@softeria/ms-365-mcp-server 0.164.0 → 0.165.0

package/README.md

@@ -715,6 +715,8 @@ When running as an MCP server, the following options can be used:
 --preset <names>  Use preset tool categories (comma-separated). See "Tool Presets" section above
 --list-presets    List all available presets and exit
 --toon            (experimental) Enable TOON output format for 30-60% token reduction
+--blob-output     File download tools answer an MCP EmbeddedResource with the file instead of
+                  base64 JSON in a text block (see MS365_MCP_BLOB_OUTPUT below)
 --discovery       Dynamic tool discovery: loads tools on demand to reduce initial token usage (see "Dynamic Tool Discovery" above)
 --public-url <url> Public base URL for OAuth when behind a reverse proxy (see Open WebUI section and docs/deployment.md)
 ```
@@ -730,6 +732,8 @@ Environment variables:
 - `MS365_MCP_MAX_PAGES=<n>`: Maximum number of pages followed when a tool is called with `fetchAllPages: true` (positive integer, default `100`). Bounds memory and latency for large result sets.
 - `MS365_MCP_MAX_ITEMS=<n>`: Maximum number of items accumulated when `fetchAllPages: true` (positive integer, default `10000`). Pagination stops and the response is truncated once this many items are collected.
 - `MS365_MCP_ALLOW_PAGINATION=0|false|no`: Disable multi-page following entirely. When set, the `fetchAllPages` parameter is not advertised on tools, and any request that still passes it returns only the first page (default: pagination enabled).
+- `MS365_MCP_BLOB_OUTPUT=true|1`: File download tools (`download-bytes`, `get-mail-message-mime`, `get-shared-mailbox-message-mime`, `get-mail-attachment-content`, `get-shared-mailbox-attachment-content`) answer a short JSON text block (`name`, `contentType`, `size`) and an MCP `EmbeddedResource` with `BlobResourceContents` (`uri`, `mimeType`, `blob`) instead of base64 JSON in text. The `uri`'s last segment is the optional `fileName` argument. Default: off. Alternative to the --blob-output flag.
+- `MS365_MCP_BLOB_MAX_BYTES=<n>`: With blob output on, the largest file a download tool reads (positive integer, default `5242880`). The server stops reading past it and answers an error naming the limit.
 - `MS365_MCP_BODY_FORMAT=html`: Return email bodies as HTML instead of plain text (default: text)
 - `MS365_MCP_MESSAGE_SIGNOFF_PREFIX=<text>`: Signoff prepended to outgoing messages so recipients can tell they were agent-sent, e.g. `🤖`. Default: none. CLI equivalent: `--message-signoff-prefix <text>` (see Message Signoff below)
 - `MS365_MCP_MESSAGE_SIGNOFF_SUFFIX=<text>`: Signoff appended to outgoing messages. Default: none. CLI equivalent: `--message-signoff-suffix <text>`. `--no-message-signoff` disables both (see Message Signoff below)

package/dist/__tests__/blob-output.test.js

@@ -0,0 +1,106 @@
+import http from "http";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import GraphClient from "../graph-client.js";
+import { fetchWithResilience, loadResilienceConfig } from "../lib/graph-resilience.js";
+vi.mock("../logger.js", () => ({
+  default: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() }
+}));
+vi.mock("../lib/graph-resilience.js", async (importOriginal) => ({
+  ...await importOriginal(),
+  fetchWithResilience: vi.fn()
+}));
+const fetchMock = vi.mocked(fetchWithResilience);
+const client = () => new GraphClient({ getToken: vi.fn().mockResolvedValue("token") }, {
+  clientId: "c",
+  tenantId: "t",
+  cloudType: "global"
+});
+const pdf = Buffer.from("%PDF-1.4 test bytes \0
\xFF", "latin1");
