@softeria/ms-365-mcp-server 0.154.0 → 0.154.2

package/Dockerfile.ghcr

@@ -0,0 +1,29 @@
+# The image published to ghcr.io/softeria/ms-365-mcp-server. It installs the released npm
+# package rather than building from source, so a version tag holds exactly what npm serves
+# for that version. `generate` downloads Microsoft's live spec, so a source build of the
+# same version can drift from it.
+#
+# Separate from Dockerfile because the legacy (non-BuildKit) builder runs every stage in a
+# file whatever --target says, which would break the source build documented in
+# docs/deployment.md.
+FROM node:24-alpine
+
+LABEL org.opencontainers.image.source="https://github.com/Softeria/ms-365-mcp-server"
+
+# No default. npm resolves an empty spec to latest, which would stamp whatever is newest
+# with the tag the workflow passes.
+ARG VERSION
+
+ENV NODE_ENV=production
+
+RUN test -n "$VERSION" || { echo 'VERSION build arg is required'; exit 1; }
+
+# --ignore-scripts keeps keytar (optional, native, no musl prebuild) from attempting a
+# node-gyp build that cannot succeed here. --omit=optional would drop @azure/identity and
+# @azure/keyvault-secrets with it, which Key Vault mode needs.
+RUN npm i -g --ignore-scripts "@softeria/ms-365-mcp-server@${VERSION}" && \
+    npm cache clean --force
+
+USER node
+
+ENTRYPOINT ["ms-365-mcp-server"]

package/dist/__tests__/graph-client.test.js

@@ -88,6 +88,121 @@ describe("GraphClient audit metadata", () => {
     const result = await createGraphClient().graphRequest("/me/messages/m1/$value");
     expect(result._meta).toMatchObject({ response_bytes: raw.byteLength });
   });
+  describe("forceBinary", () => {
+    const doc = Buffer.from([
+      208,
+      207,
+      17,
+      224,
+      161,
+      177,
+      26,
+      225,
+      255,
+      254,
+      0,
+      65
+    ]);
+    it("returns base64 bytes for a content type outside the binary allowlist", async () => {
+      fetchWithResilienceMock.mockResolvedValue(
+        new Response(doc, { status: 200, headers: { "content-type": "application/msword" } })
+      );
+      const result = await createGraphClient().graphRequest(
+        "/me/messages/m1/attachments/a1/$value",
+        {
+          rawResponse: true,
+          forceBinary: true
+        }
+      );
+      const payload = JSON.parse(result.content[0].text);
+      expect(payload).toMatchObject({
+        contentType: "application/msword",
+        encoding: "base64",
+        contentLength: doc.byteLength
+      });
+      expect(Buffer.from(payload.contentBytes, "base64").equals(doc)).toBe(true);
+      expect(payload).not.toHaveProperty("rawResponse");
+      expect(result._meta).toMatchObject({ response_bytes: doc.byteLength });
+    });
+  });
+  describe("never returns lossy text", () => {
+    const cases = [
+      {
+        name: "Word 97-2003 document",
+        contentType: "application/msword",
+        body: Buffer.from([208, 207, 17, 224, 161, 177, 26, 225, 255, 254, 0, 65])
+      },
+      {
+        name: "RTF with Windows-1252 quotes",
+        contentType: "application/rtf",
+        body: Buffer.from("{\\rtf1\\ansi \x93quoted\x94}", "latin1")
+      },
+      {
+        name: "8-bit MIME message",
+        contentType: "message/rfc822",
+        body: Buffer.from("Subject: caf\xE9\r\n\r\nna\xEFve body\r\n", "latin1")
+      },
+      {
+        name: "text/plain in Windows-1252",
+        contentType: "text/plain; charset=windows-1252",
+        body: Buffer.from("caf\xE9 \x96 dash", "latin1")
+      }
+    ];
+    for (const c of cases) {
+      it(`returns ${c.name} (${c.contentType}) as byte-identical base64`, async () => {
+        fetchWithResilienceMock.mockResolvedValue(
+          new Response(new Uint8Array(c.body), {
+            status: 200,
+            headers: { "content-type": c.contentType }
+          })
+        );
+        const result = await createGraphClient().graphRequest(
+          "/me/messages/m1/attachments/a1/$value",
+          {
+            rawResponse: true
+          }
+        );
+        const payload = JSON.parse(result.content[0].text);
+        expect(payload).not.toHaveProperty("rawResponse");
+        expect(payload).toMatchObject({ encoding: "base64", contentLength: c.body.byteLength });
+        expect(Buffer.from(payload.contentBytes, "base64").equals(c.body)).toBe(true);
+        expect(result._meta).toMatchObject({ response_bytes: c.body.byteLength });
+      });
+    }
+    it("still returns valid UTF-8 text as text, byte for byte, BOM included", async () => {
+      const body = Buffer.concat([
+        Buffer.from([239, 187, 191]),
+        Buffer.from("h\xE9llo\r\nw\xF6rld\n", "utf8")
+      ]);
+      fetchWithResilienceMock.mockResolvedValue(
+        new Response(body, {
+          status: 200,
+          headers: { "content-type": "text/plain; charset=utf-8" }
+        })
+      );
+      const result = await createGraphClient().graphRequest(
+        "/me/messages/m1/attachments/a1/$value",
+        {
+          rawResponse: true
+        }
+      );
+      const payload = JSON.parse(result.content[0].text);
+      expect(payload).not.toHaveProperty("contentBytes");
+      expect(Buffer.from(payload.rawResponse, "utf8").equals(body)).toBe(true);
+      expect(result._meta).toMatchObject({ response_bytes: body.byteLength });
+    });
+    it("still parses JSON, even with a leading byte-order mark", async () => {
+      const body = Buffer.concat([
+        Buffer.from([239, 187, 191]),
+        Buffer.from('{"id":"u1"}', "utf8")
+      ]);
+      fetchWithResilienceMock.mockResolvedValue(
+        new Response(body, { status: 200, headers: { "content-type": "application/json" } })
+      );
+      const result = await createGraphClient().graphRequest("/me");
+      expect(JSON.parse(result.content[0].text)).toEqual({ id: "u1" });
+    });
+  });
   it("preserves HTTP status metadata when response headers are requested", async () => {
     fetchWithResilienceMock.mockResolvedValue(
       new Response(JSON.stringify({ id: "task-1" }), {

