@softeria/ms-365-mcp-server 0.141.0 → 0.143.0

package/README.md

@@ -539,9 +539,9 @@ npx @softeria/ms-365-mcp-server --preset mail
 npx @softeria/ms-365-mcp-server --list-presets  # See all available presets
 ```
 
-Available presets: `mail`, `calendar`, `files`, `personal`, `work`, `excel`, `contacts`, `tasks`, `onenote`, `search`, `users`, `outlook`, `onedrive`, `teams`, `all`
+Available presets: `mail`, `calendar`, `files`, `personal`, `work`, `excel`, `contacts`, `tasks`, `onenote`, `search`, `users`, `outlook`, `onedrive`, `teams`, `teams-write`, `all`
 
-Each endpoint in `endpoints.json` declares which presets it belongs to via a `presets` array, so every preset is an exact tool-name allow-list that never over-matches across apps (e.g. `mail` does not include shared-mailbox tools; those are in `work`). The universal binary reader `download-bytes` is included in every preset, so whatever an app returns (a file, an attachment, a photo, a recording) can always be fetched; `get-download-url` (a pre-authenticated URL for drive/SharePoint files) rides with the drive-backed presets. So a preset that can find a file can always read its bytes.
+Each endpoint in `endpoints.json` declares which presets it belongs to via a `presets` array, so every preset is an exact tool-name allow-list that never over-matches across apps (e.g. `mail` does not include shared-mailbox tools; those are in `work`). The universal binary reader `download-bytes` is included in every preset except `teams-write`, so whatever an app returns (a file, an attachment, a photo, a recording) can always be fetched; `get-download-url` (a pre-authenticated URL for drive/SharePoint files) rides with the drive-backed presets. So a preset that can find a file can always read its bytes.
 
 The `outlook`, `onedrive` and `teams` presets are app-scoped: they expose exactly one Microsoft app. Use these for "expose exactly one app" deployments:
 
@@ -553,6 +553,12 @@ npx @softeria/ms-365-mcp-server --preset outlook
 npx @softeria/ms-365-mcp-server --org-mode --preset teams
 ```
 
+The `teams-write` preset is the send-only counterpart to `--read-only`: send in chats, send/reply in channels, list chats/teams/channels by name, and activity notifications - no message reading and no byte downloaders. The requested token is minimal by construction (`Chat.ReadBasic`, the `*.Send` scopes, and basic team/channel listing - nothing that can read message content):
+
+```bash
+npx @softeria/ms-365-mcp-server --org-mode --preset teams-write
+```
+
 ## Dynamic Tool Discovery
 
 Instead of loading every tool upfront, use dynamic discovery so the LLM finds and loads tools only when it needs them:
@@ -613,6 +619,8 @@ Environment variables:
 - `MS365_MCP_MAX_ITEMS=<n>`: Maximum number of items accumulated when `fetchAllPages: true` (positive integer, default `10000`). Pagination stops and the response is truncated once this many items are collected.
 - `MS365_MCP_ALLOW_PAGINATION=0|false|no`: Disable multi-page following entirely. When set, the `fetchAllPages` parameter is not advertised on tools, and any request that still passes it returns only the first page (default: pagination enabled).
 - `MS365_MCP_BODY_FORMAT=html`: Return email bodies as HTML instead of plain text (default: text)
+- `MS365_MCP_MESSAGE_SIGNOFF_PREFIX=<text>`: Signoff prepended to outgoing messages so recipients can tell they were agent-sent, e.g. `🤖`. Default: none. CLI equivalent: `--message-signoff-prefix <text>` (see Message Signoff below)
+- `MS365_MCP_MESSAGE_SIGNOFF_SUFFIX=<text>`: Signoff appended to outgoing messages. Default: none. CLI equivalent: `--message-signoff-suffix <text>`. `--no-message-signoff` disables both (see Message Signoff below)
 - `MS365_MCP_RATE_LIMIT_DISABLED=true|1`: Disable per-IP rate limiting in HTTP mode (default: enabled — 30 req/min on `/authorize`, `/token`, `/register`; 120 req/min on `/mcp`)
 - `MS365_MCP_TRUST_PROXY_HOPS=<n>`: Number of trusted reverse-proxy hops in HTTP mode (default `1`). Accurate per-IP rate limiting depends on this matching your deployment — set to the number of proxies in front of the server, `0` to use the raw socket peer IP, or a comma-separated subnet list
 - `MS365_MCP_CLOUD_TYPE=global|china`: Microsoft cloud environment (alternative to --cloud flag)
@@ -768,6 +776,14 @@ The Key Vault integration uses `DefaultAzureCredential` from the Azure Identity
 