+const opts = { forceBinary: true, maxBytes: 1024, blobOutput: { fileName: "a b.pdf" } };
+describe("blob output", () => {
+  beforeEach(() => vi.clearAllMocks());
+  it("answers a text block and an EmbeddedResource with the exact bytes", async () => {
+    fetchMock.mockResolvedValue(
+      new Response(pdf, { status: 200, headers: { "content-type": "application/pdf" } })
+    );
+    const res = await client().graphRequest("/me/messages/m/attachments/a/$value", opts);
+    expect(JSON.parse(res.content[0].text)).toEqual({
+      name: "a b.pdf",
+      contentType: "application/pdf",
+      size: pdf.length
+    });
+    const item = res.content[1];
+    expect(item.type).toBe("resource");
+    expect(item.resource.uri).toBe("file:///a%20b.pdf");
+    expect(item.resource.mimeType).toBe("application/pdf");
+    expect(Buffer.from(item.resource.blob, "base64").equals(pdf)).toBe(true);
+  });
+  it("keeps the old base64 JSON when blob output is not asked for", async () => {
+    fetchMock.mockResolvedValue(
+      new Response(pdf, { headers: { "content-type": "application/pdf" } })
+    );
+    const res = await client().graphRequest("/x/$value", { forceBinary: true });
+    expect(res.content).toHaveLength(1);
+    expect(JSON.parse(res.content[0].text).contentBytes).toBe(pdf.toString("base64"));
+  });
+  it("refuses a body over the cap by Content-Length without reading it", async () => {
+    fetchMock.mockResolvedValue(
+      new Response(Buffer.alloc(2048), { headers: { "content-length": "2048" } })
+    );
+    const res = await client().graphRequest("/x/$value", opts);
+    expect(res.isError).toBe(true);
+    expect(res.content[0].text).toContain("download limit of 1024 bytes");
+  });
+  it("stops reading a body over the cap when no length is declared", async () => {
+    let pulled = 0;
+    const body = new ReadableStream({
+      pull(controller) {
+        pulled += 512;
+        controller.enqueue(new Uint8Array(512));
+        if (pulled >= 1024 * 1024) controller.close();
+      }
+    });
+    fetchMock.mockResolvedValue(new Response(body));
+    const res = await client().graphRequest("/x/$value", opts);
+    expect(res.isError).toBe(true);
+    expect(res.content[0].text).toContain("download limit of 1024 bytes");
+    expect(pulled).toBeLessThan(16 * 1024);
+  });
+  it("accepts a body exactly at the cap", async () => {
+    fetchMock.mockResolvedValue(new Response(Buffer.alloc(1024)));
+    const res = await client().graphRequest("/x/$value", opts);
+    expect(res.isError).toBeUndefined();
+    expect(JSON.parse(res.content[0].text).size).toBe(1024);
+  });
+});
+describe("redirects that leave the Graph origin", () => {
+  const servers = [];
+  const listen = (h) => new Promise((resolve) => {
+    const s = http.createServer(h).listen(0, "127.0.0.1", () => {
+      servers.push(s);
+      resolve(`http://127.0.0.1:${s.address().port}`);
+    });
+  });
+  afterEach(() => servers.splice(0).forEach((s) => s.close()));
+  it("arrive without the Authorization header", async () => {
+    const real = await vi.importActual(
+      "../lib/graph-resilience.js"
+    );
+    let seen = "unset";
+    const other = await listen((req, res2) => {
+      seen = req.headers.authorization;
+      res2.end("bytes");
+    });
+    const graph = await listen((_req, res2) => {
+      res2.writeHead(302, { location: `${other}/file` }).end();
+    });
+    const res = await real.fetchWithResilience(
+      `${graph}/v1.0/x`,
+      { headers: { Authorization: "Bearer secret" } },
+      loadResilienceConfig(),
