@softeria/ms-365-mcp-server 0.149.1 → 0.150.0

package/dist/__tests__/graph-tools.test.js

@@ -2822,6 +2822,197 @@ describe("graph-tools", () => {
       expect(server.tools.get("destructive-tool").schema).toHaveProperty("confirm");
     });
   });
+  describe("$select projection", () => {
+    const untrimmed = {
+      value: [
+        {
+          id: "MSo",
+          subject: "Standup",
+          joinWebUrl: "https://teams/x",
+          joinInformation: { content: "<div>invite</div>" },
+          joinMeetingIdSettings: { passcode: "123456" }
+        }
+      ]
+    };
+    async function run(args, responses, outputFormat = "json") {
+      mockEndpoints.push(makeEndpoint());
+      mockEndpointsJson = [makeConfig()];
+      const graphClient = createMockGraphClient(
+        responses ?? [{ content: [{ type: "text", text: JSON.stringify(untrimmed) }] }],
+        outputFormat
+      );
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const result = await server.tools.get("test-tool").handler(args);
+      return { result, graphClient };
+    }
+    it("narrows the body to the requested fields when Graph ignored $select", async () => {
+      const { result } = await run({ select: "id,subject,joinWebUrl" });
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "MSo",
+        subject: "Standup",
+        joinWebUrl: "https://teams/x"
+      });
+    });
+    it("leaves the body untouched when no select was passed", async () => {
+      const { result } = await run({});
+      expect(JSON.parse(result.content[0].text)).toEqual(untrimmed);
+    });
+    it("forces JSON so a --toon client still gets a trimmed body", async () => {
+      const { result, graphClient } = await run({ select: "id,subject" }, void 0, "toon");
+      expect(graphClient.graphRequest).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({ forceJsonOutput: true })
+      );
+      expect(result.content[0].text.startsWith("TOON:")).toBe(true);
+      expect(result.content[0].text).not.toContain("joinInformation");
+    });
+    it("still projects when --toon and fetchAllPages are combined", async () => {
+      const { result } = await run(
+        { select: "id,subject", fetchAllPages: true },
+        [
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "1", subject: "a", joinInformation: { content: "huge" } }],
+                  "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?$skip=1"
+                })
+              }
+            ]
+          },
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "2", subject: "b", joinInformation: { content: "huge" } }]
+                })
+              }
+            ]
+          }
+        ],
+        "toon"
+      );
+      expect(result.content[0].text.startsWith("TOON:")).toBe(true);
+      expect(result.content[0].text).not.toContain("joinInformation");
+      const merged = JSON.parse(result.content[0].text.slice("TOON:".length));
+      expect(merged.value).toEqual([
+        { id: "1", subject: "a" },
+        { id: "2", subject: "b" }
+      ]);
+    });
+    it("does not project a raw-text transport envelope", async () => {
+      const envelope = { message: "OK!", rawResponse: "WEBVTT\n\n00:00:01.000 --> 00:00:02.000" };
+      const { result } = await run({ select: "id" }, [
+        { content: [{ type: "text", text: JSON.stringify(envelope) }] }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(envelope);
+    });
+    it("does not project a binary transport envelope", async () => {
+      const envelope = {
+        message: "OK!",
+        contentType: "video/mp4",
+        encoding: "base64",
+        contentLength: 3,
+        contentBytes: "AAA"
+      };
+      const { result } = await run({ select: "id" }, [
+        { content: [{ type: "text", text: JSON.stringify(envelope) }] }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(envelope);
+    });
+    it("keeps an $expand-ed navigation property that was not selected", async () => {
+      const { result } = await run({ select: "subject", expand: "attachments" }, [
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                id: "1",
+                subject: "a",
+                attachments: [{ id: "att1" }],
+                bodyPreview: "huge"
+              })
+            }
+          ]
+        }
+      ]);
+      const body = JSON.parse(result.content[0].text);
+      expect(body.attachments).toEqual([{ id: "att1" }]);
+      expect(body).not.toHaveProperty("bodyPreview");
+    });
+    it("returns the body untrimmed when no requested field is present", async () => {
+      const body = { id: "1", joinWebUrl: "u", joinInformation: { content: "huge" } };
+      const { result } = await run({ select: "joinUrl" }, [
+        { content: [{ type: "text", text: JSON.stringify(body) }] }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(body);
+    });
+    it("keeps the _etag that includeHeaders adds to a single resource", async () => {
+      const { result } = await run({ select: "subject", includeHeaders: true }, [
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ id: "1", subject: "a", _etag: 'W/"1"', bodyPreview: "huge" })
+            }
+          ]
+        }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual({
+        id: "1",
+        subject: "a",
+        _etag: 'W/"1"'
+      });
+    });
+    it("does not arm projection when excludeResponse was requested", async () => {
+      const { result, graphClient } = await run({ select: "id", excludeResponse: true }, [
+        { content: [{ type: "text", text: JSON.stringify({ success: true }) }] }
+      ]);
+      expect(graphClient.graphRequest).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.not.objectContaining({ forceJsonOutput: true })
+      );
+      expect(JSON.parse(result.content[0].text)).toEqual({ success: true });
+    });
+    it("does not project an error body on the merge path", async () => {
+      const errorBody = { error: "Microsoft Graph API error: 403 Forbidden", code: "accessDenied" };
+      const { result } = await run({ select: "error", fetchAllPages: true }, [
+        { content: [{ type: "text", text: JSON.stringify(errorBody) }], isError: true }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(errorBody);
+    });
+    it("leaves an error from a later page alone", async () => {
+      const errorBody = { error: "Microsoft Graph API error: 503 Service Unavailable" };
+      const { result } = await run(
+        { select: "error", fetchAllPages: true },
+        [
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "1", subject: "a" }],
+                  "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?$skip=1"
+                })
+              }
+            ]
+          },
+          { content: [{ type: "text", text: JSON.stringify(errorBody) }], isError: true }
+        ],
+        "toon"
+      );
+      expect(result.content[0].text.startsWith("TOON:")).toBe(false);
+      expect(JSON.parse(result.content[0].text)).toEqual(errorBody);
+    });
+    it("returns the body untrimmed when the only real field is a typo alongside id", async () => {
+      const { result } = await run({ select: "id,joinUrl" });
+      expect(JSON.parse(result.content[0].text)).toEqual(untrimmed);
+    });
+  });
   describe("isDestructiveOperation", () => {
     it("returns true for POST, PATCH, PUT, DELETE", async () => {
       const { isDestructiveOperation } = await loadModule();

