@softeria/ms-365-mcp-server 0.157.2 → 0.158.1

package/dist/__tests__/graph-tools.test.js

@@ -1,8 +1,8 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { z } from "zod";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { z } from "zod";
 const loggerMock = vi.hoisted(() => ({
   info: vi.fn(),
   warn: vi.fn(),
@@ -2331,16 +2331,11 @@ describe("graph-tools", () => {
       };
       const server = createMockServer();
       const { registerGraphTools } = await loadModule();
-      registerGraphTools(
-        server,
-        graphClient,
-        false,
-        void 0,
-        false,
+      registerGraphTools(server, graphClient, {
         authManager,
-        true,
-        ["user1@domain.com", "user2@domain.com"]
-      );
+        multiAccount: true,
+        accountNames: ["user1@domain.com", "user2@domain.com"]
+      });
       const outputPath = join(tmpDir, "invoice.pdf");
       const result = await server.tools.get("download-bytes-to-file").handler({
         target: "/me/messages/m1/attachments/a1/$value",
@@ -2364,18 +2359,7 @@ describe("graph-tools", () => {
       expect(stdioServer.tools.has("download-bytes-to-file")).toBe(true);
       expect(stdioServer.tools.has("download-bytes")).toBe(true);
       const httpServer = createMockServer();
-      registerGraphTools(
-        httpServer,
-        {},
-        false,
-        void 0,
-        false,
-        void 0,
-        false,
-        [],
-        void 0,
-        true
-      );
+      registerGraphTools(httpServer, {}, { httpMode: true });
       expect(httpServer.tools.has("download-bytes-to-file")).toBe(false);
       expect(httpServer.tools.has("download-bytes")).toBe(true);
     });
@@ -2730,16 +2714,11 @@ describe("graph-tools", () => {
       };
       const server = createMockServer();
       const { registerGraphTools } = await loadModule();
-      registerGraphTools(
-        server,
-        graphClient,
-        false,
-        void 0,
-        false,
+      registerGraphTools(server, graphClient, {
         authManager,
-        true,
-        ["user1@domain.com", "user2@domain.com"]
-      );
+        multiAccount: true,
+        accountNames: ["user1@domain.com", "user2@domain.com"]
+      });
       const { requestContext } = await import("../request-context.js");
       const tool = server.tools.get("get-download-url");
       const bearer = makeJwt({ upn: "user1@domain.com" });
@@ -2790,17 +2769,9 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerGraphTools } = await loadModule();
-      registerGraphTools(
-        server,
-        createMockGraphClient(),
-        false,
-        void 0,
-        false,
-        void 0,
-        false,
-        [],
-        "Mail.Read"
-      );
+      registerGraphTools(server, createMockGraphClient(), {
+        allowedScopes: "Mail.Read"
+      });
       expect(server.tools.has("list-mail-messages")).toBe(true);
       expect(server.tools.has("list-calendar-events")).toBe(false);
     });
@@ -2825,17 +2796,9 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerGraphTools } = await loadModule();
-      registerGraphTools(
-        server,
-        createMockGraphClient(),
-        false,
-        void 0,
-        false,
-        void 0,
-        false,
-        [],
-        "Mail.Read"
-      );
+      registerGraphTools(server, createMockGraphClient(), {
+        allowedScopes: "Mail.Read"
+      });
       const handler = server.server._requestHandlers.get("tools/call");
       await expect(
         handler?.(
@@ -2896,17 +2859,7 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(
-        server,
-        {},
-        false,
-        false,
-        void 0,
-        false,
-        [],
-        void 0,
-        "Mail.Read"
-      );
+      registerDiscoveryTools(server, {}, { allowedScopes: "Mail.Read" });
       const result = await server.tools.get("search-tools").handler({ limit: 50 });
       const found = JSON.parse(result.content[0].text).tools.map((t) => t.name);
       expect(found).toContain("list-mail-messages");
@@ -2933,17 +2886,7 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(
-        server,
-        {},
-        false,
-        false,
-        void 0,
-        false,
-        [],
-        void 0,
-        "Mail.Read"
-      );
+      registerDiscoveryTools(server, {}, { allowedScopes: "Mail.Read" });
       const result = await server.tools.get("execute-tool").handler({
         tool_name: "get-drive-item",
         parameters: { driveId: "drive-1", driveItemId: "item-2" }