 The Azure Key Vault packages (`@azure/identity` and `@azure/keyvault-secrets`) are optional dependencies. They are only loaded when `MS365_MCP_KEYVAULT_URL` is configured. If you don't use Key Vault, these packages are not required.
 
+## Message Signoff
+
+Outgoing messages can be wrapped in a configurable signoff (e.g. a `🤖` prefix) so recipients can tell agent-sent messages from ones you typed yourself. Off by default — enable it with `--message-signoff-prefix` / `--message-signoff-suffix` (env: `MS365_MCP_MESSAGE_SIGNOFF_PREFIX` / `MS365_MCP_MESSAGE_SIGNOFF_SUFFIX`); `--no-message-signoff` or an empty env value turns it back off.
+
+Once configured, it applies to all Teams messages (sends, replies and edits, including via `graph-batch`), to direct mail sends (`send-mail`, reply/forward, their shared-mailbox variants, and group thread replies), and to mail drafts as their content is written — `send-draft-message` sends a draft as-is, so a draft you wrote yourself goes out untouched. A message that already carries the marker is not signed twice, and a send whose body cannot take the signoff is refused rather than sent unsigned.
+
+Markers may contain markup (e.g. a coloured `<span>`) as long as it renders visible text. Note that the signoff is a guardrail against an agent misusing the tools it was given, not a hard security boundary — an agent with shell access on the same machine could simply restart the server without it.
+
 ## Production Deployment
 
 See [docs/deployment.md](docs/deployment.md) for a full guide to hosting the server for organization-wide access, including Docker, Azure Container Apps, Azure App Service, Azure AD app registration, reverse proxy setup, client configuration, and exposed endpoints.

package/dist/auth.js

@@ -62,6 +62,8 @@ function buildDiskCoherencyCachePlugin(storage) {
   };
 }
 const SCOPE_HIERARCHY = {
+  "Chat.ReadWrite": ["Chat.Read", "Chat.ReadBasic"],
+  "Chat.Read": ["Chat.ReadBasic"],
   "Mail.ReadWrite": ["Mail.Read"],
   "Calendars.ReadWrite": ["Calendars.Read"],
   "Files.ReadWrite": ["Files.Read"],
@@ -137,7 +139,7 @@ function getEndpointEffectiveLoginScopes(scopeGroups, allowedScopes) {
 function collapseRedundantScopes(scopes) {
   const scopesSet = new Set(scopes);
   Object.entries(SCOPE_HIERARCHY).forEach(([higherScope, lowerScopes]) => {
-    if (scopesSet.has(higherScope) && lowerScopes.every((scope) => scopesSet.has(scope))) {
+    if (scopesSet.has(higherScope)) {
       lowerScopes.forEach((scope) => scopesSet.delete(scope));
     }
   });

