@softeria/ms-365-mcp-server 0.161.4 → 0.163.0

package/README.md

@@ -809,16 +809,21 @@ is refused with the same 404 as any other bad ticket.
 
 ```
 MS365_MCP_ATTACHMENT_URL_BASE=http://m365-mcp:3000   # required
-MS365_MCP_ATTACHMENT_URL_KEY=...                     # required (or _KEY_FILE=/path)
-MS365_MCP_ATTACHMENT_URL_KEY_ID=1                    # optional, default 1
+MS365_MCP_ATTACHMENT_URL_KEY=...                     # optional (or _KEY_FILE=/path), see below
+MS365_MCP_ATTACHMENT_URL_KEY_ID=1                    # optional, default 1; needs a key
 MS365_MCP_ATTACHMENT_URL_TTL_S=120                   # optional, default 120, max 300
 ```
 
 `MS365_MCP_ATTACHMENT_URL_BASE` is deliberately **not** `MS365_MCP_PUBLIC_URL`: that one is
 browser-facing, for OAuth redirects, while this is fetched server-to-server and is
 commonly a container address. A missing or malformed setting fails at startup rather than
-per-request — a signing feature that comes up without a key would mint URLs nothing can
-verify, silently.
+per-request.
+
+The signing key is optional. Without one, minted URLs are just `/attachment?t=<ticket>` and
+any HTTP client can fetch them; the ticket alone authorises redemption. Set a key only if
+the fetcher verifies the `dgk`/`dgx`/`dgs` signature (see below), such as a docglean-mcp
+sidecar, which will refuse an unsigned URL. Setting `_KEY_ID` without a key, or a `_KEY_FILE` that is
+empty or unreadable, fails at startup.
 
 ### Splitting the attachment listener
 
@@ -904,9 +909,10 @@ directly.
 `--attachment-host` takes a bare IPv4 address, IPv6 address (bracketed `[::1]` or bare
 `::1`) or hostname. It is refused rather than coerced — `--attachment-host 10.0.0.5:3001`
 is an error naming `--attachment-port`, not a bind to something else. Note that
-`MS365_MCP_ATTACHMENT_URL_BASE` still must not be an IPv6 literal (the URL signature covers
-the host and the two implementations normalise IPv6 differently); if you bind the listener
-to an IPv6 address, name it in the base by hostname.
+with a signing key set, `MS365_MCP_ATTACHMENT_URL_BASE` must not be an IPv6 literal (the URL
+signature covers the host and the two implementations normalise IPv6 differently); if you
+bind the listener to an IPv6 address, name it in the base by hostname. Without a key there
+is no such restriction.
 
 Point `MS365_MCP_ATTACHMENT_URL_BASE` at the attachment port. The server cannot check this
 for you: the base is usually a container name on a network this process cannot resolve, so
@@ -915,7 +921,7 @@ base and the bound port are logged at startup, one line apart, for exactly that
 
 ### The signature, and who checks what
 
-`dgk`/`dgx`/`dgs` are **not** checked by this server on redemption, and that is deliberate.
+This server never checks `dgk`/`dgx`/`dgs` on redemption, and that is deliberate.
 They exist for the fetcher: a document-conversion sidecar that refuses to dial a private
 address unless the URL carries a valid HMAC from an origin it has been configured to trust.
 What authorises redemption _here_ is the ticket. Verifying the signature on the way back in

