especially with Azure Container Apps.
 #
-# MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
+# Not read from .env - export MS365_MCP_KEYVAULT_URL in the environment instead:
+#   export MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
 #
 # Key Vault secret names (store these in your Key Vault):
 #   - ms365-mcp-client-id     (required)
@@ -58,8 +64,10 @@ MS365_MCP_TENANT_ID=common
 # -------------------------------------------------------------------
 # Headless local-MSAL deployments can store token-cache and selected-account
 # metadata with a provider-neutral executable wrapper. The value is a real
-# executable path, not a shell command string; put any provider-specific args
-# inside the wrapper script.
+# executable path (absolute), not a shell command string; put any
+# provider-specific args inside the wrapper script.
 #
-# MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
-# MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000
+# This one starts a process, so it is deliberately NOT read from .env. Export it
+# in the environment that launches the server:
+#   export MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
+#   export MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000

package/README.md

@@ -440,6 +440,11 @@ registration:
 
 With these configured, the server will use your custom Azure app instead of the built-in one.
 
+> **Note**: `.env` is read from the directory the server is started in, and the MCP client decides what
+> that is. Only `MS365_MCP_CLIENT_ID`, `MS365_MCP_CLIENT_SECRET`, `MS365_MCP_TENANT_ID` and
+> `MS365_MCP_CLOUD_TYPE` are read from it. Every other variable listed above must be set in your shell
+> or MCP client config; anything else found in a `.env` is ignored with a warning on stderr.
+
 #### 3. Bring Your Own Token (BYOT)
 
 If you are running ms-365-mcp-server as part of a larger system that manages Microsoft OAuth tokens externally, you can