package/dist/cli.js

@@ -3,6 +3,7 @@ import { readFileSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { getCombinedPresetPattern, listPresets, presetRequiresOrgMode } from "./tool-categories.js";
+import { assertSignoffMarkersVisible } from "./lib/message-signoff.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, "..", "package.json");
 const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
@@ -15,6 +16,12 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
   "--expected-home-account-id <id>",
   "Require local MSAL authentication to use this exact MSAL homeAccountId"
 ).option("--read-only", "Start server in read-only mode, disabling write operations").option(
+  "--message-signoff-prefix <text>",
+  "Signoff prepended to outgoing messages (Teams sends, replies and edits; mail sends and drafts) so recipients can tell they were agent-sent, e.g. \u{1F916} (default: none). Equivalent env var: MS365_MCP_MESSAGE_SIGNOFF_PREFIX."
+).option(
+  "--message-signoff-suffix <text>",
+  "Signoff appended to outgoing messages (default: none). Equivalent env var: MS365_MCP_MESSAGE_SIGNOFF_SUFFIX."
+).option("--no-message-signoff", "Disable both message signoffs, overriding the env vars.").option(
   "--http [address]",
   'Use Streamable HTTP transport instead of stdio. Format: [host:]port (e.g., "localhost:3000", ":3000", "3000"). Default: all interfaces on port 3000'
 ).option(
@@ -31,7 +38,7 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
   "Append additional Graph scopes (whitespace-separated) to the token request, beyond those derived from enabled tools. Use with your own app registration (MS365_MCP_CLIENT_ID/SECRET) to request scopes the default app does not declare, then call the endpoints via graph-batch."
 ).option(
   "--preset <names>",
-  "Use preset tool categories (comma-separated). Available: mail, calendar, files, personal, work, excel, contacts, tasks, onenote, search, users, all"
+  "Use preset tool categories (comma-separated). Available: mail, calendar, files, personal, work, excel, contacts, tasks, onenote, search, users, outlook, onedrive, teams, teams-write, all"
 ).option("--list-presets", "List all available presets and exit").option("--list-permissions", "List all required Graph API permissions and exit").option(
   "--org-mode",
   "Enable organization/work mode from start (includes Teams, SharePoint, etc.)"
@@ -65,6 +72,17 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 function parseArgs() {
   program.parse();
   const options = program.opts();
+  if (typeof options.messageSignoffSuffix === "string") {
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_SUFFIX = options.messageSignoffSuffix;
+  }
+  if (typeof options.messageSignoffPrefix === "string") {
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_PREFIX = options.messageSignoffPrefix;
+  }
+  if (options.messageSignoff === false) {
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_SUFFIX = "";
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_PREFIX = "";
+  }
+  assertSignoffMarkersVisible();
   if (options.listPresets) {
     const presets = listPresets();
     console.log(JSON.stringify({ presets }, null, 2));

