@softeria/ms-365-mcp-server 0.153.1 → 0.154.1

package/README.md

@@ -154,7 +154,7 @@ SharePoint supports two enterprise permission models:
 - Broad tenant scopes such as `Sites.Read.All`, `Sites.ReadWrite.All`, and `Sites.Manage.All`.
 - Microsoft Graph `Sites.Selected`, where SharePoint site access is granted to the app on specific site collections and Graph evaluates the signed-in user's own permissions at request time.
 
-The default org-mode behavior continues to request the broad SharePoint scopes used by existing deployments. Enterprises that want selected-site SharePoint access can set an allowlist containing `Sites.Selected` instead of broad `Sites.*.All` scopes. Direct site/list/item tools that target an explicit SharePoint site can run with `Sites.Selected`; tenant-wide SharePoint discovery and search tools still require broad SharePoint scopes.
+The default org-mode behavior continues to request the broad SharePoint scopes used by existing deployments. Enterprises that want selected-site SharePoint access can set an allowlist containing `Sites.Selected` instead of broad `Sites.*.All` scopes. Direct site/list/item tools that target an explicit SharePoint site, and the `/drives/{drive-id}/...` item tools (list, get, upload, folder, move/rename, copy, versions) for drives of a granted site, can run with `Sites.Selected`; tenant-wide SharePoint discovery and search tools still require broad SharePoint scopes.
 
 ```bash
 npx @softeria/ms-365-mcp-server \

package/dist/__tests__/graph-tools.test.js

@@ -1068,6 +1068,95 @@ describe("graph-tools", () => {
       expect(payload).not.toHaveProperty("target_resource");
     });
   });
+  describe("shared query contract at execution", () => {
+    it.each([{ skiptoken: 123 }, { $SKIPTOKEN: 123 }, { COUNT: "true" }, { $Count: "true" }])(
+      "rejects invalid cursor and mixed-case query values: %j",
+      async (params) => {
+        mockEndpoints.push(makeEndpoint());
+        mockEndpointsJson = [makeConfig()];
+        const graphClient = createMockGraphClient();
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        const result = await server.tools.get("test-tool").handler(params);
+        expect(result.isError).toBe(true);
+        expect(graphClient.graphRequest).not.toHaveBeenCalled();
+      }
+    );
+    it("accepts valid mixed-case query values and string cursors", async () => {
+      mockEndpoints.push(makeEndpoint());
+      mockEndpointsJson = [makeConfig()];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      await server.tools.get("test-tool").handler({ COUNT: true, $SKIPTOKEN: "next-token" });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+      const request = JSON.stringify(graphClient.graphRequest.mock.calls[0]);
+      expect(request).toContain("$count=true");
+      expect(request).toContain("$skiptoken=next-token");
+    });
+    it.each(["list-calendar-events-delta", "list-calendar-view-delta"])(
+      "ignores stale mixed-case top values for %s",
+      async (alias) => {
+        mockEndpoints.push(makeEndpoint({ alias }));
+        mockEndpointsJson = [makeConfig({ toolName: alias })];
+        const graphClient = createMockGraphClient();
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        for (const key of ["top", "$top", "TOP", "$TOP", "$Top"]) {
+          await server.tools.get(alias).handler({ [key]: 10 });
+        }
+        expect(graphClient.graphRequest).toHaveBeenCalledTimes(5);
+        for (const call of graphClient.graphRequest.mock.calls) {
+          expect(JSON.stringify(call)).not.toContain("$top");
+        }
+      }
+    );
+    it.each(["list-joined-teams", "list-my-associated-teams"])(
+      "rejects unsupported query options before Graph dispatch for %s",
+      async (alias) => {
+        mockEndpoints.push(makeEndpoint({ alias }));
+        mockEndpointsJson = [makeConfig({ toolName: alias })];
+        const graphClient = createMockGraphClient();
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        for (const key of ["top", "$top", "skiptoken", "$skiptoken", "select", "$select"]) {
+          const value = key.replace("$", "") === "top" ? 100 : "next-token";
+          const result = await server.tools.get(alias).handler({ [key]: value });