package/dist/__tests__/graph-tools.test.js

@@ -1068,6 +1068,95 @@ describe("graph-tools", () => {
       expect(payload).not.toHaveProperty("target_resource");
     });
   });
+  describe("shared query contract at execution", () => {
+    it.each([{ skiptoken: 123 }, { $SKIPTOKEN: 123 }, { COUNT: "true" }, { $Count: "true" }])(
+      "rejects invalid cursor and mixed-case query values: %j",
+      async (params) => {
+        mockEndpoints.push(makeEndpoint());
+        mockEndpointsJson = [makeConfig()];
+        const graphClient = createMockGraphClient();
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        const result = await server.tools.get("test-tool").handler(params);
+        expect(result.isError).toBe(true);
+        expect(graphClient.graphRequest).not.toHaveBeenCalled();
+      }
+    );
+    it("accepts valid mixed-case query values and string cursors", async () => {
+      mockEndpoints.push(makeEndpoint());
+      mockEndpointsJson = [makeConfig()];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      await server.tools.get("test-tool").handler({ COUNT: true, $SKIPTOKEN: "next-token" });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+      const request = JSON.stringify(graphClient.graphRequest.mock.calls[0]);
+      expect(request).toContain("$count=true");
+      expect(request).toContain("$skiptoken=next-token");
+    });
+    it.each(["list-calendar-events-delta", "list-calendar-view-delta"])(
+      "ignores stale mixed-case top values for %s",
+      async (alias) => {
+        mockEndpoints.push(makeEndpoint({ alias }));
+        mockEndpointsJson = [makeConfig({ toolName: alias })];
+        const graphClient = createMockGraphClient();
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        for (const key of ["top", "$top", "TOP", "$TOP", "$Top"]) {
+          await server.tools.get(alias).handler({ [key]: 10 });
+        }
+        expect(graphClient.graphRequest).toHaveBeenCalledTimes(5);
+        for (const call of graphClient.graphRequest.mock.calls) {
+          expect(JSON.stringify(call)).not.toContain("$top");
+        }
+      }
+    );
+    it.each(["list-joined-teams", "list-my-associated-teams"])(
+      "rejects unsupported query options before Graph dispatch for %s",
+      async (alias) => {
+        mockEndpoints.push(makeEndpoint({ alias }));
+        mockEndpointsJson = [makeConfig({ toolName: alias })];
+        const graphClient = createMockGraphClient();
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        for (const key of ["top", "$top", "skiptoken", "$skiptoken", "select", "$select"]) {
+          const value = key.replace("$", "") === "top" ? 100 : "next-token";
+          const result = await server.tools.get(alias).handler({ [key]: value });
+          expect(result.isError).toBe(true);
+        }
+        expect(graphClient.graphRequest).not.toHaveBeenCalled();
+      }
+    );
+    it("rejects oversized chat pages before Graph dispatch, including dollar-prefixed input", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-chats" }));
+      mockEndpointsJson = [makeConfig({ toolName: "list-chats" })];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      for (const key of ["top", "$top"]) {
+        const result = await server.tools.get("list-chats").handler({ [key]: 100 });
+        expect(result.isError).toBe(true);
+      }
+      expect(graphClient.graphRequest).not.toHaveBeenCalled();
+    });
+    it("sends a calendar field array as comma-separated text in one Graph request", async () => {
+      const alias = "list-calendar-events-delta";
+      mockEndpoints.push(makeEndpoint({ alias }));
+      mockEndpointsJson = [makeConfig({ toolName: alias })];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      await server.tools.get(alias).handler({ select: ["id", "subject"] });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+      expect(JSON.stringify(graphClient.graphRequest.mock.calls[0])).toContain("id,subject");
+    });
+  });
   describe("skiptoken cursor", () => {
     const prevAllowPagination = process.env.MS365_MCP_ALLOW_PAGINATION;
     afterEach(() => {
@@ -2098,6 +2187,8 @@ describe("graph-tools", () => {
       const [path, options] = graphClient.graphRequest.mock.calls[0];
       expect(path).toBe("/me/photo/$value");
       expect(options.accessToken).toBeUndefined();
+      expect(options.forceBinary).toBe(true);
+      expect(options.rawResponse).toBe(true);
     });
     it("rejects absolute URLs (Graph paths only)", async () => {
       mockEndpoints.length = 0;

package/dist/generated/client.js

@@ -846,8 +846,8 @@ const microsoft_graph_driveItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
   audio: microsoft_graph_audio.optional(),
   bundle: microsoft_graph_bundle.optional(),
   cTag: z.string().describe(
@@ -2586,8 +2586,8 @@ const microsoft_graph_listItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
   contentType: microsoft_graph_contentTypeInfo.optional(),
   deleted: microsoft_graph_deleted.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2708,8 +2708,8 @@ const microsoft_graph_list = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
     displayName: z.string().describe("The displayable title of the list.").nullish(),
     list: microsoft_graph_listInfo.optional(),
     sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2741,8 +2741,8 @@ const microsoft_graph_drive = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
     driveType: z.string().describe(
       "Describes the type of drive represented by this resource. OneDrive personal drives return personal. OneDrive for Business returns business. SharePoint document libraries return documentLibrary. Read-only."
     ).nullish(),
@@ -4558,8 +4558,8 @@ const microsoft_graph_baseItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional()
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional()
 }).passthrough();
 const microsoft_graph_site = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
@@ -4580,8 +4580,8 @@ const microsoft_graph_site = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
   isPersonalSite: z.boolean().describe("Identifies whether the site is personal or not. Read-only.").nullish(),
   root: microsoft_graph_root.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -5880,8 +5880,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -5995,8 +5995,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 138 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(