package/dist/endpoints.json

@@ -1559,15 +1559,15 @@
     "pathPattern": "/me/chats",
     "method": "get",
     "toolName": "list-chats",
-    "presets": ["teams", "work"],
-    "workScopes": [["Chat.Read"], ["Chat.ReadBasic"]]
+    "presets": ["teams", "teams-write", "work"],
+    "workScopes": ["Chat.ReadBasic"]
   },
   {
     "pathPattern": "/chats/{chat-id}",
     "method": "get",
     "toolName": "get-chat",
-    "presets": ["teams", "work"],
-    "workScopes": [["Chat.Read"], ["Chat.ReadBasic"]]
+    "presets": ["teams", "teams-write", "work"],
+    "workScopes": ["Chat.ReadBasic"]
   },
   {
     "pathPattern": "/chats/{chat-id}/members",
@@ -1610,7 +1610,7 @@
     "pathPattern": "/chats/{chat-id}/messages",
     "method": "post",
     "toolName": "send-chat-message",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["ChatMessage.Send"],
     "llmTip": "Use contentType 'html' in the body — plain text contentType gets mangled by Graph API. To @mention someone, put an <at id=\"0\">Name</at> tag in the html content and add a mentions array to the request body, as a sibling of the body property (not a separate top-level tool parameter): { body: { contentType: 'html', content: 'Hi <at id=\"0\">Name</at>' }, mentions: [{ id: 0, mentionText: 'Name', mentioned: { user: { id: '<aad-user-id>', displayName: 'Name', userIdentityType: 'aadUser' } } }] }. Each mention id must match its <at id> value; include userIdentityType: 'aadUser' or Graph returns 400 'value without a type name'."
   },
@@ -1618,28 +1618,28 @@
     "pathPattern": "/me/joinedTeams",
     "method": "get",
     "toolName": "list-joined-teams",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Team.ReadBasic.All"]
   },
   {
     "pathPattern": "/teams/{team-id}",
     "method": "get",
     "toolName": "get-team",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Team.ReadBasic.All"]
   },
   {
     "pathPattern": "/teams/{team-id}/channels",
     "method": "get",
     "toolName": "list-team-channels",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Channel.ReadBasic.All"]
   },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}",
     "method": "get",
     "toolName": "get-team-channel",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Channel.ReadBasic.All"]
   },
   {
@@ -1696,7 +1696,7 @@
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages",
     "method": "post",
     "toolName": "send-channel-message",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["ChannelMessage.Send"],
     "llmTip": "Use contentType 'html' in the body — plain text contentType gets mangled by Graph API. To @mention someone, put an <at id=\"0\">Name</at> tag in the html content and add a mentions array to the request body, as a sibling of the body property (not a separate top-level tool parameter): { body: { contentType: 'html', content: 'Hi <at id=\"0\">Name</at>' }, mentions: [{ id: 0, mentionText: 'Name', mentioned: { user: { id: '<aad-user-id>', displayName: 'Name', userIdentityType: 'aadUser' } } }] }. Each mention id must match its <at id> value; include userIdentityType: 'aadUser' or Graph returns 400 'value without a type name'."
   },
@@ -1704,7 +1704,7 @@
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/replies",
     "method": "post",
     "toolName": "reply-to-channel-message",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["ChannelMessage.Send"],
     "llmTip": "Use contentType 'html' in the body — plain text contentType gets mangled by Graph API. To @mention someone, put an <at id=\"0\">Name</at> tag in the html content and add a mentions array to the request body, as a sibling of the body property (not a separate top-level tool parameter): { body: { contentType: 'html', content: 'Hi <at id=\"0\">Name</at>' }, mentions: [{ id: 0, mentionText: 'Name', mentioned: { user: { id: '<aad-user-id>', displayName: 'Name', userIdentityType: 'aadUser' } } }] }. Each mention id must match its <at id> value; include userIdentityType: 'aadUser' or Graph returns 400 'value without a type name'."
   },
@@ -2726,7 +2726,7 @@
     "pathPattern": "/me/teamwork/sendActivityNotification",
     "method": "post",
     "toolName": "send-my-activity-notification",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["TeamsActivity.Send"],
     "contentType": "application/json",
     "llmTip": "Sends a Teams activity feed notification to the current user (the badge + entry in their Activity tab). Body: { topic: { source: 'entityUrl' | 'text', value: <Graph URL or plain text>, webUrl: <required when source='text', click-through URL> }, activityType: <must be declared in the calling Teams app's manifest, OR the reserved 'systemDefault' which provides free-form Actor+Reason text>, previewText: { content: 'short preview' }, templateParameters?: [{ name, value }] (substituted into the manifest's localized notification template), teamsAppId?: <optional disambiguator when multiple installed apps share a Microsoft Entra app ID — fetch via list-my-installed-teams-apps>, chainId?, iconId? }. Use to ping the user with 'action required' notifications from agentic workflows. See https://learn.microsoft.com/graph/teams-send-activityfeednotifications."

package/dist/graph-client.js

@@ -7,6 +7,7 @@ import {
   getSharedBreaker,
   loadResilienceConfig
 } from "./lib/graph-resilience.js";
+import { applyMessageSignoffToRequest } from "./lib/message-signoff.js";
 import { open, stat, unlink } from "fs/promises";
 import { pipeline } from "stream/promises";
 function isBinaryContentType(contentType) {
@@ -166,6 +167,8 @@ class GraphClient {
     const apiVersion = options.apiVersion || "v1.0";
     const url = `${cloudEndpoints.graphApi}/${apiVersion}${endpoint}`;
     logger.info(`[GRAPH CLIENT] Final URL being sent to Microsoft: ${url}`);
+    const method = options.method || "GET";
+    const body = applyMessageSignoffToRequest(method, endpoint, options.body);
     const headers = {
       Authorization: `Bearer ${accessToken}`,
       "Content-Type": "application/json",
@@ -174,10 +177,10 @@ class GraphClient {
     return fetchWithResilience(
       url,
       {
-        method: options.method || "GET",
+        method,
         headers,
         // Node's fetch accepts Buffer/Uint8Array; TS BodyInit doesn't.
-        body: options.body
+        body
       },
       loadResilienceConfig(),
       getSharedBreaker()