+          expect(result.isError).toBe(true);
+        }
+        expect(graphClient.graphRequest).not.toHaveBeenCalled();
+      }
+    );
+    it("rejects oversized chat pages before Graph dispatch, including dollar-prefixed input", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-chats" }));
+      mockEndpointsJson = [makeConfig({ toolName: "list-chats" })];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      for (const key of ["top", "$top"]) {
+        const result = await server.tools.get("list-chats").handler({ [key]: 100 });
+        expect(result.isError).toBe(true);
+      }
+      expect(graphClient.graphRequest).not.toHaveBeenCalled();
+    });
+    it("sends a calendar field array as comma-separated text in one Graph request", async () => {
+      const alias = "list-calendar-events-delta";
+      mockEndpoints.push(makeEndpoint({ alias }));
+      mockEndpointsJson = [makeConfig({ toolName: alias })];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      await server.tools.get(alias).handler({ select: ["id", "subject"] });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+      expect(JSON.stringify(graphClient.graphRequest.mock.calls[0])).toContain("id,subject");
+    });
+  });
   describe("skiptoken cursor", () => {
     const prevAllowPagination = process.env.MS365_MCP_ALLOW_PAGINATION;
     afterEach(() => {

package/dist/endpoints.json

@@ -621,14 +621,14 @@
     "method": "get",
     "toolName": "get-drive-root-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"]
+    "scopes": [["Files.Read"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/children",
     "method": "get",
     "toolName": "list-folder-files",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"]
+    "scopes": [["Files.Read"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}",
@@ -642,7 +642,7 @@
     "method": "put",
     "toolName": "upload-file-content",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Body is a base64-encoded string of the file bytes; the server decodes it before PUT. Graph accepts up to 250MB here, but the whole string travels as a tool argument and a truncated one decodes to a truncated file with no error, so use create-upload-session rather than emitting a large base64 string. For new files use path format: /items/root:/path/to/file.txt:/content. Overwrites existing files without warning."
   },
   {
@@ -650,7 +650,7 @@
     "method": "post",
     "toolName": "create-upload-session",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "For large file uploads (no size limit, and no minimum unlike the Outlook attachment session). Returns a pre-authenticated uploadUrl; the caller PUTs the bytes there itself. This server does not perform the PUT. For new files use path: /items/{parentId}:/{fileName}:/createUploadSession. Body (optional): { item: { '@microsoft.graph.conflictBehavior': 'rename' } }."
   },
   {
@@ -658,7 +658,7 @@
     "method": "get",
     "toolName": "get-drive-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"],
+    "scopes": [["Files.Read"], ["Sites.Selected"]],
     "llmTip": "Gets metadata for a file or folder: name, size, lastModifiedDateTime, createdBy, webUrl, file (mimeType, hashes), folder (childCount), parentReference, and @microsoft.graph.downloadUrl. For large drive/SharePoint files, call get-download-url with target=/drives/{drive-id}/items/{driveItem-id}/content to fetch out-of-band with no Authorization header. For small files where base64 in the tool response is acceptable, call download-bytes with the same /content target."
   },
   {
@@ -666,7 +666,7 @@
     "method": "patch",
     "toolName": "move-rename-onedrive-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Move and/or rename a file or folder. To move, provide parentReference with the target folder's id. To rename, provide a new name. Both can be done in a single request."
   },
   {
@@ -674,7 +674,7 @@
     "method": "post",
     "toolName": "create-onedrive-folder",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Creates a new folder inside the specified drive item. Body must include name (string) and folder ({}) fields. Use @microsoft.graph.conflictBehavior to control behavior on name conflict: 'rename' (default), 'replace', or 'fail'."