package/dist/graph-client.js

@@ -11,6 +11,7 @@ import { applyMessageSignoffToRequest } from "./lib/message-signoff.js";
 import { TRANSPORT_OK_MESSAGE } from "./lib/select-projection.js";
 import { open, stat, unlink } from "fs/promises";
 import { pipeline } from "stream/promises";
+const UTF8_STRICT = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 function isBinaryContentType(contentType) {
   if (!contentType) return false;
   const lower = contentType.toLowerCase().split(";")[0].trim();
@@ -120,11 +121,20 @@ class GraphClient {
         throw await this.createGraphApiError(response);
       }
       const contentTypeHeader = response.headers?.get?.("content-type") || "";
-      const isBinaryResponse = isBinaryContentType(contentTypeHeader);
+      const isBinaryResponse = options.forceBinary === true || isBinaryContentType(contentTypeHeader);
       let metadata = { http_status: response.status };
       let result;
-      if (isBinaryResponse) {
-        const buffer = Buffer.from(await response.arrayBuffer());
+      const buffer = Buffer.from(await response.arrayBuffer());
+      metadata = { ...metadata, response_bytes: buffer.byteLength };
+      let text;
+      if (!isBinaryResponse) {
+        try {
+          text = UTF8_STRICT.decode(buffer);
+        } catch {
+          text = void 0;
+        }
+      }
+      if (text === void 0) {
         result = {
           message: TRANSPORT_OK_MESSAGE,
           contentType: contentTypeHeader,
@@ -132,20 +142,15 @@ class GraphClient {
           contentLength: buffer.byteLength,
           contentBytes: buffer.toString("base64")
         };
-        metadata = { ...metadata, response_bytes: buffer.byteLength };
+      } else if (text === "") {
+        result = { message: TRANSPORT_OK_MESSAGE };
+      } else if (options.rawResponse) {
+        result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
       } else {
-        const text = await response.text();
-        metadata = { ...metadata, response_bytes: Buffer.byteLength(text, "utf8") };
-        if (text === "") {
-          result = { message: TRANSPORT_OK_MESSAGE };
-        } else if (options.rawResponse) {
+        try {
+          result = JSON.parse(text.charCodeAt(0) === 65279 ? text.slice(1) : text);
+        } catch {
           result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
-        } else {
-          try {
-            result = JSON.parse(text);
-          } catch {
-            result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
-          }
         }
       }
       if (endpoint === "/$batch") {

