@softeria/ms-365-mcp-server 0.142.0 → 0.143.0

package/README.md

@@ -619,6 +619,8 @@ Environment variables:
 - `MS365_MCP_MAX_ITEMS=<n>`: Maximum number of items accumulated when `fetchAllPages: true` (positive integer, default `10000`). Pagination stops and the response is truncated once this many items are collected.
 - `MS365_MCP_ALLOW_PAGINATION=0|false|no`: Disable multi-page following entirely. When set, the `fetchAllPages` parameter is not advertised on tools, and any request that still passes it returns only the first page (default: pagination enabled).
 - `MS365_MCP_BODY_FORMAT=html`: Return email bodies as HTML instead of plain text (default: text)
+- `MS365_MCP_MESSAGE_SIGNOFF_PREFIX=<text>`: Signoff prepended to outgoing messages so recipients can tell they were agent-sent, e.g. `🤖`. Default: none. CLI equivalent: `--message-signoff-prefix <text>` (see Message Signoff below)
+- `MS365_MCP_MESSAGE_SIGNOFF_SUFFIX=<text>`: Signoff appended to outgoing messages. Default: none. CLI equivalent: `--message-signoff-suffix <text>`. `--no-message-signoff` disables both (see Message Signoff below)
 - `MS365_MCP_RATE_LIMIT_DISABLED=true|1`: Disable per-IP rate limiting in HTTP mode (default: enabled — 30 req/min on `/authorize`, `/token`, `/register`; 120 req/min on `/mcp`)
 - `MS365_MCP_TRUST_PROXY_HOPS=<n>`: Number of trusted reverse-proxy hops in HTTP mode (default `1`). Accurate per-IP rate limiting depends on this matching your deployment — set to the number of proxies in front of the server, `0` to use the raw socket peer IP, or a comma-separated subnet list
 - `MS365_MCP_CLOUD_TYPE=global|china`: Microsoft cloud environment (alternative to --cloud flag)
@@ -774,6 +776,14 @@ The Key Vault integration uses `DefaultAzureCredential` from the Azure Identity
 
 The Azure Key Vault packages (`@azure/identity` and `@azure/keyvault-secrets`) are optional dependencies. They are only loaded when `MS365_MCP_KEYVAULT_URL` is configured. If you don't use Key Vault, these packages are not required.
 
+## Message Signoff
+
+Outgoing messages can be wrapped in a configurable signoff (e.g. a `🤖` prefix) so recipients can tell agent-sent messages from ones you typed yourself. Off by default — enable it with `--message-signoff-prefix` / `--message-signoff-suffix` (env: `MS365_MCP_MESSAGE_SIGNOFF_PREFIX` / `MS365_MCP_MESSAGE_SIGNOFF_SUFFIX`); `--no-message-signoff` or an empty env value turns it back off.
+
+Once configured, it applies to all Teams messages (sends, replies and edits, including via `graph-batch`), to direct mail sends (`send-mail`, reply/forward, their shared-mailbox variants, and group thread replies), and to mail drafts as their content is written — `send-draft-message` sends a draft as-is, so a draft you wrote yourself goes out untouched. A message that already carries the marker is not signed twice, and a send whose body cannot take the signoff is refused rather than sent unsigned.
+
+Markers may contain markup (e.g. a coloured `<span>`) as long as it renders visible text. Note that the signoff is a guardrail against an agent misusing the tools it was given, not a hard security boundary — an agent with shell access on the same machine could simply restart the server without it.
+
 ## Production Deployment
 
 See [docs/deployment.md](docs/deployment.md) for a full guide to hosting the server for organization-wide access, including Docker, Azure Container Apps, Azure App Service, Azure AD app registration, reverse proxy setup, client configuration, and exposed endpoints.