   },
   {
@@ -698,7 +698,7 @@
     "method": "post",
     "toolName": "copy-drive-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Asynchronously copy a file or folder to a new location and/or name. Body: { parentReference: { driveId: '...', id: '...' }, name?: 'New Name.xlsx' }. Returns 202 Accepted with a Location header pointing at a monitor URL for the async job. Ideal for duplicating templates (e.g. clone an Armhr Census Template per prospect), bulk file provisioning, or preserving an immutable snapshot of a working file."
   },
   {
@@ -738,7 +738,7 @@
     "method": "get",
     "toolName": "list-drive-item-versions",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"],
+    "scopes": [["Files.Read"], ["Sites.Selected"]],
     "llmTip": "Lists version history of a file. Each version has id, lastModifiedDateTime, lastModifiedBy, and size. Use the version id with /versions/{id}/content to download a specific version."
   },
   {

package/dist/generated/client.js

@@ -846,8 +846,8 @@ const microsoft_graph_driveItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
   audio: microsoft_graph_audio.optional(),
   bundle: microsoft_graph_bundle.optional(),
   cTag: z.string().describe(
@@ -2586,8 +2586,8 @@ const microsoft_graph_listItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
   contentType: microsoft_graph_contentTypeInfo.optional(),
   deleted: microsoft_graph_deleted.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2708,8 +2708,8 @@ const microsoft_graph_list = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
     displayName: z.string().describe("The displayable title of the list.").nullish(),
     list: microsoft_graph_listInfo.optional(),
     sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2741,8 +2741,8 @@ const microsoft_graph_drive = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
     driveType: z.string().describe(
       "Describes the type of drive represented by this resource. OneDrive personal drives return personal. OneDrive for Business returns business. SharePoint document libraries return documentLibrary. Read-only."
     ).nullish(),
@@ -4558,8 +4558,8 @@ const microsoft_graph_baseItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional()
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional()
 }).passthrough();
 const microsoft_graph_site = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
@@ -4580,8 +4580,8 @@ const microsoft_graph_site = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
   isPersonalSite: z.boolean().describe("Identifies whether the site is personal or not. Read-only.").nullish(),
   root: microsoft_graph_root.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -5880,8 +5880,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -5995,8 +5995,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(

package/dist/graph-tools.js

@@ -35,6 +35,7 @@ import { parseTeamsUrl } from "./lib/teams-url-parser.js";
 import { buildBM25Index, scoreQuery, tokenize } from "./lib/bm25.js";
 import { deriveTargetResource } from "./audit-target-resource.js";
 import { describeToolSchema, describeUtilityToolSchema } from "./lib/tool-schema.js";
+import { queryParameterSchema } from "./lib/query-parameter-schema.js";
 import {
   TOP_UNSUPPORTED_DELTA_TOOLS,
   shouldOmitTopParam,
@@ -43,14 +44,6 @@ import {
   DEFAULT_MAX_PAGES,
   getMaxPages,
   isFetchAllPagesApplicable,
-  FILTER_PARAM_DESCRIPTION,
-  SEARCH_PARAM_DESCRIPTION,
-  SELECT_PARAM_DESCRIPTION,
-  EXPAND_PARAM_DESCRIPTION,
-  ORDERBY_PARAM_DESCRIPTION,
-  TOP_PARAM_DESCRIPTION,
-  SKIP_PARAM_DESCRIPTION,
-  COUNT_PARAM_DESCRIPTION,
   CONFIRM_PARAM_DESCRIPTION,
   TIMEZONE_PARAM_DESCRIPTION,
   EXPAND_EXTENDED_PROPERTIES_PARAM_DESCRIPTION,
@@ -1195,13 +1188,38 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         "search",
         "format"
       ];
-      const normalizedParamName = paramName.startsWith("$") ? paramName.slice(1) : paramName;
-      const isOdataParam = odataParams.includes(normalizedParamName.toLowerCase());
-      const fixedParamName = isOdataParam ? `$${normalizedParamName.toLowerCase()}` : paramName;
+      const bareParamName = paramName.startsWith("$") ? paramName.slice(1) : paramName;
+      const isOdataParam = odataParams.includes(bareParamName.toLowerCase());
+      const normalizedParamName = isOdataParam ? bareParamName.toLowerCase() : bareParamName;