package/dist/cli.js

@@ -29,7 +29,7 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
   "Enable login/logout tools when using HTTP mode (disabled by default in HTTP mode)"
 ).option(
   "--enable-attachment-urls",
-  "HTTP mode only. Let get-download-url mint a short-TTL, single-use URL served by this server for Graph byte resources that expose no pre-authenticated URL of their own (mail and event attachments, meeting recordings, other $value endpoints). Also adds get-download-url to any --preset that lacks it (except teams-write). Requires MS365_MCP_ATTACHMENT_URL_BASE and MS365_MCP_ATTACHMENT_URL_KEY (or _KEY_FILE)"
+  "HTTP mode only. Let get-download-url mint a short-TTL, single-use URL served by this server for Graph byte resources that expose no pre-authenticated URL of their own (mail and event attachments, meeting recordings, other $value endpoints). Also adds get-download-url to any --preset that lacks it (except teams-write). Requires MS365_MCP_ATTACHMENT_URL_BASE; MS365_MCP_ATTACHMENT_URL_KEY (or _KEY_FILE) is optional and adds an HMAC signature for fetchers that verify one"
 ).option(
   "--attachment-port <port>",
   "HTTP mode only. Serve the attachment download route on its own listener on this port instead of on the MCP app, so a caller that can fetch attachments cannot also reach /mcp. Requires --enable-attachment-urls, and MS365_MCP_ATTACHMENT_URL_BASE must name this port. A separate port only isolates the two surfaces if they also bind separate interfaces \u2014 see --attachment-host. Equivalent env var: MS365_MCP_ATTACHMENT_PORT."

package/dist/endpoints.json

@@ -1322,7 +1322,7 @@
     "toolName": "create-todo-task",
     "presets": ["personal", "tasks"],
     "scopes": ["Tasks.ReadWrite"],
-    "llmTip": "Creates a new task in a Microsoft To Do list. Body: { title: \"...\" }; optional dueDateTime, reminderDateTime, importance, body (notes), recurrence, categories. Requires todoTaskListId from list-todo-task-lists."
+    "llmTip": "Creates a new task in a Microsoft To Do list. Body: { title: \"...\" }; optional dueDateTime, reminderDateTime, importance, body (notes), recurrence, categories, and checklistItems: [{ displayName: \"...\", isChecked: false }] to create the task's steps inline (isChecked is optional). Requires todoTaskListId from list-todo-task-lists. To change steps after the task exists, use the *-todo-checklist-item tools."
   },
   {
     "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}",
@@ -1330,7 +1330,7 @@
     "toolName": "update-todo-task",
     "presets": ["personal", "tasks"],
     "scopes": ["Tasks.ReadWrite"],
-    "llmTip": "Updates a Microsoft To Do task. Use this to mark a to-do item complete or done (body: { status: \"completed\" }), reopen it (status: \"notStarted\"), rename it (title), or change its due date (dueDateTime), reminder (reminderDateTime), importance, or notes (body). Requires todoTaskListId from list-todo-task-lists and todoTaskId from list-todo-tasks."
+    "llmTip": "Updates a Microsoft To Do task. Use this to mark a to-do item complete or done (body: { status: \"completed\" }), reopen it (status: \"notStarted\"), rename it (title), or change its due date (dueDateTime), reminder (reminderDateTime), importance, or notes (body). Requires todoTaskListId from list-todo-task-lists and todoTaskId from list-todo-tasks. Steps (checklistItems) can't be changed here: Graph rejects checklistItems in a PATCH on the task with 400. Use create-todo-checklist-item, update-todo-checklist-item, or delete-todo-checklist-item instead."
   },
   {
     "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}",
@@ -1363,6 +1363,38 @@
     "scopes": ["Tasks.ReadWrite"],
     "llmTip": "Removes a linked resource from a To Do task."
   },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems",
+    "method": "get",
+    "toolName": "list-todo-checklist-items",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.Read"],
+    "llmTip": "Lists the steps (checklist items) of a To Do task. Each item has id, displayName, isChecked, checkedDateTime, and createdDateTime. Graph supports no OData query parameters on this endpoint, so do not pass select, filter, orderby, or top. Requires todoTaskListId from list-todo-task-lists and todoTaskId from list-todo-tasks."
+  },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems",
+    "method": "post",
+    "toolName": "create-todo-checklist-item",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.ReadWrite"],
+    "llmTip": "Adds a step (checklist item) to an existing To Do task. Body: { displayName: \"...\" }; optional isChecked (defaults to false). Returns the new item with its id. To add steps while creating a task, pass checklistItems in the create-todo-task body instead."
+  },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems/{checklistItem-id}",
+    "method": "patch",
+    "toolName": "update-todo-checklist-item",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.ReadWrite"],
+    "llmTip": "Updates a step (checklist item) of a To Do task. Use this to check a step off (body: { isChecked: true }), uncheck it (isChecked: false), or rename it (displayName). Requires checklistItemId from list-todo-checklist-items."
+  },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems/{checklistItem-id}",
+    "method": "delete",
+    "toolName": "delete-todo-checklist-item",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.ReadWrite"],
+    "llmTip": "Deletes a step (checklist item) from a To Do task. This cannot be undone. Requires checklistItemId from list-todo-checklist-items."
+  },
   {
     "pathPattern": "/me/planner/tasks",
     "method": "get",

