@softeria/ms-365-mcp-server 0.158.1 → 0.159.0

package/README.md

@@ -16,6 +16,8 @@ This server supports multiple Microsoft cloud environments:
 | **Global** (default) | International Microsoft 365        | login.microsoftonline.com | graph.microsoft.com             |
 | **China** (21Vianet) | Microsoft 365 operated by 21Vianet | login.chinacloudapi.cn    | microsoftgraph.chinacloudapi.cn |
 
+To route Graph traffic through a proxy of your own (one that terminates the client's plain HTTP and originates TLS to Microsoft), set `MS365_MCP_GRAPH_BASE_URL` to its base URL; see the environment variable list under CLI Options, including what still bypasses it.
+
 ## Prerequisites
 
 - Node.js >= 20 (recommended)
@@ -734,6 +736,7 @@ Environment variables:
 - `MS365_MCP_ATTACHMENT_HOST=<host>`: Interface the `MS365_MCP_ATTACHMENT_PORT` listener binds (alternative to --attachment-host; requires `--attachment-port`). Defaults to the host `--http` bound — which for a wildcard `--http` means both ports answer everywhere and the port split isolates nothing. See "Splitting the attachment listener"
 - `MS365_MCP_HTTP_LOCAL_FILE_TOOLS=true|1`: Register download-bytes-to-file over HTTP (alternative to --http-local-file-tools; same restrictions)
 - `MS365_MCP_CLOUD_TYPE=global|china`: Microsoft cloud environment (alternative to --cloud flag)
+- `MS365_MCP_GRAPH_BASE_URL=<url>`: Send Graph API requests to this base URL instead of the cloud's `graph.microsoft.com` (e.g. `http://127.0.0.1:10255/tenant-a/graph` for an egress proxy that originates TLS itself). Absolute http(s) URL without query or fragment; a path prefix is kept, so requests go to `<url>/v1.0/...`. The login authority and the On-Behalf-Of token resource are unchanged. Two things bypass it: `get-download-url` returns Graph's pre-authenticated SharePoint URL, and the `302` from `/content` points straight at SharePoint, so whoever follows either connects to SharePoint directly; if you control egress, allow those SharePoint hosts or disable those tools. Not read from `.env`
 - `LOG_LEVEL`: Set logging level (default: 'info')
 - `SILENT=true|1`: Disable console output
 - `MS365_MCP_REDACT_PII=false|0`: Disable scrubbing of JWTs, Bearer headers, OAuth token fields, and email addresses from log messages (default: enabled). The server handles live Graph bearer tokens, so redaction is on unless you opt out for fully verbose local debugging.

package/dist/auth.js

@@ -4,7 +4,7 @@ import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import path from "path";
 import { getSecrets } from "./secrets.js";
-import { getCloudEndpoints, getDefaultClientId } from "./cloud-config.js";
+import { getCloudEndpoints, getDefaultClientId, getGraphBaseUrl } from "./cloud-config.js";
 import {
   dedupeRefreshTokens
 } from "./lib/cache-dedupe.js";
@@ -910,8 +910,7 @@ class AuthManager {
       logger.info("Token retrieved successfully, testing Graph API access...");
       try {
         const secrets = await getSecrets();
-        const cloudEndpoints = getCloudEndpoints(secrets.cloudType);
-        const response = await fetch(`${cloudEndpoints.graphApi}/v1.0/me`, {
+        const response = await fetch(`${getGraphBaseUrl(secrets.cloudType)}/v1.0/me`, {
           headers: {
             Authorization: `Bearer ${token}`
           }

package/dist/cloud-config.js

@@ -17,6 +17,23 @@ const DEFAULT_CLIENT_IDS = {
 function getDefaultClientId(cloudType = "global") {
   return DEFAULT_CLIENT_IDS[cloudType];
 }
+const GRAPH_BASE_URL_ENV = "MS365_MCP_GRAPH_BASE_URL";
+function getGraphBaseUrlOverride() {
+  const raw = process.env[GRAPH_BASE_URL_ENV]?.trim();
+  if (!raw) return void 0;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    parsed = void 0;
+  }
+  if (!parsed || !/^https?:$/.test(parsed.protocol) || parsed.search || parsed.hash) {
+    throw new Error(
+      `${GRAPH_BASE_URL_ENV} must be an absolute http(s) URL without query or fragment, got: ${raw}`
+    );
+  }
+  return raw.replace(/\/+$/, "");
+}
 function getCloudEndpoints(cloudType = "global") {
   const endpoints = CLOUD_ENDPOINTS[cloudType];
   if (!endpoints) {
@@ -26,6 +43,9 @@ function getCloudEndpoints(cloudType = "global") {
   }
   return endpoints;
 }
+function getGraphBaseUrl(cloudType = "global") {
+  return getGraphBaseUrlOverride() ?? getCloudEndpoints(cloudType).graphApi;
+}
 function isValidCloudType(value) {
   return value in CLOUD_ENDPOINTS;
 }
@@ -44,6 +64,7 @@ export {
   DEFAULT_CLIENT_IDS,
   getCloudEndpoints,
   getDefaultClientId,
+  getGraphBaseUrl,
   isValidCloudType,
   parseCloudType
 };