package/dist/cli.js

@@ -3,6 +3,7 @@ import { readFileSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { getCombinedPresetPattern, listPresets, presetRequiresOrgMode } from "./tool-categories.js";
+import { assertSignoffMarkersVisible } from "./lib/message-signoff.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, "..", "package.json");
 const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
@@ -15,6 +16,12 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
   "--expected-home-account-id <id>",
   "Require local MSAL authentication to use this exact MSAL homeAccountId"
 ).option("--read-only", "Start server in read-only mode, disabling write operations").option(
+  "--message-signoff-prefix <text>",
+  "Signoff prepended to outgoing messages (Teams sends, replies and edits; mail sends and drafts) so recipients can tell they were agent-sent, e.g. \u{1F916} (default: none). Equivalent env var: MS365_MCP_MESSAGE_SIGNOFF_PREFIX."
+).option(
+  "--message-signoff-suffix <text>",
+  "Signoff appended to outgoing messages (default: none). Equivalent env var: MS365_MCP_MESSAGE_SIGNOFF_SUFFIX."
+).option("--no-message-signoff", "Disable both message signoffs, overriding the env vars.").option(
   "--http [address]",
   'Use Streamable HTTP transport instead of stdio. Format: [host:]port (e.g., "localhost:3000", ":3000", "3000"). Default: all interfaces on port 3000'
 ).option(
@@ -65,6 +72,17 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 function parseArgs() {
   program.parse();
   const options = program.opts();
+  if (typeof options.messageSignoffSuffix === "string") {
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_SUFFIX = options.messageSignoffSuffix;
+  }
+  if (typeof options.messageSignoffPrefix === "string") {
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_PREFIX = options.messageSignoffPrefix;
+  }
+  if (options.messageSignoff === false) {
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_SUFFIX = "";
+    process.env.MS365_MCP_MESSAGE_SIGNOFF_PREFIX = "";
+  }
+  assertSignoffMarkersVisible();
   if (options.listPresets) {
     const presets = listPresets();
     console.log(JSON.stringify({ presets }, null, 2));

package/dist/graph-client.js

@@ -7,6 +7,7 @@ import {
   getSharedBreaker,
   loadResilienceConfig
 } from "./lib/graph-resilience.js";
+import { applyMessageSignoffToRequest } from "./lib/message-signoff.js";
 import { open, stat, unlink } from "fs/promises";
 import { pipeline } from "stream/promises";
 function isBinaryContentType(contentType) {
@@ -166,6 +167,8 @@ class GraphClient {
     const apiVersion = options.apiVersion || "v1.0";
     const url = `${cloudEndpoints.graphApi}/${apiVersion}${endpoint}`;
     logger.info(`[GRAPH CLIENT] Final URL being sent to Microsoft: ${url}`);
+    const method = options.method || "GET";
+    const body = applyMessageSignoffToRequest(method, endpoint, options.body);
     const headers = {
       Authorization: `Bearer ${accessToken}`,
       "Content-Type": "application/json",
@@ -174,10 +177,10 @@ class GraphClient {
     return fetchWithResilience(
       url,
       {
-        method: options.method || "GET",
+        method,
         headers,
         // Node's fetch accepts Buffer/Uint8Array; TS BodyInit doesn't.
-        body: options.body
+        body
       },
       loadResilienceConfig(),
       getSharedBreaker()