+      const fixedParamName = isOdataParam ? `$${normalizedParamName}` : paramName;
       const camelCaseParamName = paramName.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
       const paramDef = parameterDefinitions.find(
-        (p) => p.name === paramName || p.name === camelCaseParamName || isOdataParam && p.name === normalizedParamName
+        (p) => p.name === paramName || p.name === camelCaseParamName || isOdataParam && p.name.replace(/^\$/, "").toLowerCase() === normalizedParamName
       );
+      const isQuery = paramDef?.type === "Query" || isOdataParam;
+      const ignoredDeltaTop = shouldOmitTopParam(tool.alias) && normalizedParamName === "top";
+      if (isQuery && !ignoredDeltaTop && paramValue != null && paramValue !== "") {
+        const schema = queryParameterSchema(
+          tool.alias,
+          normalizedParamName,
+          paramDef?.schema ?? z.any()
+        );
+        if (!schema || !schema.safeParse(paramValue).success) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  error: "invalid_query_parameter",
+                  parameter: fixedParamName,
+                  message: schema ? "Value does not match the query contract. Check get-tool-schema." : "This endpoint does not support this query parameter."
+                })
+              }
+            ],
+            isError: true
+          };
+        }
+      }
       if (paramDef) {
         switch (paramDef.type) {
           case "Path": {
@@ -1632,6 +1650,11 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
     const paramSchema = {};
     if (tool.parameters && tool.parameters.length > 0) {
       for (const param of tool.parameters) {
+        if (param.type === "Query") {
+          const schema = queryParameterSchema(tool.alias, param.name, param.schema || z.any());
+          if (schema) paramSchema[param.name] = schema;
+          continue;
+        }
         paramSchema[param.name] = param.type === "Body" && param.schema ? lenientBodySchema(param.schema) : param.schema || z.any();
       }
     }
@@ -1652,41 +1675,6 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
     if (isSkiptokenApplicable(tool, Object.keys(paramSchema))) {
       paramSchema["skiptoken"] = z.string().describe(SKIPTOKEN_PARAM_DESCRIPTION).optional();
     }
-    if (paramSchema["filter"] !== void 0 || paramSchema["$filter"] !== void 0) {
-      const key = paramSchema["$filter"] !== void 0 ? "$filter" : "filter";
-      paramSchema[key] = z.string().describe(FILTER_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["search"] !== void 0 || paramSchema["$search"] !== void 0) {
-      const key = paramSchema["$search"] !== void 0 ? "$search" : "search";
-      paramSchema[key] = z.string().describe(SEARCH_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["select"] !== void 0 || paramSchema["$select"] !== void 0) {
-      const key = paramSchema["$select"] !== void 0 ? "$select" : "select";
-      paramSchema[key] = z.string().describe(SELECT_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["expand"] !== void 0 || paramSchema["$expand"] !== void 0) {
-      const key = paramSchema["$expand"] !== void 0 ? "$expand" : "expand";
-      paramSchema[key] = z.array(z.string()).describe(EXPAND_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["orderby"] !== void 0 || paramSchema["$orderby"] !== void 0) {
-      const key = paramSchema["$orderby"] !== void 0 ? "$orderby" : "orderby";
-      paramSchema[key] = z.string().describe(ORDERBY_PARAM_DESCRIPTION).optional();
-    }
-    if (shouldOmitTopParam(tool.alias)) {
-      delete paramSchema["top"];
-      delete paramSchema["$top"];
-    } else if (paramSchema["top"] !== void 0 || paramSchema["$top"] !== void 0) {
-      const key = paramSchema["$top"] !== void 0 ? "$top" : "top";
-      paramSchema[key] = z.number().describe(TOP_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["skip"] !== void 0 || paramSchema["$skip"] !== void 0) {
-      const key = paramSchema["$skip"] !== void 0 ? "$skip" : "skip";
-      paramSchema[key] = z.number().describe(SKIP_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["count"] !== void 0 || paramSchema["$count"] !== void 0) {
-      const countKey = paramSchema["$count"] !== void 0 ? "$count" : "count";
-      paramSchema[countKey] = z.boolean().describe(COUNT_PARAM_DESCRIPTION).optional();
-    }
     if (multiAccount) {