@@ -2985,17 +2928,7 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(
-        server,
-        {},
-        false,
-        false,
-        void 0,
-        false,
-        [],
-        void 0,
-        "Mail.Read"
-      );
+      registerDiscoveryTools(server, {}, { allowedScopes: "Mail.Read" });
       const handler = server.server._requestHandlers.get("tools/call");
       await expect(
         handler?.(
@@ -3121,7 +3054,7 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(server, {}, false, false, void 0, false, [], "mail");
+      registerDiscoveryTools(server, {}, { enabledTools: "mail" });
       const result = await server.tools.get("search-tools").handler({ limit: 50 });
       const found = JSON.parse(result.content[0].text).tools.map((t) => t.name);
       expect(found).toContain("list-mail-messages");
@@ -3157,16 +3090,7 @@ describe("graph-tools", () => {
       ];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(
-        server,
-        {},
-        false,
-        false,
-        void 0,
-        false,
-        [],
-        "^list-mail-messages$"
-      );
+      registerDiscoveryTools(server, {}, { enabledTools: "^list-mail-messages$" });
       const result = await server.tools.get("execute-tool").handler({
         tool_name: "get-drive-item",
         parameters: { driveId: "drive-1", driveItemId: "item-2" }
@@ -3191,16 +3115,7 @@ describe("graph-tools", () => {
       mockEndpointsJson = [];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(
-        server,
-        {},
-        false,
-        false,
-        void 0,
-        false,
-        [],
-        "^download-bytes$"
-      );
+      registerDiscoveryTools(server, {}, { enabledTools: "^download-bytes$" });
       const result = await server.tools.get("search-tools").handler({ limit: 50 });
       const found = JSON.parse(result.content[0].text).tools.map((t) => t.name);
       expect(found).toContain("download-bytes");
@@ -3211,16 +3126,7 @@ describe("graph-tools", () => {
       mockEndpointsJson = [];
       const server = createMockServer();
       const { registerDiscoveryTools } = await loadModule();
-      registerDiscoveryTools(
-        server,
-        {},
-        false,
-        false,
-        void 0,
-        false,
-        [],
-        "[invalid"
-      );
+      registerDiscoveryTools(server, {}, { enabledTools: "[invalid" });
       const result = await server.tools.get("search-tools").handler({ limit: 50 });
       const found = JSON.parse(result.content[0].text).tools.map((t) => t.name);
       expect(found).toContain("download-bytes");
@@ -3233,7 +3139,7 @@ describe("graph-tools", () => {
       mockEndpointsJson = [];
       const server = createMockServer();
       const { registerGraphTools } = await loadModule();
-      registerGraphTools(server, {}, true);
+      registerGraphTools(server, {}, { readOnly: true });
       expect(server.tools.has("download-bytes")).toBe(true);
       expect(server.tools.has("parse-teams-url")).toBe(true);
     });
@@ -3485,6 +3391,387 @@ describe("graph-tools", () => {
         joinWebUrl: "https://teams/x"
       });
     });
+    it("restricts list-users selects and responses to the configured user fields", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-users", path: "/users" }));
+      mockEndpointsJson = [
+        makeConfig({ toolName: "list-users", pathPattern: "/users", scopes: ["User.Read.All"] })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                value: [
+                  { id: "1", displayName: "Carlos", mail: "carlos@example.com", jobTitle: "CEO" }
+                ]
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, {
+        userFields: "id,displayName,mail"
+      });
+      const result = await server.tools.get("list-users").handler({
+        select: "id,displayName,mail,jobTitle"
+      });
+      expect(graphClient.graphRequest.mock.calls[0][0]).toContain("$select=id,displayName,mail");
+      expect(graphClient.graphRequest.mock.calls[0][0]).not.toContain("jobTitle");
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "1",
+        displayName: "Carlos",
+        mail: "carlos@example.com"
+      });
+    });
+    it("adds the configured fields when list-users is called without select", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-users", path: "/users" }));
+      mockEndpointsJson = [
+        makeConfig({ toolName: "list-users", pathPattern: "/users", scopes: ["User.Read.All"] })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                value: [{ id: "1", displayName: "Carlos", jobTitle: "CEO" }]