package/dist/generated/client.js

@@ -4148,6 +4148,11 @@ const microsoft_graph_todoTaskCollectionResponse = z.object({
   "@odata.nextLink": z.string().nullable(),
   value: z.array(microsoft_graph_todoTask)
 }).partial().passthrough();
+const microsoft_graph_checklistItemCollectionResponse = z.object({
+  "@odata.count": z.number().int().nullable(),
+  "@odata.nextLink": z.string().nullable(),
+  value: z.array(microsoft_graph_checklistItem)
+}).partial().passthrough();
 const microsoft_graph_linkedResourceCollectionResponse = z.object({
   "@odata.count": z.number().int().nullable(),
   "@odata.nextLink": z.string().nullable(),
@@ -5295,6 +5300,7 @@ const schemas = {
   microsoft_graph_todoTaskList,
   microsoft_graph_todoTaskListCollectionResponse,
   microsoft_graph_todoTaskCollectionResponse,
+  microsoft_graph_checklistItemCollectionResponse,
   microsoft_graph_linkedResourceCollectionResponse,
   microsoft_graph_checkInMethod,
   microsoft_graph_checkInClaim,
@@ -12347,6 +12353,103 @@ Currently, a user can be associated with a team in two different ways:`,
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/me/todo/lists/:todoTaskListId/tasks/:todoTaskId/checklistItems",
+    alias: "list-todo-checklist-items",
+    description: `Get the checklistItem resources associated to a todoTask from the checklistItems navigation property.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "post",
+    path: "/me/todo/lists/:todoTaskListId/tasks/:todoTaskId/checklistItems",
+    alias: "create-todo-checklist-item",
+    description: `Create a new checklistItem object.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property`,
+        type: "Body",
+        schema: microsoft_graph_checklistItem
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "patch",
+    path: "/me/todo/lists/:todoTaskListId/tasks/:todoTaskId/checklistItems/:checklistItemId",
+    alias: "update-todo-checklist-item",
+    description: `Update the properties of a checklistItem object.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property values`,
+        type: "Body",
+        schema: microsoft_graph_checklistItem
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "delete",
+    path: "/me/todo/lists/:todoTaskListId/tasks/:todoTaskId/checklistItems/:checklistItemId",
+    alias: "delete-todo-checklist-item",
+    description: `Delete a checklistItem object.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "If-Match",
+        type: "Header",
+        schema: z.string().describe("ETag").optional()
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/me/todo/lists/:todoTaskListId/tasks/:todoTaskId/linkedResources",

package/dist/lib/attachment-tickets.js

@@ -5,6 +5,7 @@ const TICKET_PARAM = "t";
 function buildAttachmentUrl(config, ticketId, nowMs = Date.now()) {
   const url = new URL(ATTACHMENT_ROUTE, config.base);
   url.searchParams.set(TICKET_PARAM, ticketId);
+  if (!config.key) return url.toString();
   return signUrl(
     url.toString(),
     { key: config.key, keyId: config.keyId, ttlSeconds: config.ttlSeconds },