package/dist/lib/message-signoff.js

@@ -0,0 +1,230 @@
+import { parseFragment, serialize } from "parse5";
+class MessageSignoffError extends Error {
+  constructor(target, reason) {
+    super(
+      `${target}: a message signoff is configured but could not be applied - ${reason}. Provide the message as { body: { contentType, content } }, or disable the signoff (--no-message-signoff / unset the MS365_MCP_MESSAGE_SIGNOFF_* env vars).`
+    );
+    this.name = "MessageSignoffError";
+  }
+}
+function resolveEnvText(name, defaultValue) {
+  const raw = process.env[name];
+  if (raw === void 0) {
+    return defaultValue;
+  }
+  const trimmed = raw.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function resolveMessageSignoffPrefix() {
+  return resolveEnvText("MS365_MCP_MESSAGE_SIGNOFF_PREFIX");
+}
+function resolveMessageSignoffSuffix() {
+  return resolveEnvText("MS365_MCP_MESSAGE_SIGNOFF_SUFFIX");
+}
+function renderedText(html) {
+  const collect = (node) => node.nodeName === "#text" ? node.value ?? "" : (node.childNodes ?? []).map(collect).join("");
+  return collect(parseFragment(html));
+}
+function assertSignoffMarkersVisible() {
+  for (const [name, marker] of [
+    ["MS365_MCP_MESSAGE_SIGNOFF_PREFIX", resolveMessageSignoffPrefix()],
+    ["MS365_MCP_MESSAGE_SIGNOFF_SUFFIX", resolveMessageSignoffSuffix()]
+  ]) {
+    if (marker === void 0 || !marker.includes("<")) continue;
+    if (renderedText(marker).trim() === "") {
+      throw new Error(
+        `${name} ("${marker}") renders as empty text in html messages, so the signoff would be invisible. Put visible text inside the markup (e.g. <span style="color:gray">\u{1F916}</span>) or use plain text.`
+      );
+    }
+  }
+}
+function markerAlreadyAt(content, marker, isHtml, at) {
+  const text = isHtml ? renderedText(content) : content;
+  const markerText = (isHtml ? renderedText(marker) : marker).trim();
+  if (markerText === "") return false;
+  return at === "start" ? text.trimStart().startsWith(markerText) : text.trimEnd().endsWith(markerText);
+}
+function signContent(content, isHtml, prefix, suffix) {
+  let signed = content;
+  if (suffix !== void 0 && !markerAlreadyAt(signed, suffix, isHtml, "end")) {
+    signed = `${isHtml ? serialize(parseFragment(signed)) : signed} ${suffix}`;
+  }
+  if (prefix !== void 0 && !markerAlreadyAt(signed, prefix, isHtml, "start")) {
+    signed = `${prefix} ${signed}`;
+  }
+  return signed;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function signItemBodyContainer(target, payload, prefix, suffix) {
+  const message = payload.body;
+  if (!isPlainObject(message)) {
+    throw new MessageSignoffError(target, "the body has no nested body (itemBody) object");
+  }
+  const content = message.content;
+  if (typeof content !== "string") {
+    throw new MessageSignoffError(target, "the body has no content string");
+  }
+  const contentType = message.contentType;
+  const isHtml = typeof contentType === "string" && contentType.toLowerCase() === "html";
+  return {
+    ...payload,
+    body: { ...message, content: signContent(content, isHtml, prefix, suffix) }
+  };
+}
+function signMessageSend(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload)) {
+    throw new MessageSignoffError(target, "the body is not a chatMessage object");
+  }
+  return signItemBodyContainer(target, payload, prefix, suffix);
+}
+function signWhenBodyPresent(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload) || payload.body === void 0) return payload;
+  return signItemBodyContainer(target, payload, prefix, suffix);
+}
+function signReplyForwardDraft(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload)) return payload;
+  let signed = payload;
+  if (typeof signed.comment === "string" && signed.comment.trim() !== "") {
+    signed = { ...signed, comment: signContent(signed.comment, false, prefix, suffix) };
+  }
+  const message = signed.message;
+  if (isPlainObject(message) && message.body !== void 0) {
+    signed = { ...signed, message: signItemBodyContainer(target, message, prefix, suffix) };
+  }
+  return signed;
+}
+function signSendMail(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload) || !isPlainObject(payload.message)) {
+    throw new MessageSignoffError(target, "the body has no message object");
+  }
+  return { ...payload, message: signItemBodyContainer(target, payload.message, prefix, suffix) };
+}
+function signGroupThreadReply(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload) || !isPlainObject(payload.post)) {
+    throw new MessageSignoffError(target, "the body has no post object");