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      const result = await server.tools.get("list-users").handler({});
+      expect(graphClient.graphRequest.mock.calls[0][0]).toContain("$select=id,displayName");
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "1",
+        displayName: "Carlos"
+      });
+    });
+    it("blocks expanded user data outside the list-users field boundary", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-users", path: "/users" }));
+      mockEndpointsJson = [
+        makeConfig({ toolName: "list-users", pathPattern: "/users", scopes: ["User.Read.All"] })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                value: [
+                  {
+                    id: "1",
+                    displayName: "Carlos",
+                    manager: { displayName: "Manager", jobTitle: "CEO" }
+                  }
+                ]
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      const result = await server.tools.get("list-users").handler({
+        select: "id,displayName",
+        expand: "manager($select=displayName,jobTitle)"
+      });
+      expect(graphClient.graphRequest.mock.calls[0][0]).not.toContain("$expand");
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "1",
+        displayName: "Carlos"
+      });
+    });
+    async function runListUsers(userFields, args, graphBody) {
+      mockEndpoints.push(makeEndpoint({ alias: "list-users", path: "/users" }));
+      mockEndpointsJson = [
+        makeConfig({ toolName: "list-users", pathPattern: "/users", scopes: ["User.Read.All"] })
+      ];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify(graphBody) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields });
+      const result = await server.tools.get("list-users").handler(args);
+      return { result, graphClient };
+    }
+    it("still projects when the requested fields are all disallowed", async () => {
+      const { result, graphClient } = await runListUsers(
+        "id,displayName",
+        { select: "jobTitle,employeeId" },
+        { value: [{ id: "1", displayName: "Carlos", jobTitle: "CEO" }] }
+      );
+      expect(graphClient.graphRequest.mock.calls[0][0]).toContain("$select=id,displayName");
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "1",
+        displayName: "Carlos"
+      });
+    });
+    it("drops id when the allowlist does not name it", async () => {
+      const { result } = await runListUsers(
+        "displayName",
+        {},
+        { value: [{ id: "1", displayName: "Carlos", jobTitle: "CEO" }] }
+      );
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({ displayName: "Carlos" });
+    });
+    it("keeps the pagination envelope while enforcing the boundary", async () => {
+      const { result } = await runListUsers(
+        "displayName",
+        {},
+        {
+          "@odata.nextLink": "https://graph/next",
+          value: [{ id: "1", displayName: "Carlos", jobTitle: "CEO" }]
+        }
+      );
+      expect(JSON.parse(result.content[0].text)).toEqual({
+        "@odata.nextLink": "https://graph/next",
+        value: [{ displayName: "Carlos" }]
+      });
+    });
+    it("fails closed when Graph returns none of the allowlisted fields", async () => {
+      const { result } = await runListUsers(
+        "displayName",
+        {},
+        { value: [{ id: "1", jobTitle: "CEO", employeeId: "E-1" }] }
+      );
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({});
+    });
+    it("refuses to register with an allowlist that names no fields", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-users", path: "/users" }));
+      mockEndpointsJson = [
+        makeConfig({ toolName: "list-users", pathPattern: "/users", scopes: ["User.Read.All"] })
+      ];
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      expect(
+        () => registerGraphTools(server, createMockGraphClient(), { userFields: " , ," })
+      ).toThrow(/names no fields/);
+    });
+    it("enforces the boundary through discovery mode execute-tool", async () => {
+      mockEndpoints.push(makeEndpoint({ alias: "list-users", path: "/users" }));
+      mockEndpointsJson = [
+        makeConfig({ toolName: "list-users", pathPattern: "/users", scopes: ["User.Read.All"] })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                value: [{ id: "1", displayName: "Carlos", jobTitle: "CEO" }]
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerDiscoveryTools } = await loadModule();
+      registerDiscoveryTools(server, graphClient, {