package/dist/endpoints.json

@@ -2081,7 +2081,7 @@
     "toolName": "list-online-meetings",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access."
+    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select=id,subject,joinWebUrl unless you need more."
   },
   {
     "pathPattern": "/me/onlineMeetings/{onlineMeeting-id}",
@@ -2089,7 +2089,7 @@
     "toolName": "get-online-meeting",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID."
+    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select with the fields you came here for, e.g. select=id,chatInfo,participants."
   },
   {
     "pathPattern": "/me/onlineMeetings",

package/dist/graph-client.js

@@ -8,6 +8,7 @@ import {
   loadResilienceConfig
 } from "./lib/graph-resilience.js";
 import { applyMessageSignoffToRequest } from "./lib/message-signoff.js";
+import { TRANSPORT_OK_MESSAGE } from "./lib/select-projection.js";
 import { open, stat, unlink } from "fs/promises";
 import { pipeline } from "stream/promises";
 function isBinaryContentType(contentType) {
@@ -118,7 +119,7 @@ class GraphClient {
       if (isBinaryResponse) {
         const buffer = Buffer.from(await response.arrayBuffer());
         result = {
-          message: "OK!",
+          message: TRANSPORT_OK_MESSAGE,
           contentType: contentTypeHeader,
           encoding: "base64",
           contentLength: buffer.byteLength,
@@ -127,14 +128,14 @@ class GraphClient {
       } else {
         const text = await response.text();
         if (text === "") {
-          result = { message: "OK!" };
+          result = { message: TRANSPORT_OK_MESSAGE };
         } else if (options.rawResponse) {
-          result = { message: "OK!", rawResponse: text };
+          result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
         } else {
           try {
             result = JSON.parse(text);
           } catch {
-            result = { message: "OK!", rawResponse: text };
+            result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
           }
         }
       }