+  }
+  return { ...payload, post: signItemBodyContainer(target, payload.post, prefix, suffix) };
+}
+const SIGNOFF_RULES = [
+  // Teams sends and replies
+  { method: "POST", pattern: /^\/chats\/[^/]+\/messages$/, apply: signMessageSend },
+  { method: "POST", pattern: /^\/chats\/[^/]+\/messages\/[^/]+\/replies$/, apply: signMessageSend },
+  {
+    method: "POST",
+    pattern: /^\/teams\/[^/]+\/channels\/[^/]+\/messages$/,
+    apply: signMessageSend
+  },
+  {
+    method: "POST",
+    pattern: /^\/teams\/[^/]+\/channels\/[^/]+\/messages\/[^/]+\/replies$/,
+    apply: signMessageSend
+  },
+  // Teams edits - a PATCH rewriting body.content must keep the signoff
+  { method: "PATCH", pattern: /^\/chats\/[^/]+\/messages\/[^/]+$/, apply: signWhenBodyPresent },
+  {
+    method: "PATCH",
+    pattern: /^\/teams\/[^/]+\/channels\/[^/]+\/messages\/[^/]+(?:\/replies\/[^/]+)?$/,
+    apply: signWhenBodyPresent
+  },
+  // Mail drafts - send-draft-message (POST .../send) carries no body to sign,
+  // so draft content is signed where it is written instead
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)(?:\/mailFolders\/[^/]+)?\/messages$/,
+    apply: signWhenBodyPresent
+  },
+  {
+    method: "PATCH",
+    pattern: /^\/(?:me|users\/[^/]+)(?:\/mailFolders\/[^/]+)?\/messages\/[^/]+$/,
+    apply: signWhenBodyPresent
+  },
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)\/messages\/[^/]+\/create(?:Reply|ReplyAll|Forward)$/,
+    apply: signReplyForwardDraft
+  },
+  // Direct mail sends - straight out with no draft step, so they are signed
+  // (and fail closed) like a Teams send. Covers the /users/{id} shared-mailbox
+  // variants of each
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)\/sendMail$/,
+    apply: signSendMail
+  },
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)\/messages\/[^/]+\/(?:reply|replyAll|forward)$/,
+    apply: signReplyForwardDraft
+  },
+  {
+    method: "POST",
+    pattern: /^\/groups\/[^/]+\/threads\/[^/]+\/reply$/,
+    apply: signGroupThreadReply
+  }
+];
+function normalizePath(path) {
+  let clean = path.split("?")[0];
+  clean = clean.replace(/^\/(?:v1\.0|beta)(?=\/)/, "");
+  if (!clean.startsWith("/")) clean = `/${clean}`;
+  if (clean.length > 1 && clean.endsWith("/")) clean = clean.slice(0, -1);
+  return clean;
+}
+function parseIfString(target, body) {
+  if (typeof body !== "string") return body;
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new MessageSignoffError(target, "the body is a string that is not valid JSON");
+  }
+}
+function signBatchPayload(payload, prefix, suffix) {
+  if (!isPlainObject(payload) || !Array.isArray(payload.requests)) {
+    return payload;
+  }
+  const requests = payload.requests.map((entry) => {
+    if (!isPlainObject(entry) || typeof entry.url !== "string") return entry;
+    const method = typeof entry.method === "string" ? entry.method.toUpperCase() : "";
+    const path = normalizePath(entry.url);
+    const target = `${method} ${path} (in $batch)`;
+    if (path === "/$batch") {
+      return {
+        ...entry,
+        body: signBatchPayload(parseIfString(target, entry.body), prefix, suffix)
+      };
+    }
+    const rule = SIGNOFF_RULES.find((r) => r.method === method && r.pattern.test(path));
+    if (!rule) return entry;
+    return {
+      ...entry,
+      body: rule.apply(target, parseIfString(target, entry.body), prefix, suffix)
+    };
+  });
+  return { ...payload, requests };
+}
+function applyMessageSignoffToRequest(method, path, body) {
+  const prefix = resolveMessageSignoffPrefix();
+  const suffix = resolveMessageSignoffSuffix();
+  if (prefix === void 0 && suffix === void 0) return body;
+  const upperMethod = method.toUpperCase();
+  const cleanPath = normalizePath(path);
+  const isBatch = upperMethod === "POST" && cleanPath === "/$batch";
+  const rule = isBatch ? void 0 : SIGNOFF_RULES.find((r) => r.method === upperMethod && r.pattern.test(cleanPath));
+  if (!isBatch && !rule) return body;
+  const target = `${upperMethod} ${cleanPath}`;
+  if (body !== void 0 && typeof body !== "string") {
+    throw new MessageSignoffError(target, "the body is binary, not a signable JSON payload");
+  }
+  const payload = parseIfString(target, body);
+  const signed = isBatch ? signBatchPayload(payload, prefix, suffix) : rule.apply(target, payload, prefix, suffix);
+  if (signed === payload) return body;
+  return JSON.stringify(signed);
+}
+export {
+  MessageSignoffError,
+  applyMessageSignoffToRequest,
+  assertSignoffMarkersVisible,
+  resolveMessageSignoffPrefix,
+  resolveMessageSignoffSuffix
+};