+        userFields: "id,displayName"
+      });
+      const result = await server.tools.get("execute-tool").handler({
+        tool_name: "list-users",
+        parameters: { select: "id,displayName,jobTitle" }
+      });
+      expect(graphClient.graphRequest.mock.calls[0][0]).toContain("$select=id,displayName");
+      expect(graphClient.graphRequest.mock.calls[0][0]).not.toContain("jobTitle");
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "1",
+        displayName: "Carlos"
+      });
+    });
+    it("projects a directory navigation that returns user profile data", async () => {
+      mockEndpoints.push(
+        makeEndpoint({ alias: "get-user-manager", path: "/users/:userId/manager" })
+      );
+      mockEndpointsJson = [
+        makeConfig({
+          toolName: "get-user-manager",
+          pathPattern: "/users/{user-id}/manager",
+          scopes: ["User.Read.All"]
+        })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                id: "m1",
+                displayName: "Manager",
+                mail: "manager@example.com",
+                jobTitle: "CEO",
+                employeeId: "E-9"
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, {
+        userFields: "id,displayName,mail"
+      });
+      const result = await server.tools.get("get-user-manager").handler({ userId: "abc" });
+      expect(graphClient.graphRequest.mock.calls[0][0]).not.toContain("$select");
+      expect(JSON.parse(result.content[0].text)).toEqual({
+        id: "m1",
+        displayName: "Manager",
+        mail: "manager@example.com"
+      });
+    });
+    it("projects group members, which carry the same profile fields", async () => {
+      mockEndpoints.push(
+        makeEndpoint({ alias: "list-group-members", path: "/groups/:groupId/members" })
+      );
+      mockEndpointsJson = [
+        makeConfig({
+          toolName: "list-group-members",
+          pathPattern: "/groups/{group-id}/members",
+          scopes: ["GroupMember.Read.All"]
+        })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                value: [{ id: "1", displayName: "Carlos", jobTitle: "CEO" }]
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      const result = await server.tools.get("list-group-members").handler({ groupId: "g1" });
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "1",
+        displayName: "Carlos"
+      });
+    });
+    it.each([
+      { alias: "get-current-user", path: "/me", pathPattern: "/me", args: {} },
+      {
+        alias: "get-group",
+        path: "/groups/:groupId",
+        pathPattern: "/groups/{group-id}",
+        args: { groupId: "g1" }
+      }
+    ])("strips $expand from $alias while the field policy is active", async (endpoint) => {
+      mockEndpoints.push(makeEndpoint({ alias: endpoint.alias, path: endpoint.path }));
+      mockEndpointsJson = [
+        makeConfig({
+          toolName: endpoint.alias,
+          pathPattern: endpoint.pathPattern,
+          scopes: ["User.Read.All"]
+        })
+      ];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ id: "1" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      await server.tools.get(endpoint.alias).handler({
+        ...endpoint.args,
+        expand: "manager($select=displayName,jobTitle)"
+      });
+      expect(graphClient.graphRequest.mock.calls[0][0]).not.toContain("$expand");
+    });
+    it("restricts a graph-batch subrequest that reads the users surface", async () => {
+      mockEndpoints.push(
+        makeEndpoint({
+          alias: "graph-batch",
+          method: "post",
+          path: "/$batch",
+          parameters: [{ name: "body", type: "Body", schema: z.any() }]
+        })
+      );
+      mockEndpointsJson = [
+        makeConfig({ toolName: "graph-batch", pathPattern: "/$batch", method: "post" })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                responses: [
+                  {
+                    id: "1",
+                    status: 200,
+                    body: {
+                      value: [{ id: "1", displayName: "Carlos", employeeId: "E-1" }]
+                    }
+                  },
+                  { id: "2", status: 200, body: { id: "m1", subject: "Keep me" } },
+                  { id: "3", status: 200, body: { id: "g1", displayName: "Team" } }
+                ]
+              })
+            }
+          ]
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      const result = await server.tools.get("graph-batch").handler({
+        body: {
+          requests: [