package/dist/lib/attachment-url-config.js

@@ -19,13 +19,20 @@ function pythonStrip(value) {
 function readKey(env) {
   const keyFile = env.MS365_MCP_ATTACHMENT_URL_KEY_FILE;
   if (keyFile) {
+    let key;
     try {
-      return pythonStrip(readFileSync(keyFile, "utf8"));
+      key = pythonStrip(readFileSync(keyFile, "utf8"));
     } catch {
       throw new AttachmentUrlConfigError(
         `MS365_MCP_ATTACHMENT_URL_KEY_FILE could not be read: ${keyFile}`
       );
     }
+    if (!key) {
+      throw new AttachmentUrlConfigError(
+        `MS365_MCP_ATTACHMENT_URL_KEY_FILE is empty: ${keyFile}. Unset it to mint unsigned URLs.`
+      );
+    }
+    return key;
   }
   return env.MS365_MCP_ATTACHMENT_URL_KEY ?? "";
 }
@@ -50,20 +57,26 @@ function loadAttachmentUrlConfig(enabled, env = process.env) {
       `MS365_MCP_ATTACHMENT_URL_BASE must be http or https, got ${parsedBase.protocol}`
     );
   }
-  if (parsedBase.hostname.startsWith("[")) {
-    throw new AttachmentUrlConfigError(
-      `MS365_MCP_ATTACHMENT_URL_BASE must not be an IPv6 literal: the URL signature covers the host, and this runtime and the verifying sidecar normalise IPv6 spellings differently, so every minted URL would be refused. Use a hostname (a container or service name) instead of ${parsedBase.hostname}.`
-    );
-  }
   if (parsedBase.search || parsedBase.hash) {
     throw new AttachmentUrlConfigError(
       "MS365_MCP_ATTACHMENT_URL_BASE must not carry a query string or fragment."
     );
   }
   const key = readKey(env);
-  if (!key) {
+  if (key && !key.trim()) {
+    throw new AttachmentUrlConfigError(
+      "MS365_MCP_ATTACHMENT_URL_KEY is whitespace only. Set a real key, or unset it to mint unsigned URLs."
+    );
+  }
+  if (key) {
+    if (parsedBase.hostname.startsWith("[")) {
+      throw new AttachmentUrlConfigError(
+        `MS365_MCP_ATTACHMENT_URL_BASE must not be an IPv6 literal: the URL signature covers the host, and this runtime and the verifying sidecar normalise IPv6 spellings differently, so every minted URL would be refused. Use a hostname (a container or service name) instead of ${parsedBase.hostname}.`
+      );
+    }
+  } else if (env.MS365_MCP_ATTACHMENT_URL_KEY_ID) {
     throw new AttachmentUrlConfigError(
-      "--enable-attachment-urls requires MS365_MCP_ATTACHMENT_URL_KEY or MS365_MCP_ATTACHMENT_URL_KEY_FILE -- the HMAC key shared with the sidecar that will verify the minted URL."
+      "MS365_MCP_ATTACHMENT_URL_KEY_ID is set but no signing key is: set MS365_MCP_ATTACHMENT_URL_KEY or MS365_MCP_ATTACHMENT_URL_KEY_FILE, or unset the key id."
     );
   }
   for (let index = 0; index < key.length; index += 1) {
@@ -92,7 +105,7 @@ function loadAttachmentUrlConfig(enabled, env = process.env) {
   }
   return {
     base: parsedBase.origin,
-    key,
+    key: key || void 0,
     keyId,
     ttlSeconds
   };

package/dist/server.js

@@ -730,7 +730,7 @@ class MicrosoftGraphServer {
         attachmentApp.get(ATTACHMENT_ROUTE, createAttachmentHandler(attachmentDeps));
         attachmentApp.put(ATTACHMENT_ROUTE, createAttachmentUploadHandler(attachmentDeps));
         logger.info(
-          `  - Attachment URLs: ${attachmentConfig.base}${ATTACHMENT_ROUTE} (ttl ${attachmentConfig.ttlSeconds}s, key id ${attachmentConfig.keyId})`
+          `  - Attachment URLs: ${attachmentConfig.base}${ATTACHMENT_ROUTE} (ttl ${attachmentConfig.ttlSeconds}s, ${attachmentConfig.key ? `signed, key id ${attachmentConfig.keyId}` : "unsigned"})`
         );
         if (dedicated) {
           logger.info(