+      real.getSharedBreaker()
+    );
+    expect(await res.text()).toBe("bytes");
+    expect(seen).toBeUndefined();
+  });
+});

package/dist/__tests__/graph-tools.test.js

@@ -2256,6 +2256,28 @@ describe("graph-tools", () => {
       expect(options.accessToken).toBeUndefined();
       expect(options.forceBinary).toBe(true);
       expect(options.rawResponse).toBe(true);
+      expect(options.blobOutput).toBeUndefined();
+      expect(options.maxBytes).toBeUndefined();
+    });
+    it("asks for a capped blob resource when blob output is on", async () => {
+      mockEndpoints.length = 0;
+      mockEndpointsJson = [];
+      process.env.MS365_MCP_BLOB_OUTPUT = "true";
+      process.env.MS365_MCP_BLOB_MAX_BYTES = "1234";
+      try {
+        const graphClient = { graphRequest: vi.fn().mockResolvedValue({ content: [] }) };
+        const server = createMockServer();
+        const { registerGraphTools } = await loadModule();
+        registerGraphTools(server, graphClient);
+        await server.tools.get("download-bytes").handler({ target: "/me/messages/m1/attachments/a1/$value", fileName: "drawing.pdf" });
+        const [, options] = graphClient.graphRequest.mock.calls[0];
+        expect(options.forceBinary).toBe(true);
+        expect(options.maxBytes).toBe(1234);
+        expect(options.blobOutput).toEqual({ fileName: "drawing.pdf" });
+      } finally {
+        delete process.env.MS365_MCP_BLOB_OUTPUT;
+        delete process.env.MS365_MCP_BLOB_MAX_BYTES;
+      }
     });
     it("rejects absolute URLs (Graph paths only)", async () => {
       mockEndpoints.length = 0;

package/dist/cli.js

@@ -76,6 +76,9 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 ).option(
   "--http-local-file-tools",
   "In HTTP mode, also register the local file tools: download-bytes-to-file, which writes files on the server as the server's user, and upload-attachment-from-file, which reads files from the MS365_MCP_UPLOAD_DIRS directories when that is set. Anyone who can reach the port can use them, so enable only on a single-user machine. Refused unless --http binds a loopback host with no --public-url and no --trust-proxy-auth."
+).option(
+  "--blob-output",
+  "File download tools (get-mail-message-mime, get-shared-mailbox-message-mime, get-mail-attachment-content, get-shared-mailbox-attachment-content) answer an MCP EmbeddedResource with the file instead of base64 JSON in a text block. Off by default."
 ).option(
   "--allow-unauthenticated-discovery",
   "In HTTP mode, allow MCP discovery requests (initialize, tools/list, prompts/list, resources/list, ping) without a bearer token, so a gateway can enumerate the tool catalog before any user has authenticated. Non-discovery requests (e.g. tools/call) still require a token. Off by default."
@@ -98,6 +101,9 @@ function parseArgs() {
     process.env.MS365_MCP_MESSAGE_SIGNOFF_SUFFIX = "";
     process.env.MS365_MCP_MESSAGE_SIGNOFF_PREFIX = "";
   }
+  if (options.blobOutput) {
+    process.env.MS365_MCP_BLOB_OUTPUT = "true";
+  }
   assertSignoffMarkersVisible();
   assertUploadDirsAbsolute();
   if (options.listPresets) {

package/dist/endpoints.json

@@ -949,8 +949,40 @@
     "presets": ["mail", "outlook", "personal"],
     "scopes": ["Mail.Read"],
     "acceptType": "text/plain",
+    "blobOutput": true,
     "llmTip": "Download an email message as raw RFC 5322 MIME content (.eml format). Use this when archiving an email to disk preserving all original headers, body, and inline-encoded attachments. Returns the MIME stream as text. Find the message id with list-mail-messages first."