package/dist/graph-tools.js

@@ -35,6 +35,7 @@ import { parseTeamsUrl } from "./lib/teams-url-parser.js";
 import { buildBM25Index, scoreQuery, tokenize } from "./lib/bm25.js";
 import { deriveTargetResource } from "./audit-target-resource.js";
 import { describeToolSchema, describeUtilityToolSchema } from "./lib/tool-schema.js";
+import { queryParameterSchema } from "./lib/query-parameter-schema.js";
 import {
   TOP_UNSUPPORTED_DELTA_TOOLS,
   shouldOmitTopParam,
@@ -43,14 +44,6 @@ import {
   DEFAULT_MAX_PAGES,
   getMaxPages,
   isFetchAllPagesApplicable,
-  FILTER_PARAM_DESCRIPTION,
-  SEARCH_PARAM_DESCRIPTION,
-  SELECT_PARAM_DESCRIPTION,
-  EXPAND_PARAM_DESCRIPTION,
-  ORDERBY_PARAM_DESCRIPTION,
-  TOP_PARAM_DESCRIPTION,
-  SKIP_PARAM_DESCRIPTION,
-  COUNT_PARAM_DESCRIPTION,
   CONFIRM_PARAM_DESCRIPTION,
   TIMEZONE_PARAM_DESCRIPTION,
   EXPAND_EXTENDED_PROPERTIES_PARAM_DESCRIPTION,
@@ -686,7 +679,8 @@ const UTILITY_TOOLS = [
         }
         return await graphClient.graphRequest(target, {
           accessToken: accountAccessToken,
-          rawResponse: true
+          rawResponse: true,
+          forceBinary: true
         });
       } catch (error) {
         return {
@@ -1195,13 +1189,38 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         "search",
         "format"
       ];
-      const normalizedParamName = paramName.startsWith("$") ? paramName.slice(1) : paramName;
-      const isOdataParam = odataParams.includes(normalizedParamName.toLowerCase());
-      const fixedParamName = isOdataParam ? `$${normalizedParamName.toLowerCase()}` : paramName;
+      const bareParamName = paramName.startsWith("$") ? paramName.slice(1) : paramName;
+      const isOdataParam = odataParams.includes(bareParamName.toLowerCase());
+      const normalizedParamName = isOdataParam ? bareParamName.toLowerCase() : bareParamName;
+      const fixedParamName = isOdataParam ? `$${normalizedParamName}` : paramName;
       const camelCaseParamName = paramName.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
       const paramDef = parameterDefinitions.find(
-        (p) => p.name === paramName || p.name === camelCaseParamName || isOdataParam && p.name === normalizedParamName
+        (p) => p.name === paramName || p.name === camelCaseParamName || isOdataParam && p.name.replace(/^\$/, "").toLowerCase() === normalizedParamName
       );
+      const isQuery = paramDef?.type === "Query" || isOdataParam;
+      const ignoredDeltaTop = shouldOmitTopParam(tool.alias) && normalizedParamName === "top";
+      if (isQuery && !ignoredDeltaTop && paramValue != null && paramValue !== "") {
+        const schema = queryParameterSchema(
+          tool.alias,
+          normalizedParamName,
+          paramDef?.schema ?? z.any()
+        );
+        if (!schema || !schema.safeParse(paramValue).success) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  error: "invalid_query_parameter",
+                  parameter: fixedParamName,
+                  message: schema ? "Value does not match the query contract. Check get-tool-schema." : "This endpoint does not support this query parameter."
+                })
+              }
+            ],