package/dist/lib/message-signoff.js

@@ -0,0 +1,230 @@
+import { parseFragment, serialize } from "parse5";
+class MessageSignoffError extends Error {
+  constructor(target, reason) {
+    super(
+      `${target}: a message signoff is configured but could not be applied - ${reason}. Provide the message as { body: { contentType, content } }, or disable the signoff (--no-message-signoff / unset the MS365_MCP_MESSAGE_SIGNOFF_* env vars).`
+    );
+    this.name = "MessageSignoffError";
+  }
+}
+function resolveEnvText(name, defaultValue) {
+  const raw = process.env[name];
+  if (raw === void 0) {
+    return defaultValue;
+  }
+  const trimmed = raw.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function resolveMessageSignoffPrefix() {
+  return resolveEnvText("MS365_MCP_MESSAGE_SIGNOFF_PREFIX");
+}
+function resolveMessageSignoffSuffix() {
+  return resolveEnvText("MS365_MCP_MESSAGE_SIGNOFF_SUFFIX");
+}
+function renderedText(html) {
+  const collect = (node) => node.nodeName === "#text" ? node.value ?? "" : (node.childNodes ?? []).map(collect).join("");
+  return collect(parseFragment(html));
+}
+function assertSignoffMarkersVisible() {
+  for (const [name, marker] of [
+    ["MS365_MCP_MESSAGE_SIGNOFF_PREFIX", resolveMessageSignoffPrefix()],
+    ["MS365_MCP_MESSAGE_SIGNOFF_SUFFIX", resolveMessageSignoffSuffix()]
+  ]) {
+    if (marker === void 0 || !marker.includes("<")) continue;
+    if (renderedText(marker).trim() === "") {
+      throw new Error(
+        `${name} ("${marker}") renders as empty text in html messages, so the signoff would be invisible. Put visible text inside the markup (e.g. <span style="color:gray">\u{1F916}</span>) or use plain text.`
+      );
+    }
+  }
+}
+function markerAlreadyAt(content, marker, isHtml, at) {
+  const text = isHtml ? renderedText(content) : content;
+  const markerText = (isHtml ? renderedText(marker) : marker).trim();
+  if (markerText === "") return false;
+  return at === "start" ? text.trimStart().startsWith(markerText) : text.trimEnd().endsWith(markerText);
+}
+function signContent(content, isHtml, prefix, suffix) {
+  let signed = content;
+  if (suffix !== void 0 && !markerAlreadyAt(signed, suffix, isHtml, "end")) {
+    signed = `${isHtml ? serialize(parseFragment(signed)) : signed} ${suffix}`;
+  }
+  if (prefix !== void 0 && !markerAlreadyAt(signed, prefix, isHtml, "start")) {
+    signed = `${prefix} ${signed}`;
+  }
+  return signed;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function signItemBodyContainer(target, payload, prefix, suffix) {
+  const message = payload.body;
+  if (!isPlainObject(message)) {
+    throw new MessageSignoffError(target, "the body has no nested body (itemBody) object");
+  }
+  const content = message.content;
+  if (typeof content !== "string") {
+    throw new MessageSignoffError(target, "the body has no content string");
+  }
+  const contentType = message.contentType;
+  const isHtml = typeof contentType === "string" && contentType.toLowerCase() === "html";
+  return {
+    ...payload,
+    body: { ...message, content: signContent(content, isHtml, prefix, suffix) }
+  };
+}
+function signMessageSend(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload)) {
+    throw new MessageSignoffError(target, "the body is not a chatMessage object");
+  }
+  return signItemBodyContainer(target, payload, prefix, suffix);
+}
+function signWhenBodyPresent(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload) || payload.body === void 0) return payload;
+  return signItemBodyContainer(target, payload, prefix, suffix);
+}
+function signReplyForwardDraft(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload)) return payload;
+  let signed = payload;
+  if (typeof signed.comment === "string" && signed.comment.trim() !== "") {
+    signed = { ...signed, comment: signContent(signed.comment, false, prefix, suffix) };
+  }
+  const message = signed.message;
+  if (isPlainObject(message) && message.body !== void 0) {
+    signed = { ...signed, message: signItemBodyContainer(target, message, prefix, suffix) };
+  }
+  return signed;
+}
+function signSendMail(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload) || !isPlainObject(payload.message)) {
+    throw new MessageSignoffError(target, "the body has no message object");
+  }
+  return { ...payload, message: signItemBodyContainer(target, payload.message, prefix, suffix) };
+}
+function signGroupThreadReply(target, payload, prefix, suffix) {
+  if (!isPlainObject(payload) || !isPlainObject(payload.post)) {
+    throw new MessageSignoffError(target, "the body has no post object");
+  }
+  return { ...payload, post: signItemBodyContainer(target, payload.post, prefix, suffix) };
+}
+const SIGNOFF_RULES = [
+  // Teams sends and replies