package/dist/tool-categories.js

@@ -51,12 +51,18 @@ const PRESET_META = {
   teams: {
     description: "Teams app only: chats, channels, meetings and presence",
     requiresOrgMode: true
+  },
+  "teams-write": {
+    description: "Teams send-only: send/reply in chats and channels, list chats/teams/channels by name, activity notifications - no message reading",
+    requiresOrgMode: true,
+    // A write-only preset must not include the generic byte readers.
+    omitUniversalUtilities: true
   }
 };
 const UNIVERSAL_UTILITY_TOOLS = ["download-bytes", "download-bytes-to-file"];
 const SCOPED_UTILITY_TOOLS = {
   "get-download-url": ["files", "onedrive", "personal", "work", "search"],
-  "parse-teams-url": ["teams", "work"]
+  "parse-teams-url": ["teams", "teams-write", "work"]
 };
 for (const [tool, presets] of Object.entries(SCOPED_UTILITY_TOOLS)) {
   for (const preset of presets) {
@@ -76,7 +82,7 @@ function presetPattern(preset) {
   }
   const names = [
     ...endpointNames,
-    ...UNIVERSAL_UTILITY_TOOLS,
+    ...PRESET_META[preset]?.omitUniversalUtilities ? [] : UNIVERSAL_UTILITY_TOOLS,
     ...Object.entries(SCOPED_UTILITY_TOOLS).filter(([, presets]) => presets.includes(preset)).map(([name]) => name)
   ];
   return new RegExp(`^(?:${names.join("|")})$`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.141.0",
+  "version": "0.143.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",
@@ -44,6 +44,7 @@
     "helmet": "^8.1.0",
     "js-yaml": "^4.1.0",
     "open": "^11.0.0",
+    "parse5": "^8.0.1",
     "winston": "^3.17.0",
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.25.1"