+            isError: true
+          };
+        }
+      }
       if (paramDef) {
         switch (paramDef.type) {
           case "Path": {
@@ -1632,6 +1651,11 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
     const paramSchema = {};
     if (tool.parameters && tool.parameters.length > 0) {
       for (const param of tool.parameters) {
+        if (param.type === "Query") {
+          const schema = queryParameterSchema(tool.alias, param.name, param.schema || z.any());
+          if (schema) paramSchema[param.name] = schema;
+          continue;
+        }
         paramSchema[param.name] = param.type === "Body" && param.schema ? lenientBodySchema(param.schema) : param.schema || z.any();
       }
     }
@@ -1652,41 +1676,6 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
     if (isSkiptokenApplicable(tool, Object.keys(paramSchema))) {
       paramSchema["skiptoken"] = z.string().describe(SKIPTOKEN_PARAM_DESCRIPTION).optional();
     }
-    if (paramSchema["filter"] !== void 0 || paramSchema["$filter"] !== void 0) {
-      const key = paramSchema["$filter"] !== void 0 ? "$filter" : "filter";
-      paramSchema[key] = z.string().describe(FILTER_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["search"] !== void 0 || paramSchema["$search"] !== void 0) {
-      const key = paramSchema["$search"] !== void 0 ? "$search" : "search";
-      paramSchema[key] = z.string().describe(SEARCH_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["select"] !== void 0 || paramSchema["$select"] !== void 0) {
-      const key = paramSchema["$select"] !== void 0 ? "$select" : "select";
-      paramSchema[key] = z.string().describe(SELECT_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["expand"] !== void 0 || paramSchema["$expand"] !== void 0) {
-      const key = paramSchema["$expand"] !== void 0 ? "$expand" : "expand";
-      paramSchema[key] = z.array(z.string()).describe(EXPAND_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["orderby"] !== void 0 || paramSchema["$orderby"] !== void 0) {
-      const key = paramSchema["$orderby"] !== void 0 ? "$orderby" : "orderby";
-      paramSchema[key] = z.string().describe(ORDERBY_PARAM_DESCRIPTION).optional();
-    }
-    if (shouldOmitTopParam(tool.alias)) {
-      delete paramSchema["top"];
-      delete paramSchema["$top"];
-    } else if (paramSchema["top"] !== void 0 || paramSchema["$top"] !== void 0) {
-      const key = paramSchema["$top"] !== void 0 ? "$top" : "top";
-      paramSchema[key] = z.number().describe(TOP_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["skip"] !== void 0 || paramSchema["$skip"] !== void 0) {
-      const key = paramSchema["$skip"] !== void 0 ? "$skip" : "skip";
-      paramSchema[key] = z.number().describe(SKIP_PARAM_DESCRIPTION).optional();
-    }
-    if (paramSchema["count"] !== void 0 || paramSchema["$count"] !== void 0) {
-      const countKey = paramSchema["$count"] !== void 0 ? "$count" : "count";
-      paramSchema[countKey] = z.boolean().describe(COUNT_PARAM_DESCRIPTION).optional();
-    }
     if (multiAccount) {
       paramSchema["account"] = z.string().describe(getAccountParamDescription(accountNames)).optional();
     }