+  { method: "POST", pattern: /^\/chats\/[^/]+\/messages$/, apply: signMessageSend },
+  { method: "POST", pattern: /^\/chats\/[^/]+\/messages\/[^/]+\/replies$/, apply: signMessageSend },
+  {
+    method: "POST",
+    pattern: /^\/teams\/[^/]+\/channels\/[^/]+\/messages$/,
+    apply: signMessageSend
+  },
+  {
+    method: "POST",
+    pattern: /^\/teams\/[^/]+\/channels\/[^/]+\/messages\/[^/]+\/replies$/,
+    apply: signMessageSend
+  },
+  // Teams edits - a PATCH rewriting body.content must keep the signoff
+  { method: "PATCH", pattern: /^\/chats\/[^/]+\/messages\/[^/]+$/, apply: signWhenBodyPresent },
+  {
+    method: "PATCH",
+    pattern: /^\/teams\/[^/]+\/channels\/[^/]+\/messages\/[^/]+(?:\/replies\/[^/]+)?$/,
+    apply: signWhenBodyPresent
+  },
+  // Mail drafts - send-draft-message (POST .../send) carries no body to sign,
+  // so draft content is signed where it is written instead
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)(?:\/mailFolders\/[^/]+)?\/messages$/,
+    apply: signWhenBodyPresent
+  },
+  {
+    method: "PATCH",
+    pattern: /^\/(?:me|users\/[^/]+)(?:\/mailFolders\/[^/]+)?\/messages\/[^/]+$/,
+    apply: signWhenBodyPresent
+  },
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)\/messages\/[^/]+\/create(?:Reply|ReplyAll|Forward)$/,
+    apply: signReplyForwardDraft
+  },
+  // Direct mail sends - straight out with no draft step, so they are signed
+  // (and fail closed) like a Teams send. Covers the /users/{id} shared-mailbox
+  // variants of each
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)\/sendMail$/,
+    apply: signSendMail
+  },
+  {
+    method: "POST",
+    pattern: /^\/(?:me|users\/[^/]+)\/messages\/[^/]+\/(?:reply|replyAll|forward)$/,
+    apply: signReplyForwardDraft
+  },
+  {
+    method: "POST",
+    pattern: /^\/groups\/[^/]+\/threads\/[^/]+\/reply$/,
+    apply: signGroupThreadReply
+  }
+];
+function normalizePath(path) {
+  let clean = path.split("?")[0];
+  clean = clean.replace(/^\/(?:v1\.0|beta)(?=\/)/, "");
+  if (!clean.startsWith("/")) clean = `/${clean}`;
+  if (clean.length > 1 && clean.endsWith("/")) clean = clean.slice(0, -1);
+  return clean;
+}
+function parseIfString(target, body) {
+  if (typeof body !== "string") return body;
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new MessageSignoffError(target, "the body is a string that is not valid JSON");
+  }
+}
+function signBatchPayload(payload, prefix, suffix) {
+  if (!isPlainObject(payload) || !Array.isArray(payload.requests)) {
+    return payload;
+  }
+  const requests = payload.requests.map((entry) => {
+    if (!isPlainObject(entry) || typeof entry.url !== "string") return entry;
+    const method = typeof entry.method === "string" ? entry.method.toUpperCase() : "";
+    const path = normalizePath(entry.url);
+    const target = `${method} ${path} (in $batch)`;
+    if (path === "/$batch") {
+      return {
+        ...entry,
+        body: signBatchPayload(parseIfString(target, entry.body), prefix, suffix)
+      };
+    }
+    const rule = SIGNOFF_RULES.find((r) => r.method === method && r.pattern.test(path));
+    if (!rule) return entry;
+    return {
+      ...entry,
+      body: rule.apply(target, parseIfString(target, entry.body), prefix, suffix)
+    };
+  });
+  return { ...payload, requests };
+}
+function applyMessageSignoffToRequest(method, path, body) {
+  const prefix = resolveMessageSignoffPrefix();
+  const suffix = resolveMessageSignoffSuffix();
+  if (prefix === void 0 && suffix === void 0) return body;
+  const upperMethod = method.toUpperCase();
+  const cleanPath = normalizePath(path);
+  const isBatch = upperMethod === "POST" && cleanPath === "/$batch";
+  const rule = isBatch ? void 0 : SIGNOFF_RULES.find((r) => r.method === upperMethod && r.pattern.test(cleanPath));
+  if (!isBatch && !rule) return body;
+  const target = `${upperMethod} ${cleanPath}`;
+  if (body !== void 0 && typeof body !== "string") {
+    throw new MessageSignoffError(target, "the body is binary, not a signable JSON payload");
+  }
+  const payload = parseIfString(target, body);
+  const signed = isBatch ? signBatchPayload(payload, prefix, suffix) : rule.apply(target, payload, prefix, suffix);
+  if (signed === payload) return body;
+  return JSON.stringify(signed);
+}
+export {
+  MessageSignoffError,
+  applyMessageSignoffToRequest,
+  assertSignoffMarkersVisible,
+  resolveMessageSignoffPrefix,
+  resolveMessageSignoffSuffix
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.142.0",
+  "version": "0.143.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",
@@ -44,6 +44,7 @@
     "helmet": "^8.1.0",
     "js-yaml": "^4.1.0",
     "open": "^11.0.0",
+    "parse5": "^8.0.1",
     "winston": "^3.17.0",
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.25.1"