package/src/endpoints.json

@@ -1559,15 +1559,15 @@
     "pathPattern": "/me/chats",
     "method": "get",
     "toolName": "list-chats",
-    "presets": ["teams", "work"],
-    "workScopes": [["Chat.Read"], ["Chat.ReadBasic"]]
+    "presets": ["teams", "teams-write", "work"],
+    "workScopes": ["Chat.ReadBasic"]
   },
   {
     "pathPattern": "/chats/{chat-id}",
     "method": "get",
     "toolName": "get-chat",
-    "presets": ["teams", "work"],
-    "workScopes": [["Chat.Read"], ["Chat.ReadBasic"]]
+    "presets": ["teams", "teams-write", "work"],
+    "workScopes": ["Chat.ReadBasic"]
   },
   {
     "pathPattern": "/chats/{chat-id}/members",
@@ -1610,7 +1610,7 @@
     "pathPattern": "/chats/{chat-id}/messages",
     "method": "post",
     "toolName": "send-chat-message",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["ChatMessage.Send"],
     "llmTip": "Use contentType 'html' in the body — plain text contentType gets mangled by Graph API. To @mention someone, put an <at id=\"0\">Name</at> tag in the html content and add a mentions array to the request body, as a sibling of the body property (not a separate top-level tool parameter): { body: { contentType: 'html', content: 'Hi <at id=\"0\">Name</at>' }, mentions: [{ id: 0, mentionText: 'Name', mentioned: { user: { id: '<aad-user-id>', displayName: 'Name', userIdentityType: 'aadUser' } } }] }. Each mention id must match its <at id> value; include userIdentityType: 'aadUser' or Graph returns 400 'value without a type name'."
   },
@@ -1618,28 +1618,28 @@
     "pathPattern": "/me/joinedTeams",
     "method": "get",
     "toolName": "list-joined-teams",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Team.ReadBasic.All"]
   },
   {
     "pathPattern": "/teams/{team-id}",
     "method": "get",
     "toolName": "get-team",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Team.ReadBasic.All"]
   },
   {
     "pathPattern": "/teams/{team-id}/channels",
     "method": "get",
     "toolName": "list-team-channels",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Channel.ReadBasic.All"]
   },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}",
     "method": "get",
     "toolName": "get-team-channel",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["Channel.ReadBasic.All"]
   },
   {
@@ -1696,7 +1696,7 @@
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages",
     "method": "post",
     "toolName": "send-channel-message",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["ChannelMessage.Send"],
     "llmTip": "Use contentType 'html' in the body — plain text contentType gets mangled by Graph API. To @mention someone, put an <at id=\"0\">Name</at> tag in the html content and add a mentions array to the request body, as a sibling of the body property (not a separate top-level tool parameter): { body: { contentType: 'html', content: 'Hi <at id=\"0\">Name</at>' }, mentions: [{ id: 0, mentionText: 'Name', mentioned: { user: { id: '<aad-user-id>', displayName: 'Name', userIdentityType: 'aadUser' } } }] }. Each mention id must match its <at id> value; include userIdentityType: 'aadUser' or Graph returns 400 'value without a type name'."
   },
@@ -1704,7 +1704,7 @@
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/replies",
     "method": "post",
     "toolName": "reply-to-channel-message",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["ChannelMessage.Send"],
     "llmTip": "Use contentType 'html' in the body — plain text contentType gets mangled by Graph API. To @mention someone, put an <at id=\"0\">Name</at> tag in the html content and add a mentions array to the request body, as a sibling of the body property (not a separate top-level tool parameter): { body: { contentType: 'html', content: 'Hi <at id=\"0\">Name</at>' }, mentions: [{ id: 0, mentionText: 'Name', mentioned: { user: { id: '<aad-user-id>', displayName: 'Name', userIdentityType: 'aadUser' } } }] }. Each mention id must match its <at id> value; include userIdentityType: 'aadUser' or Graph returns 400 'value without a type name'."
   },
@@ -2726,7 +2726,7 @@
     "pathPattern": "/me/teamwork/sendActivityNotification",
     "method": "post",
     "toolName": "send-my-activity-notification",
-    "presets": ["teams", "work"],
+    "presets": ["teams", "teams-write", "work"],
     "workScopes": ["TeamsActivity.Send"],
     "contentType": "application/json",
     "llmTip": "Sends a Teams activity feed notification to the current user (the badge + entry in their Activity tab). Body: { topic: { source: 'entityUrl' | 'text', value: <Graph URL or plain text>, webUrl: <required when source='text', click-through URL> }, activityType: <must be declared in the calling Teams app's manifest, OR the reserved 'systemDefault' which provides free-form Actor+Reason text>, previewText: { content: 'short preview' }, templateParameters?: [{ name, value }] (substituted into the manifest's localized notification template), teamsAppId?: <optional disambiguator when multiple installed apps share a Microsoft Entra app ID — fetch via list-my-installed-teams-apps>, chainId?, iconId? }. Use to ping the user with 'action required' notifications from agentic workflows. See https://learn.microsoft.com/graph/teams-send-activityfeednotifications."