package/dist/lib/query-parameter-schema.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { getODataParamDescription, shouldOmitTopParam } from "./param-descriptions.js";
+const TEAM_LIST_TOOLS = /* @__PURE__ */ new Set(["list-joined-teams", "list-my-associated-teams"]);
+function queryParameterSchema(toolName, name, providerSchema) {
+  const bareName = name.replace(/^\$/, "").toLowerCase();
+  if (TEAM_LIST_TOOLS.has(toolName)) return void 0;
+  if (bareName === "top" && shouldOmitTopParam(toolName)) return void 0;
+  const source = providerSchema instanceof z.ZodOptional ? providerSchema.unwrap() : providerSchema;
+  let schema = source;
+  switch (bareName) {
+    case "select":
+    case "expand":
+    case "orderby":
+      schema = z.union([z.string(), z.array(z.string())]);
+      break;
+    case "filter":
+    case "search":
+      schema = z.string();
+      break;
+    case "skiptoken":
+      schema = z.string();
+      break;
+    case "top":
+      if (toolName === "list-chats") schema = source.and(z.number().max(50));
+      break;
+  }
+  if (providerSchema.isOptional()) schema = schema.optional();
+  const description = getODataParamDescription(bareName);
+  return description ? schema.describe(description) : schema;
+}
+export {
+  queryParameterSchema
+};

package/dist/lib/tool-schema.js

@@ -1,8 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
+import { queryParameterSchema } from "./query-parameter-schema.js";
 import { isDestructiveOperation } from "./destructive-ops.js";
 import {
-  getODataParamDescription,
-  shouldOmitTopParam,
   isFetchAllPagesApplicable,
   isSkiptokenApplicable,
   SKIPTOKEN_PARAM_DESCRIPTION,
@@ -22,24 +21,23 @@ function unwrapOptional(schema) {
   }
   return { inner: schema, optional: false };
 }
-function bareParamName(name) {
-  return name.startsWith("$") ? name.slice(1) : name;
-}
 function describeToolSchema(tool, config, ctx = {}) {
-  const omitTop = shouldOmitTopParam(tool.alias);
-  const params = (tool.parameters ?? []).filter((p) => !(omitTop && bareParamName(p.name) === "top")).map((p) => {
-    const { inner, optional } = unwrapOptional(p.schema);
+  const params = (tool.parameters ?? []).flatMap((p) => {
+    const effectiveSchema = p.type === "Query" ? queryParameterSchema(tool.alias, p.name, p.schema) : p.schema;
+    if (!effectiveSchema) return [];
+    const { inner, optional } = unwrapOptional(effectiveSchema);
     const isPath = p.type === "Path";
     const jsonSchema = zodToJsonSchema(inner, { target: "jsonSchema7", $refStrategy: "none" });
     const { $schema: _s, ...schema } = jsonSchema;
-    const override = p.type === "Query" ? getODataParamDescription(bareParamName(p.name)) : void 0;
-    return {
-      name: p.name,
-      in: p.type,
-      required: isPath || !optional,
-      description: override ?? p.description,
-      schema
-    };
+    return [
+      {
+        name: p.name,
+        in: p.type,
+        required: isPath || !optional,
+        description: effectiveSchema.description ?? p.description,
+        schema
+      }
+    ];
   });
   if (isDestructiveOperation(tool.method, config)) {
     params.push({

package/docs/deployment.md

@@ -28,7 +28,25 @@ In HTTP mode, `MS365_MCP_AUTH_CACHE_COMMAND` is skipped at startup and per Graph
 
 ## Docker
 
-A `Dockerfile` is included for containerized deployments:
+Released images are published to GitHub Container Registry:
+
+```bash
+docker pull ghcr.io/softeria/ms-365-mcp-server:latest
+# or pin a release
+docker pull ghcr.io/softeria/ms-365-mcp-server:<version>
+```
+
+The image runs as a non-root user and takes the same arguments as the CLI:
+
+```bash
+docker run -p 3000:3000 \
+  -e MS365_MCP_CLIENT_ID=your-client-id \
+  -e MS365_MCP_TENANT_ID=your-tenant-id \
+  ghcr.io/softeria/ms-365-mcp-server:latest \
+  --http 3000 --org-mode
+```
+
+A `Dockerfile` is also included, to build from source instead:
 
 ```bash
 # Build the image

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.154.0",
+  "version": "0.154.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",