   },
+  {
+    "pathPattern": "/users/{user-id}/messages/{message-id}/$value",
+    "method": "get",
+    "toolName": "get-shared-mailbox-message-mime",
+    "descriptionOverride": "Download the raw MIME source (RFC 5322 .eml content) of a message in another user's mailbox or a shared mailbox, by message ID. The user-id is the mailbox owner's ID or email address, and delegated access to that mailbox is required.",
+    "presets": ["work"],
+    "workScopes": ["Mail.Read.Shared"],
+    "acceptType": "text/plain",
+    "blobOutput": true,
+    "llmTip": "Download a message of a shared mailbox as an .eml. Find the message id with list-shared-mailbox-messages first. With the server's blob output on, the bytes come back as a file resource; pass fileName to name it."
+  },
+  {
+    "pathPattern": "/me/messages/{message-id}/attachments/{attachment-id}/$value",
+    "method": "get",
+    "toolName": "get-mail-attachment-content",
+    "descriptionOverride": "Download the raw bytes of a file attachment of an Outlook message in the signed-in user's mailbox, by message ID and attachment ID.",
+    "presets": ["mail", "outlook", "personal"],
+    "scopes": ["Mail.Read"],
+    "blobOutput": true,
+    "llmTip": "Find the attachment id with list-mail-attachments first. With the server's blob output on, the bytes come back as a file resource; pass fileName (the attachment's name) to name it. Files over the server's download limit are refused with an error naming the limit."
+  },
+  {
+    "pathPattern": "/users/{user-id}/messages/{message-id}/attachments/{attachment-id}/$value",
+    "method": "get",
+    "toolName": "get-shared-mailbox-attachment-content",
+    "descriptionOverride": "Download the raw bytes of a file attachment of a message in another user's mailbox or a shared mailbox, by message ID and attachment ID. The user-id is the mailbox owner's ID or email address, and delegated access to that mailbox is required.",
+    "presets": ["work"],
+    "workScopes": ["Mail.Read.Shared"],
+    "blobOutput": true,
+    "llmTip": "Find the attachment id with list-shared-mailbox-attachments first. With the server's blob output on, the bytes come back as a file resource; pass fileName (the attachment's name) to name it. Files over the server's download limit are refused with an error naming the limit."
+  },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/workbook/worksheets/{workbookWorksheet-id}/range(address='{address}')",
     "method": "patch",

package/dist/generated/client.js

@@ -10618,6 +10618,26 @@ resource.`,
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/me/messages/:messageId/attachments/:attachmentId/$value",
+    alias: "get-mail-attachment-content",
+    description: `Get mail attachment content.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "messageId",
+        type: "Path",
+        schema: z.string().describe("Path parameter: message-id")
+      },
+      {
+        name: "attachmentId",
+        type: "Path",
+        schema: z.string().describe("Path parameter: attachment-id")
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "post",
     path: "/me/messages/:messageId/attachments/createUploadSession",
@@ -15571,6 +15591,14 @@ Only the policyViolation property of a chatMessage can be updated in application
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/users/:userId/messages/:messageId/$value",
+    alias: "get-shared-mailbox-message-mime",
+    description: `The unique identifier for an entity. Read-only.`,
+    requestFormat: "json",
+    response: z.void()
+  },
   {
     method: "get",
     path: "/users/:userId/messages/:messageId/attachments",
@@ -15652,6 +15680,31 @@ Only the policyViolation property of a chatMessage can be updated in application
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/users/:userId/messages/:messageId/attachments/:attachmentId/$value",
+    alias: "get-shared-mailbox-attachment-content",
+    description: `Get shared mailbox attachment content.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "userId",
+        type: "Path",
+        schema: z.string().describe("Path parameter: user-id")
+      },
+      {
+        name: "messageId",
+        type: "Path",
+        schema: z.string().describe("Path parameter: message-id")
+      },
+      {
+        name: "attachmentId",
+        type: "Path",
+        schema: z.string().describe("Path parameter: attachment-id")
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "post",