+            { id: "1", method: "GET", url: "/users?$select=id,displayName,employeeId" },
+            { id: "2", method: "GET", url: "/me/messages/m1?$select=id,subject" },
+            { id: "3", method: "GET", url: "/groups/g1?$expand=members($select=mail)" }
+          ]
+        }
+      });
+      const sentBody = JSON.parse(graphClient.graphRequest.mock.calls[0][1].body);
+      expect(sentBody.requests[0].url).toBe("/users?$select=id,displayName");
+      expect(sentBody.requests[1].url).toBe("/me/messages/m1?$select=id,subject");
+      expect(sentBody.requests[2].url).toBe("/groups/g1");
+      const responses = JSON.parse(result.content[0].text).responses;
+      expect(responses[0].body.value[0]).toEqual({ id: "1", displayName: "Carlos" });
+      expect(responses[1].body).toEqual({ id: "m1", subject: "Keep me" });
+    });
+    it("refuses a byte-passthrough read of the users surface", async () => {
+      mockEndpoints.length = 0;
+      mockEndpointsJson = [];
+      const graphClient = createMockGraphClient();
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      const result = await server.tools.get("download-bytes").handler({
+        target: "/users?$select=employeeId"
+      });
+      expect(result.isError).toBe(true);
+      expect(JSON.parse(result.content[0].text).error).toBe("user_fields_restricted");
+      expect(graphClient.graphRequest).not.toHaveBeenCalled();
+    });
+    it("still allows byte reads below a user, such as a profile photo", async () => {
+      mockEndpoints.length = 0;
+      mockEndpointsJson = [];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: JSON.stringify({ message: "OK!" }) }] }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient, { userFields: "id,displayName" });
+      await server.tools.get("download-bytes").handler({
+        target: "/users/abc/photo/$value"
+      });
+      expect(graphClient.graphRequest).toHaveBeenCalledTimes(1);
+    });
     it("leaves the body untouched when no select was passed", async () => {
       const { result } = await run({});
       expect(JSON.parse(result.content[0].text)).toEqual(untrimmed);

package/dist/cli.js

@@ -2,8 +2,8 @@ import { Command, Option } from "commander";
 import { readFileSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-import { getCombinedPresetPattern, listPresets, presetRequiresOrgMode } from "./tool-categories.js";
 import { assertSignoffMarkersVisible } from "./lib/message-signoff.js";
+import { getCombinedPresetPattern, listPresets, presetRequiresOrgMode } from "./tool-categories.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, "..", "package.json");
 const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
@@ -42,6 +42,9 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 ).option(
   "--allowed-scopes <scopes>",
   "Limit exposed tools to Graph scopes covered by this whitespace-separated allowlist"
+).option(
+  "--user-fields <fields>",
+  "Allow only these comma-separated Microsoft Graph fields in user profile responses (/users and /users/{id})"
 ).option(
   "--extra-scopes <scopes>",
   "Append additional Graph scopes (whitespace-separated) to the token request, beyond those derived from enabled tools. Use with your own app registration (MS365_MCP_CLIENT_ID/SECRET) to request scopes the default app does not declare, then call the endpoints via graph-batch."
@@ -130,6 +133,15 @@ function parseArgs() {
     );
     process.exit(1);
   }
+  if (options.userFields === void 0 && process.env.MS365_MCP_USER_FIELDS !== void 0) {
+    options.userFields = process.env.MS365_MCP_USER_FIELDS;
+  }
+  if (options.userFields !== void 0 && String(options.userFields).split(",").every((field) => field.trim() === "")) {
+    console.error(
+      "Error: --user-fields / MS365_MCP_USER_FIELDS was provided but names no fields. Provide one or more comma-separated Graph fields, or omit it to disable the user profile field boundary."
+    );
+    process.exit(1);
+  }
   if (options.extraScopes === void 0 && process.env.MS365_MCP_EXTRA_SCOPES !== void 0) {
     options.extraScopes = process.env.MS365_MCP_EXTRA_SCOPES;
   }

package/dist/generated/client-beta.js

@@ -748,6 +748,7 @@ const microsoft_graph_customEmojiFromIdentitySet = z.object({
   user: microsoft_graph_identity.optional()
 }).passthrough();
 const microsoft_graph_teamworkCustomEmoji = z.object({
+  id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
   contentBytes: z.string().describe(
     "The base64-encoded image content of the emoji. Supported formats include PNG and GIF."
   ).nullish(),