package/dist/generated/client.js

@@ -844,8 +844,8 @@ const microsoft_graph_driveItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   audio: microsoft_graph_audio.optional(),
   bundle: microsoft_graph_bundle.optional(),
   cTag: z.string().describe(
@@ -2584,8 +2584,8 @@ const microsoft_graph_listItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   contentType: microsoft_graph_contentTypeInfo.optional(),
   deleted: microsoft_graph_deleted.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2593,7 +2593,7 @@ const microsoft_graph_listItem = z.object({
   documentSetVersions: z.array(microsoft_graph_documentSetVersion).describe("Version information for a document set version created by a user.").optional(),
   driveItem: microsoft_graph_driveItem.describe("[Note: Simplified from 45 properties to 25 most common ones]").optional(),
   fields: microsoft_graph_fieldValueSet.optional(),
-  permissions: z.array(microsoft_graph_permission).optional(),
+  permissions: z.array(microsoft_graph_permission).describe("The set of permissions for the item. Read-only. Nullable.").optional(),
   versions: z.array(microsoft_graph_listItemVersion).describe("The list of previous versions of the list item.").optional()
 }).passthrough();
 const microsoft_graph_longRunningOperationStatus = z.enum([
@@ -2706,8 +2706,8 @@ const microsoft_graph_list = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
     displayName: z.string().describe("The displayable title of the list.").nullish(),
     list: microsoft_graph_listInfo.optional(),
     sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2717,7 +2717,7 @@ const microsoft_graph_list = z.lazy(
     drive: microsoft_graph_drive.optional(),
     items: z.array(microsoft_graph_listItem).describe("All items contained in the list.").optional(),
     operations: z.array(microsoft_graph_richLongRunningOperation).describe("The collection of long-running operations on the list.").optional(),
-    permissions: z.array(microsoft_graph_permission).optional(),
+    permissions: z.array(microsoft_graph_permission).describe("The set of permissions for the item. Read-only. Nullable.").optional(),
     subscriptions: z.array(microsoft_graph_subscription).describe("The set of subscriptions on the list.").optional()
   }).passthrough()
 );
@@ -2739,8 +2739,8 @@ const microsoft_graph_drive = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
     driveType: z.string().describe(
       "Describes the type of drive represented by this resource. OneDrive personal drives return personal. OneDrive for Business returns business. SharePoint document libraries return documentLibrary. Read-only."
     ).nullish(),
@@ -3014,7 +3014,7 @@ const microsoft_graph_team = z.lazy(
     ).nullish(),
     allChannels: z.array(microsoft_graph_channel).describe("List of channels either hosted in or shared with the team (incoming channels).").optional(),
     channels: z.array(microsoft_graph_channel).describe("The collection of channels and messages associated with the team.").optional(),
-    group: microsoft_graph_group.describe("[Note: Simplified from 80 properties to 25 most common ones]").optional(),
+    group: microsoft_graph_group.describe("[Note: Simplified from 81 properties to 25 most common ones]").optional(),
     incomingChannels: z.array(microsoft_graph_channel).describe("List of channels shared with the team.").optional(),
     installedApps: z.array(microsoft_graph_teamsAppInstallation).describe("The apps installed in this team.").optional(),
     members: z.array(microsoft_graph_conversationMember).describe("Members and owners of the team.").optional(),
@@ -3586,6 +3586,13 @@ const microsoft_graph_chatInfo = z.object({
 const microsoft_graph_chatRestrictions = z.object({
   allowTextOnly: z.boolean().describe("Indicates whether only text is allowed in the meeting chat. Optional.").nullish()
 }).passthrough();
+const microsoft_graph_cloudVideoInteropInfo = z.object({
+  moreInfoWebUrl: z.string().describe("Provides other video teleconferencing (VTC) dial-in options. Read-only.").nullish(),
+  tenantKey: z.string().describe(
+    "The tenant key that is used to dial into the interactive voice response (IVR) of the partner CVI service."
+  ).nullish(),
+  videoTeleconferenceId: z.string().describe("The video teleconferencing ID. Read-only.").nullish()
+}).passthrough();
 const microsoft_graph_joinMeetingIdSettings = z.object({
   isPasscodeRequired: z.boolean().describe(
     "Indicates whether a passcode is required to join a meeting when using joinMeetingId. Optional."
@@ -3617,6 +3624,7 @@ const microsoft_graph_onlineMeeting = z.object({
   audioConferencing: microsoft_graph_audioConferencing.optional(),
   chatInfo: microsoft_graph_chatInfo.optional(),
   chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+  cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
   expiryDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
@@ -3625,8 +3633,7 @@ const microsoft_graph_onlineMeeting = z.object({
   isEndToEndEncryptionEnabled: z.boolean().describe("Indicates whether end-to-end encryption (E2EE) is enabled for the online meeting.").nullish(),
   isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
   joinInformation: microsoft_graph_itemBody.optional(),
-  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-  joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
 }).passthrough().passthrough();
 const microsoft_graph_onlineMeetingCollectionResponse = z.object({
   "@odata.count": z.number().int().nullable(),
@@ -4549,8 +4556,8 @@ const microsoft_graph_baseItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional()
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional()
 }).passthrough();
 const microsoft_graph_site = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
@@ -4571,8 +4578,8 @@ const microsoft_graph_site = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   isPersonalSite: z.boolean().describe("Identifies whether the site is personal or not. Read-only.").nullish(),
   root: microsoft_graph_root.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -4692,6 +4699,7 @@ const microsoft_graph_virtualEventSession = z.object({
   audioConferencing: microsoft_graph_audioConferencing.optional(),
   chatInfo: microsoft_graph_chatInfo.optional(),
   chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+  cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
   expiryDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
@@ -4700,8 +4708,7 @@ const microsoft_graph_virtualEventSession = z.object({
   isEndToEndEncryptionEnabled: z.boolean().describe("Indicates whether end-to-end encryption (E2EE) is enabled for the online meeting.").nullish(),
   isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
   joinInformation: microsoft_graph_itemBody.optional(),
-  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-  joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
 }).passthrough().passthrough();
 const microsoft_graph_meetingAudience = z.enum(["everyone", "organization", "unknownFutureValue"]);
 const microsoft_graph_communicationsUserIdentity = z.object({
@@ -4723,10 +4730,14 @@ const microsoft_graph_virtualEventRegistrationQuestionBase = z.object({
 const microsoft_graph_virtualEventWebinarRegistrationConfiguration = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
   capacity: z.number().gte(-2147483648).lte(2147483647).describe("Total capacity of the virtual event.").nullish(),
+  isManualApprovalEnabled: z.boolean().describe(
+    "Indicates whether registrations require organizer approval before a participant is confirmed."
+  ).nullish(),
+  isWaitlistEnabled: z.boolean().describe(
+    "Indicates whether more registrants are automatically placed on a waitlist when capacity is reached."
+  ).nullish(),
   registrationWebUrl: z.string().describe("Registration URL of the virtual event.").nullish(),
-  questions: z.array(microsoft_graph_virtualEventRegistrationQuestionBase).describe("Registration questions.").optional(),
-  isManualApprovalEnabled: z.boolean().nullish(),
-  isWaitlistEnabled: z.boolean().nullish()
+  questions: z.array(microsoft_graph_virtualEventRegistrationQuestionBase).describe("Registration questions.").optional()
 }).passthrough();
 const microsoft_graph_virtualEventRegistrationQuestionAnswer = z.object({
   booleanValue: z.boolean().describe(
@@ -4783,6 +4794,7 @@ const microsoft_graph_virtualEventWebinar = z.object({
   externalEventInformation: z.array(microsoft_graph_virtualEventExternalInformation).describe(
     "The external information of a virtual event. Returned only for event organizers or coorganizers; otherwise, null."
   ).optional(),
+  isRegistrationRequired: z.boolean().describe("Indicates whether attendee registration is enabled for the virtual event.").nullish(),
   settings: microsoft_graph_virtualEventSettings.optional(),
   startDateTime: microsoft_graph_dateTimeTimeZone.optional(),
   status: microsoft_graph_virtualEventStatus.optional(),
@@ -5212,6 +5224,7 @@ const schemas = {
   microsoft_graph_audioConferencing,
   microsoft_graph_chatInfo,
   microsoft_graph_chatRestrictions,
+  microsoft_graph_cloudVideoInteropInfo,
   microsoft_graph_joinMeetingIdSettings,
   microsoft_graph_onlineMeeting,
   microsoft_graph_onlineMeetingCollectionResponse,
@@ -5865,8 +5878,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -5980,8 +5993,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -11185,6 +11198,7 @@ resource.`,
           audioConferencing: microsoft_graph_audioConferencing.optional(),
           chatInfo: microsoft_graph_chatInfo.optional(),
           chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+          cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
           expiryDateTime: z.string().regex(
             /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
           ).datetime({ offset: true }).describe(
@@ -11195,8 +11209,7 @@ resource.`,
           ).nullish(),
           isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
           joinInformation: microsoft_graph_itemBody.optional(),
-          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-          joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
         }).passthrough().passthrough()
       }
     ],
@@ -11257,6 +11270,7 @@ resource.`,
           audioConferencing: microsoft_graph_audioConferencing.optional(),
           chatInfo: microsoft_graph_chatInfo.optional(),
           chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+          cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
           expiryDateTime: z.string().regex(
             /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
           ).datetime({ offset: true }).describe(
@@ -11267,8 +11281,7 @@ resource.`,
           ).nullish(),
           isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
           joinInformation: microsoft_graph_itemBody.optional(),
-          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-          joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
         }).passthrough().passthrough()
       }
     ],