package/dist/graph-tools.js

@@ -4,6 +4,12 @@ import logger from "./logger.js";
 import { auditLog, getUserIdentityForAudit } from "./audit-log.js";
 import { isDestructiveOperation } from "./lib/destructive-ops.js";
 import { describePathParam } from "./lib/path-params.js";
+import {
+  anyFieldPresent,
+  isTransportEnvelope,
+  parseSelectFields,
+  projectSelectedFields
+} from "./lib/select-projection.js";
 import {
   getEndpointScopeGroups,
   getMissingAllowedScopesForGroups,
@@ -1060,6 +1066,10 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       headers["Accept"] = config.acceptType;
       logger.info(`Setting custom Accept: ${config.acceptType}`);
     }
+    const requestedSelect = parseSelectFields(queryParams["$select"]);
+    const keepFields = [
+      .../* @__PURE__ */ new Set([...requestedSelect, ...parseSelectFields(queryParams["$expand"])])
+    ];
     if (Object.keys(queryParams).length > 0) {
       const queryString = Object.entries(queryParams).map(([key, value]) => `${key}=${encodeURIComponent(value).replace(/%2C/gi, ",")}`).join("&");
       path2 = `${path2}${path2.includes("?") ? "&" : "?"}${queryString}`;
@@ -1123,10 +1133,26 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       );
     }
     const mergePages = fetchAllPages && paginationEnabled;
-    if (mergePages) {
+    const willProject = requestedSelect.length > 0 && params.excludeResponse !== true;
+    if (mergePages || willProject) {
       options.forceJsonOutput = true;
     }
     let response = await graphClient.graphRequest(path2, options);
+    const shouldProject = willProject && !response?.isError;
+    let projectionHandled = false;
+    const applyProjection = (body2) => {
+      if (isTransportEnvelope(body2)) {
+        logger.info("Skipping $select projection: body is a transport envelope, not a resource");
+        return body2;
+      }
+      if (!anyFieldPresent(body2, requestedSelect)) {
+        logger.warn(
+          `None of the requested $select fields (${requestedSelect.join(",")}) appear in the response; returning it untrimmed`
+        );
+        return body2;
+      }
+      return projectSelectedFields(body2, keepFields);
+    };
     if (mergePages && response?.content?.[0]?.text) {
       let combinedResponse;
       try {
@@ -1190,7 +1216,16 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         logger.error(`Error during pagination: ${e}`);
       }
       if (combinedResponse !== void 0) {
-        response.content[0].text = graphClient.serialize(combinedResponse);
+        const merged = shouldProject ? applyProjection(combinedResponse) : combinedResponse;
+        projectionHandled = shouldProject;
+        response.content[0].text = graphClient.serialize(merged);
+      }
+    }
+    if (shouldProject && !projectionHandled && !response?.isError && response?.content?.[0]?.text) {
+      try {
+        const parsed = JSON.parse(response.content[0].text);
+        response.content[0].text = graphClient.serialize(applyProjection(parsed));
+      } catch {
       }
     }
     if (response?.content?.[0]?.text) {

package/dist/lib/select-projection.js

@@ -0,0 +1,82 @@
+function splitTopLevel(value) {
+  const parts = [];
+  let depth = 0;
+  let current = "";
+  for (const char of value) {
+    if (char === "(") depth++;
+    else if (char === ")") depth = Math.max(0, depth - 1);
+    if (char === "," && depth === 0) {
+      parts.push(current);
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  parts.push(current);
+  return parts;
+}
+function parseSelectFields(value) {
+  if (!value) return [];
+  return [
+    ...new Set(
+      splitTopLevel(value).map((field) => field.trim().split(/[/()]/)[0].trim()).filter(Boolean)
+    )
+  ];
+}
+function isAlwaysKept(key) {
+  return key.toLowerCase() === "id" || key.startsWith("@") || key.startsWith("_");
+}
+const TRANSPORT_OK_MESSAGE = "OK!";
+function isTransportEnvelope(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return false;
+  const body = data;
+  if (body.message === TRANSPORT_OK_MESSAGE) return true;
+  return body.success === true && Object.keys(body).length === 1;
+}
+function candidateObjects(data) {
+  if (Array.isArray(data)) return data.filter(isPlainObject);
+  if (!isPlainObject(data)) return [];
+  if (Array.isArray(data.value)) return data.value.filter(isPlainObject);
+  return [data];
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function anyFieldPresent(data, fields) {
+  const checkable = fields.filter((field) => !isAlwaysKept(field));
+  if (checkable.length === 0) return true;
+  const wanted = new Set(checkable.map((field) => field.toLowerCase()));
+  const objects = candidateObjects(data);
+  if (objects.length === 0) return true;
+  return objects.some((item) => Object.keys(item).some((key) => wanted.has(key.toLowerCase())));
+}
+function projectObject(item, wanted) {
+  if (!isPlainObject(item)) return item;
+  const projected = {};
+  for (const [key, value] of Object.entries(item)) {
+    if (isAlwaysKept(key) || wanted.has(key.toLowerCase())) {
+      projected[key] = value;
+    }
+  }
+  return projected;
+}
+function projectSelectedFields(data, fields) {
+  if (fields.length === 0) return data;
+  if (!data || typeof data !== "object") return data;
+  const wanted = new Set(fields.map((field) => field.toLowerCase()));
+  if (Array.isArray(data)) {
+    return data.map((item) => projectObject(item, wanted));
+  }
+  const body = data;
+  if (Array.isArray(body.value)) {
+    return { ...body, value: body.value.map((item) => projectObject(item, wanted)) };
+  }
+  return projectObject(body, wanted);
+}
+export {
+  TRANSPORT_OK_MESSAGE,
+  anyFieldPresent,
+  isTransportEnvelope,
+  parseSelectFields,
+  projectSelectedFields
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.149.1",
+  "version": "0.150.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -2081,7 +2081,7 @@
     "toolName": "list-online-meetings",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access."
+    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select=id,subject,joinWebUrl unless you need more."
   },
   {
     "pathPattern": "/me/onlineMeetings/{onlineMeeting-id}",
@@ -2089,7 +2089,7 @@
     "toolName": "get-online-meeting",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID."
+    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select with the fields you came here for, e.g. select=id,chatInfo,participants."
   },
   {
     "pathPattern": "/me/onlineMeetings",