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.161.4",
+  "version": "0.163.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -1322,7 +1322,7 @@
     "toolName": "create-todo-task",
     "presets": ["personal", "tasks"],
     "scopes": ["Tasks.ReadWrite"],
-    "llmTip": "Creates a new task in a Microsoft To Do list. Body: { title: \"...\" }; optional dueDateTime, reminderDateTime, importance, body (notes), recurrence, categories. Requires todoTaskListId from list-todo-task-lists."
+    "llmTip": "Creates a new task in a Microsoft To Do list. Body: { title: \"...\" }; optional dueDateTime, reminderDateTime, importance, body (notes), recurrence, categories, and checklistItems: [{ displayName: \"...\", isChecked: false }] to create the task's steps inline (isChecked is optional). Requires todoTaskListId from list-todo-task-lists. To change steps after the task exists, use the *-todo-checklist-item tools."
   },
   {
     "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}",
@@ -1330,7 +1330,7 @@
     "toolName": "update-todo-task",
     "presets": ["personal", "tasks"],
     "scopes": ["Tasks.ReadWrite"],
-    "llmTip": "Updates a Microsoft To Do task. Use this to mark a to-do item complete or done (body: { status: \"completed\" }), reopen it (status: \"notStarted\"), rename it (title), or change its due date (dueDateTime), reminder (reminderDateTime), importance, or notes (body). Requires todoTaskListId from list-todo-task-lists and todoTaskId from list-todo-tasks."
+    "llmTip": "Updates a Microsoft To Do task. Use this to mark a to-do item complete or done (body: { status: \"completed\" }), reopen it (status: \"notStarted\"), rename it (title), or change its due date (dueDateTime), reminder (reminderDateTime), importance, or notes (body). Requires todoTaskListId from list-todo-task-lists and todoTaskId from list-todo-tasks. Steps (checklistItems) can't be changed here: Graph rejects checklistItems in a PATCH on the task with 400. Use create-todo-checklist-item, update-todo-checklist-item, or delete-todo-checklist-item instead."
   },
   {
     "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}",
@@ -1363,6 +1363,38 @@
     "scopes": ["Tasks.ReadWrite"],
     "llmTip": "Removes a linked resource from a To Do task."
   },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems",
+    "method": "get",
+    "toolName": "list-todo-checklist-items",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.Read"],
+    "llmTip": "Lists the steps (checklist items) of a To Do task. Each item has id, displayName, isChecked, checkedDateTime, and createdDateTime. Graph supports no OData query parameters on this endpoint, so do not pass select, filter, orderby, or top. Requires todoTaskListId from list-todo-task-lists and todoTaskId from list-todo-tasks."
+  },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems",
+    "method": "post",
+    "toolName": "create-todo-checklist-item",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.ReadWrite"],
+    "llmTip": "Adds a step (checklist item) to an existing To Do task. Body: { displayName: \"...\" }; optional isChecked (defaults to false). Returns the new item with its id. To add steps while creating a task, pass checklistItems in the create-todo-task body instead."
+  },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems/{checklistItem-id}",
+    "method": "patch",
+    "toolName": "update-todo-checklist-item",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.ReadWrite"],
+    "llmTip": "Updates a step (checklist item) of a To Do task. Use this to check a step off (body: { isChecked: true }), uncheck it (isChecked: false), or rename it (displayName). Requires checklistItemId from list-todo-checklist-items."
+  },
+  {
+    "pathPattern": "/me/todo/lists/{todoTaskList-id}/tasks/{todoTask-id}/checklistItems/{checklistItem-id}",
+    "method": "delete",
+    "toolName": "delete-todo-checklist-item",
+    "presets": ["personal", "tasks"],
+    "scopes": ["Tasks.ReadWrite"],
+    "llmTip": "Deletes a step (checklist item) from a To Do task. This cannot be undone. Requires checklistItemId from list-todo-checklist-items."
+  },
   {
     "pathPattern": "/me/planner/tasks",
     "method": "get",