       paramSchema["account"] = z.string().describe(getAccountParamDescription(accountNames)).optional();
     }

package/dist/lib/query-parameter-schema.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { getODataParamDescription, shouldOmitTopParam } from "./param-descriptions.js";
+const TEAM_LIST_TOOLS = /* @__PURE__ */ new Set(["list-joined-teams", "list-my-associated-teams"]);
+function queryParameterSchema(toolName, name, providerSchema) {
+  const bareName = name.replace(/^\$/, "").toLowerCase();
+  if (TEAM_LIST_TOOLS.has(toolName)) return void 0;
+  if (bareName === "top" && shouldOmitTopParam(toolName)) return void 0;
+  const source = providerSchema instanceof z.ZodOptional ? providerSchema.unwrap() : providerSchema;
+  let schema = source;
+  switch (bareName) {
+    case "select":
+    case "expand":
+    case "orderby":
+      schema = z.union([z.string(), z.array(z.string())]);
+      break;
+    case "filter":
+    case "search":
+      schema = z.string();
+      break;
+    case "skiptoken":
+      schema = z.string();
+      break;
+    case "top":
+      if (toolName === "list-chats") schema = source.and(z.number().max(50));
+      break;
+  }
+  if (providerSchema.isOptional()) schema = schema.optional();
+  const description = getODataParamDescription(bareName);
+  return description ? schema.describe(description) : schema;
+}
+export {
+  queryParameterSchema
+};

package/dist/lib/tool-schema.js

@@ -1,8 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
+import { queryParameterSchema } from "./query-parameter-schema.js";
 import { isDestructiveOperation } from "./destructive-ops.js";
 import {
-  getODataParamDescription,
-  shouldOmitTopParam,
   isFetchAllPagesApplicable,
   isSkiptokenApplicable,
   SKIPTOKEN_PARAM_DESCRIPTION,
@@ -22,24 +21,23 @@ function unwrapOptional(schema) {
   }
   return { inner: schema, optional: false };
 }
-function bareParamName(name) {
-  return name.startsWith("$") ? name.slice(1) : name;
-}
 function describeToolSchema(tool, config, ctx = {}) {
-  const omitTop = shouldOmitTopParam(tool.alias);
-  const params = (tool.parameters ?? []).filter((p) => !(omitTop && bareParamName(p.name) === "top")).map((p) => {
-    const { inner, optional } = unwrapOptional(p.schema);
+  const params = (tool.parameters ?? []).flatMap((p) => {
+    const effectiveSchema = p.type === "Query" ? queryParameterSchema(tool.alias, p.name, p.schema) : p.schema;
+    if (!effectiveSchema) return [];
+    const { inner, optional } = unwrapOptional(effectiveSchema);
     const isPath = p.type === "Path";
     const jsonSchema = zodToJsonSchema(inner, { target: "jsonSchema7", $refStrategy: "none" });
     const { $schema: _s, ...schema } = jsonSchema;
-    const override = p.type === "Query" ? getODataParamDescription(bareParamName(p.name)) : void 0;
-    return {
-      name: p.name,
-      in: p.type,
-      required: isPath || !optional,
-      description: override ?? p.description,
-      schema
-    };
+    return [
+      {
+        name: p.name,
+        in: p.type,
+        required: isPath || !optional,
+        description: effectiveSchema.description ?? p.description,
+        schema
+      }
+    ];
   });
   if (isDestructiveOperation(tool.method, config)) {
     params.push({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.153.1",
+  "version": "0.154.1",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -621,14 +621,14 @@
     "method": "get",
     "toolName": "get-drive-root-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"]
+    "scopes": [["Files.Read"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/children",
     "method": "get",
     "toolName": "list-folder-files",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"]
+    "scopes": [["Files.Read"], ["Sites.Selected"]]
   },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}",
@@ -642,7 +642,7 @@
     "method": "put",
     "toolName": "upload-file-content",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Body is a base64-encoded string of the file bytes; the server decodes it before PUT. Graph accepts up to 250MB here, but the whole string travels as a tool argument and a truncated one decodes to a truncated file with no error, so use create-upload-session rather than emitting a large base64 string. For new files use path format: /items/root:/path/to/file.txt:/content. Overwrites existing files without warning."