     path: "/users/:userId/messages/:messageId/createForward",

package/dist/graph-client.js

@@ -97,6 +97,58 @@ function extractBatchMetadata(data) {
     ...Object.keys(errorCodeCounts).length > 0 ? { graph_batch_error_code_counts: errorCodeCounts } : {}
   };
 }
+const DEFAULT_BLOB_MAX_BYTES = 5 * 1024 * 1024;
+function isBlobOutputEnabled() {
+  return /^(1|true)$/i.test(process.env.MS365_MCP_BLOB_OUTPUT ?? "");
+}
+function getBlobMaxBytes() {
+  const n = Number(process.env.MS365_MCP_BLOB_MAX_BYTES);
+  return Number.isInteger(n) && n > 0 ? n : DEFAULT_BLOB_MAX_BYTES;
+}
+async function readBody(response, maxBytes) {
+  if (maxBytes === void 0) return Buffer.from(await response.arrayBuffer());
+  const tooLarge = () => new Error(`The file is larger than the download limit of ${maxBytes} bytes.`);
+  const declared = Number(response.headers?.get?.("content-length"));
+  if (declared > maxBytes) {
+    await response.body?.cancel();
+    throw tooLarge();
+  }
+  const chunks = [];
+  let total = 0;
+  const reader = response.body?.getReader();
+  while (reader) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw tooLarge();
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+}
+function toBlobResponse(data, blob) {
+  const d = data;
+  if (!d || typeof d.contentBytes !== "string") return void 0;
+  const mimeType = d.contentType?.split(";")[0].trim() || "application/octet-stream";
+  const name = blob.fileName?.split("/").join("_").split(String.fromCharCode(92)).join("_") || "download";
+  const size = Buffer.byteLength(d.contentBytes, "base64");
+  return {
+    content: [
+      { type: "text", text: JSON.stringify({ name, contentType: mimeType, size }) },
+      // shortcut: ContentItem is text-only; this is the one non-text item, passed through as is.
+      {
+        type: "resource",
+        resource: {
+          uri: `file:///${encodeURIComponent(name)}`,
+          mimeType,
+          blob: d.contentBytes
+        }
+      }
+    ]
+  };
+}
 class GraphClient {
   constructor(authManager, secrets, outputFormat = "json") {
     this.outputFormat = "json";
@@ -125,7 +177,7 @@ class GraphClient {
       const isBinaryResponse = options.forceBinary === true || isBinaryContentType(contentTypeHeader);
       let metadata = { http_status: response.status };
       let result;
-      const buffer = Buffer.from(await response.arrayBuffer());
+      const buffer = await readBody(response, options.maxBytes);
       metadata = { ...metadata, response_bytes: buffer.byteLength };
       let text;
       if (!isBinaryResponse) {
@@ -343,8 +395,9 @@ class GraphClient {
       );
       const { data, metadata } = await this.makeRequestWithMetadata(endpoint, options);
       const outputFormat = options.forceJsonOutput ? "json" : this.outputFormat;
+      const blobResponse = options.blobOutput && !options.excludeResponse ? toBlobResponse(data, options.blobOutput) : void 0;
       return this.withResponseMetadata(
-        this.formatJsonResponse(data, options.rawResponse, options.excludeResponse, outputFormat),
+        blobResponse ?? this.formatJsonResponse(data, options.rawResponse, options.excludeResponse, outputFormat),
         metadata
       );
     } catch (error) {
@@ -446,7 +499,10 @@ class GraphClient {
 }
 var graph_client_default = GraphClient;
 export {
+  DEFAULT_BLOB_MAX_BYTES,
   GraphApiError,
   graph_client_default as default,
-  isBinaryContentType
+  getBlobMaxBytes,
+  isBinaryContentType,
+  isBlobOutputEnabled
 };

package/dist/graph-tools.js

@@ -14,6 +14,7 @@ import {
 } from "./auth.js";
 import { api as betaApi } from "./generated/client-beta.js";
 import { api } from "./generated/client.js";
+import { getBlobMaxBytes, isBlobOutputEnabled } from "./graph-client.js";
 import { getAttachmentMinting } from "./lib/attachment-minting.js";
 import { MAX_UPLOAD_BYTES, uploadAttachment } from "./lib/attachment-upload.js";
 import { getUploadDirs, openUploadFile } from "./lib/upload-dirs.js";
@@ -856,14 +857,17 @@ const UTILITY_TOOLS = [
     name: "download-bytes",
     method: "GET",
     path: "tool:download-bytes",
-    description: 'Download binary content from Microsoft Graph and return it as base64. Single tool for any binary read: drive file content, mail attachment, profile photo, Teams hosted content, meeting recording. Returns { contentType, encoding: "base64", contentLength, contentBytes }. For large drive/SharePoint file content, prefer get-download-url, which returns a pre-authenticated URL to stream bytes out-of-band instead of base64 through the agent context.',