package/dist/graph-client.js

@@ -1,6 +1,6 @@
 import logger from "./logger.js";
 import { encode as toonEncode } from "@toon-format/toon";
-import { getCloudEndpoints } from "./cloud-config.js";
+import { getGraphBaseUrl } from "./cloud-config.js";
 import { getRequestTokens } from "./request-context.js";
 import {
   fetchWithResilience,
@@ -293,9 +293,8 @@ class GraphClient {
     );
   }
   async performRequest(endpoint, accessToken, options) {
-    const cloudEndpoints = getCloudEndpoints(this.secrets.cloudType);
     const apiVersion = options.apiVersion || "v1.0";
-    const url = `${cloudEndpoints.graphApi}/${apiVersion}${endpoint}`;
+    const url = `${getGraphBaseUrl(this.secrets.cloudType)}/${apiVersion}${endpoint}`;
     logger.info(`[GRAPH CLIENT] Final URL being sent to Microsoft: ${url}`);
     const method = options.method || "GET";
     const signedBody = applyMessageSignoffToRequest(method, endpoint, options.body);

package/dist/graph-tools.js

@@ -1361,7 +1361,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
               /%3D/g,
               "="
             );
-            path2 = path2.replace(`{${paramName}}`, encodedValue).replace(`:${paramName}`, encodedValue).replace(`{${camelCaseParamName}}`, encodedValue).replace(`:${camelCaseParamName}`, encodedValue);
+            path2 = path2.replace(`{${paramName}}`, () => encodedValue).replace(`:${paramName}`, () => encodedValue).replace(`{${camelCaseParamName}}`, () => encodedValue).replace(`:${camelCaseParamName}`, () => encodedValue);
             break;
           }
           case "Query":
@@ -1401,7 +1401,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
         const encodedValue = encodeURIComponent(
           escapeIfStringLiteral(tool.path, [paramName, camelCaseParamName], paramValue)
         ).replace(/%3D/g, "=");
-        path2 = path2.replace(`{${paramName}}`, encodedValue).replace(`:${paramName}`, encodedValue).replace(`{${camelCaseParamName}}`, encodedValue).replace(`:${camelCaseParamName}`, encodedValue);
+        path2 = path2.replace(`{${paramName}}`, () => encodedValue).replace(`:${paramName}`, () => encodedValue).replace(`{${camelCaseParamName}}`, () => encodedValue).replace(`:${camelCaseParamName}`, () => encodedValue);
         logger.info(`Path param fallback: replaced :${camelCaseParamName} with encoded value`);
       } else if (paramName.toLowerCase() === "accept" && config?.acceptType) {
         headers["Accept"] = `${paramValue}`;

package/dist/oauth-provider.js

@@ -1,6 +1,6 @@
 import { ProxyOAuthServerProvider } from "@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js";
 import logger from "./logger.js";
-import { getCloudEndpoints } from "./cloud-config.js";
+import { getCloudEndpoints, getGraphBaseUrl } from "./cloud-config.js";
 class MicrosoftOAuthProvider extends ProxyOAuthServerProvider {
   constructor(authManager, secrets) {
     const tenantId = secrets.tenantId || "common";
@@ -14,7 +14,7 @@ class MicrosoftOAuthProvider extends ProxyOAuthServerProvider {
       },
       verifyAccessToken: async (token) => {
         try {
-          const response = await fetch(`${cloudEndpoints.graphApi}/v1.0/me`, {
+          const response = await fetch(`${getGraphBaseUrl(secrets.cloudType)}/v1.0/me`, {
             headers: {
               Authorization: `Bearer ${token}`
             }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.158.1",
+  "version": "0.159.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",