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "dotenv/config";
+import { loadEnvFile } from "./load-env.js";
 import { parseArgs } from "./cli.js";
 import logger from "./logger.js";
 import AuthManager, { buildAllowedScopeDiagnostics, resolveAuthScopes } from "./auth.js";
@@ -33,6 +33,7 @@ process.on("uncaughtException", (err, origin) => {
 });
 async function main() {
   try {
+    loadEnvFile();
     const args = parseArgs();
     const includeWorkScopes = args.orgMode || false;
     if (includeWorkScopes) {

package/dist/load-env.js

@@ -0,0 +1,41 @@
+import { parse } from "dotenv";
+import fs from "node:fs";
+import path from "node:path";
+const ENV_FILE_ALLOWLIST = [
+  "MS365_MCP_CLIENT_ID",
+  "MS365_MCP_CLIENT_SECRET",
+  "MS365_MCP_TENANT_ID",
+  "MS365_MCP_CLOUD_TYPE"
+];
+function loadEnvFile(options = {}) {
+  const file = options.path ?? path.resolve(process.cwd(), ".env");
+  let fromFile = {};
+  try {
+    fromFile = parse(fs.readFileSync(file, "utf8"));
+  } catch {
+  }
+  const applied = [];
+  const ignored = [];
+  for (const [key, value] of Object.entries(fromFile)) {
+    if (!ENV_FILE_ALLOWLIST.includes(key)) {
+      ignored.push(key);
+      continue;
+    }
+    if (process.env[key] !== void 0) {
+      continue;
+    }
+    process.env[key] = value;
+    applied.push(key);
+  }
+  const ignoredOwn = ignored.filter((key) => key.startsWith("MS365_MCP_"));
+  if (ignoredOwn.length > 0) {
+    console.error(
+      `[ms365-mcp] Ignored ${ignoredOwn.length} variable(s) from .env: ${[...ignoredOwn].sort().join(", ")}. Only ${ENV_FILE_ALLOWLIST.join(", ")} are read from .env - set anything else in your shell or MCP client config.`
+    );
+  }
+  return { applied, ignored };
+}
+export {
+  ENV_FILE_ALLOWLIST,
+  loadEnvFile
+};

package/dist/token-cache-storage.js

@@ -289,6 +289,9 @@ function parseTimeoutMs(value) {
   return parsed;
 }
 async function assertCommandUsable(commandPath) {
+  if (!path.isAbsolute(commandPath)) {
+    throw new Error(`${AUTH_CACHE_COMMAND_ENV} must be an absolute path.`);
+  }
   let stats;
   try {
     stats = await fs.promises.stat(commandPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.136.0",
+  "version": "0.137.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",