+    description: `Download binary content from Microsoft Graph and return it as base64. Single tool for any binary read: drive file content, mail attachment, profile photo, Teams hosted content, meeting recording. Returns { contentType, encoding: "base64", contentLength, contentBytes }. For large drive/SharePoint file content, prefer get-download-url, which returns a pre-authenticated URL to stream bytes out-of-band instead of base64 through the agent context. With the server's blob output on, the bytes come back as a file resource instead (capped by the server's download limit); pass fileName to name it.`,
     readOnlyHint: true,
     openWorldHint: true,
     buildSchema: (ctx) => {
       const schema = {
         target: z.string().describe(
           'Relative Microsoft Graph path starting with "/". Common paths: /drives/{drive-id}/items/{driveItem-id}/content (drive file content); /me/messages/{message-id}/attachments/{attachment-id}/$value (mail attachment, list-mail-attachments returns the IDs); /me/photo/$value or /users/{user-id}/photo/$value (profile photo); /chats/{chat-id}/messages/{chatMessage-id}/hostedContents/{chatMessageHostedContent-id}/$value (Teams chat hosted content, list-chat-message-hosted-contents returns the IDs); /teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents/{chatMessageHostedContent-id}/$value (Teams channel hosted content). For meeting recordings, use get-meeting-recording-content where available; Microsoft Graph returns authenticated recording bytes, not a pre-authenticated download URL.'
-        )
+        ),
+        fileName: z.string().describe(
+          "Name of the file, used as the last segment of the returned resource URI when the server runs with blob output. Optional."
+        ).optional()
       };
       if (ctx.multiAccount) {
         schema["account"] = z.string().optional().describe(
@@ -915,10 +919,17 @@ const UTILITY_TOOLS = [
         if (authManager && !authManager.isOAuthModeEnabled() && !getRequestTokens()) {
           accountAccessToken = await authManager.getTokenForAccount(accountParam);
         }
+        const blob = isBlobOutputEnabled() ? {
+          maxBytes: getBlobMaxBytes(),
+          blobOutput: {
+            fileName: typeof params.fileName === "string" ? params.fileName : void 0
+          }
+        } : {};
         return await graphClient.graphRequest(target, {
           accessToken: accountAccessToken,
           rawResponse: true,
-          forceBinary: true
+          forceBinary: true,
+          ...blob
         });
       } catch (error) {
         return {
@@ -1531,6 +1542,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
     );
     const strayBodyFields = {};
     for (const [paramName, paramValue] of Object.entries(params)) {
+      if (paramName === "fileName" && config?.blobOutput) continue;
       if ([
         "account",
         "confirm",
@@ -1772,6 +1784,13 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
       method: tool.method.toUpperCase(),
       headers
     };
+    if (config?.blobOutput && isBlobOutputEnabled()) {
+      options.forceBinary = true;
+      options.maxBytes = getBlobMaxBytes();
+      options.blobOutput = {
+        fileName: typeof params.fileName === "string" ? params.fileName : void 0
+      };
+    }
     if (config?.apiVersion) {
       options.apiVersion = config.apiVersion;
     }
@@ -1964,10 +1983,9 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
       } catch {
       }
     }
-    const content = response.content.map((item) => ({
-      type: "text",
-      text: item.text
-    }));
+    const content = response.content.map(
+      (item) => item.type === "resource" ? item : { type: "text", text: item.text }
+    );
     auditLog({
       event: "tool.call",
       request_id: requestId,
@@ -2098,6 +2116,11 @@ function registerGraphTools(server, graphClient, options = {}) {
     if (endpointConfig?.acceptType && paramSchema["Accept"] === void 0) {
       paramSchema["Accept"] = z.string().describe(getAcceptParamDescription(endpointConfig.acceptType)).optional();
     }
+    if (endpointConfig?.blobOutput && paramSchema["fileName"] === void 0) {
+      paramSchema["fileName"] = z.string().describe(
+        "Name of the file, used as the last segment of the returned resource URI when the server runs with blob output. Optional."