   },
   {
@@ -650,7 +650,7 @@
     "method": "post",
     "toolName": "create-upload-session",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "For large file uploads (no size limit, and no minimum unlike the Outlook attachment session). Returns a pre-authenticated uploadUrl; the caller PUTs the bytes there itself. This server does not perform the PUT. For new files use path: /items/{parentId}:/{fileName}:/createUploadSession. Body (optional): { item: { '@microsoft.graph.conflictBehavior': 'rename' } }."
   },
   {
@@ -658,7 +658,7 @@
     "method": "get",
     "toolName": "get-drive-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"],
+    "scopes": [["Files.Read"], ["Sites.Selected"]],
     "llmTip": "Gets metadata for a file or folder: name, size, lastModifiedDateTime, createdBy, webUrl, file (mimeType, hashes), folder (childCount), parentReference, and @microsoft.graph.downloadUrl. For large drive/SharePoint files, call get-download-url with target=/drives/{drive-id}/items/{driveItem-id}/content to fetch out-of-band with no Authorization header. For small files where base64 in the tool response is acceptable, call download-bytes with the same /content target."
   },
   {
@@ -666,7 +666,7 @@
     "method": "patch",
     "toolName": "move-rename-onedrive-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Move and/or rename a file or folder. To move, provide parentReference with the target folder's id. To rename, provide a new name. Both can be done in a single request."
   },
   {
@@ -674,7 +674,7 @@
     "method": "post",
     "toolName": "create-onedrive-folder",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Creates a new folder inside the specified drive item. Body must include name (string) and folder ({}) fields. Use @microsoft.graph.conflictBehavior to control behavior on name conflict: 'rename' (default), 'replace', or 'fail'."
   },
   {
@@ -698,7 +698,7 @@
     "method": "post",
     "toolName": "copy-drive-item",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.ReadWrite"],
+    "scopes": [["Files.ReadWrite"], ["Sites.Selected"]],
     "llmTip": "Asynchronously copy a file or folder to a new location and/or name. Body: { parentReference: { driveId: '...', id: '...' }, name?: 'New Name.xlsx' }. Returns 202 Accepted with a Location header pointing at a monitor URL for the async job. Ideal for duplicating templates (e.g. clone an Armhr Census Template per prospect), bulk file provisioning, or preserving an immutable snapshot of a working file."
   },
   {
@@ -738,7 +738,7 @@
     "method": "get",
     "toolName": "list-drive-item-versions",
     "presets": ["files", "onedrive", "personal"],
-    "scopes": ["Files.Read"],
+    "scopes": [["Files.Read"], ["Sites.Selected"]],
     "llmTip": "Lists version history of a file. Each version has id, lastModifiedDateTime, lastModifiedBy, and size. Use the version id with /versions/{id}/content to download a specific version."
   },
   {