+      ).optional();
+    }
     if (isFetchAllPagesApplicable(tool)) {
       const maxPages = getMaxPages();
       paramSchema["fetchAllPages"] = z.boolean().describe(getFetchAllPagesParamDescription(maxPages, tool.alias)).optional();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -949,8 +949,40 @@
     "presets": ["mail", "outlook", "personal"],
     "scopes": ["Mail.Read"],
     "acceptType": "text/plain",
+    "blobOutput": true,
     "llmTip": "Download an email message as raw RFC 5322 MIME content (.eml format). Use this when archiving an email to disk preserving all original headers, body, and inline-encoded attachments. Returns the MIME stream as text. Find the message id with list-mail-messages first."
   },
+  {
+    "pathPattern": "/users/{user-id}/messages/{message-id}/$value",
+    "method": "get",
+    "toolName": "get-shared-mailbox-message-mime",
+    "descriptionOverride": "Download the raw MIME source (RFC 5322 .eml content) of a message in another user's mailbox or a shared mailbox, by message ID. The user-id is the mailbox owner's ID or email address, and delegated access to that mailbox is required.",
+    "presets": ["work"],
+    "workScopes": ["Mail.Read.Shared"],
+    "acceptType": "text/plain",
+    "blobOutput": true,
+    "llmTip": "Download a message of a shared mailbox as an .eml. Find the message id with list-shared-mailbox-messages first. With the server's blob output on, the bytes come back as a file resource; pass fileName to name it."
+  },
+  {
+    "pathPattern": "/me/messages/{message-id}/attachments/{attachment-id}/$value",
+    "method": "get",
+    "toolName": "get-mail-attachment-content",
+    "descriptionOverride": "Download the raw bytes of a file attachment of an Outlook message in the signed-in user's mailbox, by message ID and attachment ID.",
+    "presets": ["mail", "outlook", "personal"],
+    "scopes": ["Mail.Read"],
+    "blobOutput": true,
+    "llmTip": "Find the attachment id with list-mail-attachments first. With the server's blob output on, the bytes come back as a file resource; pass fileName (the attachment's name) to name it. Files over the server's download limit are refused with an error naming the limit."
+  },
+  {
+    "pathPattern": "/users/{user-id}/messages/{message-id}/attachments/{attachment-id}/$value",
+    "method": "get",
+    "toolName": "get-shared-mailbox-attachment-content",
+    "descriptionOverride": "Download the raw bytes of a file attachment of a message in another user's mailbox or a shared mailbox, by message ID and attachment ID. The user-id is the mailbox owner's ID or email address, and delegated access to that mailbox is required.",
+    "presets": ["work"],
+    "workScopes": ["Mail.Read.Shared"],
+    "blobOutput": true,
+    "llmTip": "Find the attachment id with list-shared-mailbox-attachments first. With the server's blob output on, the bytes come back as a file resource; pass fileName (the attachment's name) to name it. Files over the server's download limit are refused with an error naming the limit."
+  },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/workbook/worksheets/{workbookWorksheet-id}/range(address='{address}')",
     "method": "patch",