@softeria/ms-365-mcp-server 0.166.0 → 0.167.0

package/dist/__tests__/graph-tools.test.js

@@ -4190,4 +4190,148 @@ describe("graph-tools", () => {
       expect(isDestructiveOperation("DELETE", { readOnly: true })).toBe(true);
     });
   });
+  describe("filterMembersByName", () => {
+    const body = {
+      value: [
+        { id: "1", displayName: "Jane Doe", email: "jane@contoso.com" },
+        { id: "2", displayName: "John Smith", email: "jsmith@contoso.com" },
+        { id: "3", displayName: null, email: null }
+      ],
+      "@odata.count": 3
+    };
+    const ids = (r) => r.value.map((m) => m.id);
+    it("matches displayName case-insensitively", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(ids(filterMembersByName(body, "JANE"))).toEqual(["1"]);
+    });
+    it("matches email", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(ids(filterMembersByName(body, "jsmith@"))).toEqual(["2"]);
+    });
+    it("returns an empty value array when nothing matches", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(ids(filterMembersByName(body, "zzz"))).toEqual([]);
+    });
+    it("returns everything for an empty or whitespace-only name", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(ids(filterMembersByName(body, "   "))).toEqual(["1", "2", "3"]);
+    });
+    it("does not match or throw on null fields", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(ids(filterMembersByName(body, "null"))).toEqual([]);
+    });
+    it("keeps other top-level fields", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(filterMembersByName(body, "jane")["@odata.count"]).toBe(3);
+    });
+    it("returns non-collection input unchanged", async () => {
+      const { filterMembersByName } = await loadModule();
+      expect(filterMembersByName("plain", "x")).toBe("plain");
+      expect(filterMembersByName({ id: "1" }, "x")).toEqual({ id: "1" });
+    });
+  });
+  describe("member name filter (tool wiring)", () => {
+    const membersBody = {
+      value: [
+        { id: "1", displayName: "Jane Doe", email: "jane@contoso.com" },
+        { id: "2", displayName: "John Smith", email: "jsmith@contoso.com" },
+        { id: "3", displayName: null, email: null }
+      ],
+      "@odata.count": 3
+    };
+    const page = (b) => ({ content: [{ type: "text", text: JSON.stringify(b) }] });
+    const ids = (result) => JSON.parse(result.content[0].text).value.map((m) => m.id);
+    async function run(args, responses = [page(membersBody)], alias = "list-team-members", path = "/teams/{team-id}/members", outputFormat = "json") {
+      mockEndpoints.push(makeEndpoint({ alias, path }));
+      mockEndpointsJson = [makeConfig({ toolName: alias, pathPattern: path })];
+      const graphClient = createMockGraphClient(responses, outputFormat);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const result = await server.tools.get(alias).handler({ "team-id": "t1", ...args });
+      return { result, graphClient };
+    }
+    it("filters list-team-members by name", async () => {
+      const { result } = await run({ name: "jane" });
+      expect(ids(result)).toEqual(["1"]);
+    });
+    it("filters list-chat-members by email", async () => {
+      const { result } = await run(
+        { "chat-id": "c1", name: "jsmith" },
+        [page(membersBody)],
+        "list-chat-members",
+        "/chats/{chat-id}/members"
+      );
+      expect(ids(result)).toEqual(["2"]);
+    });
+    it("does not send name to Graph", async () => {
+      const { graphClient } = await run({ name: "jane" });
+      expect(graphClient.graphRequest.mock.calls[0][0]).not.toContain("name");
+    });
+    it("returns the full list for a whitespace-only name", async () => {
+      const { result } = await run({ name: "  " });
+      expect(ids(result)).toEqual(["1", "2", "3"]);
+    });
+    it("leaves an error response untouched", async () => {
+      const err = { content: [{ type: "text", text: '{"error":"nope"}' }], isError: true };
+      const { result } = await run({ name: "jane" }, [err]);
+      expect(result.content[0].text).toBe('{"error":"nope"}');
+    });
+    it("keeps @odata.count as the unfiltered total", async () => {
+      const { result } = await run({ name: "jane" });
+      expect(JSON.parse(result.content[0].text)["@odata.count"]).toBe(3);
+    });
+    it("filters after fetchAllPages merges the pages", async () => {
+      const { result } = await run({ name: "ann", fetchAllPages: true }, [
+        page({
+          value: [{ id: "1", displayName: "Ann", email: "a@x.com" }],
+          "@odata.nextLink": "https://graph.microsoft.com/v1.0/teams/t1/members?$skiptoken=x"
+        }),
+        page({
+          value: [
+            { id: "2", displayName: "Bob", email: "b@x.com" },
+            { id: "3", displayName: "Annette", email: "n@x.com" }
+          ]
+        })
+      ]);
+      expect(ids(result)).toEqual(["1", "3"]);
+    });
+    it("matches only fields that survive $select projection", async () => {
+      const { result } = await run({ select: "id,displayName", name: "contoso" });
+      expect(ids(result)).toEqual([]);
+    });
+    describe("under --toon", () => {
+      const parseToon = (result) => JSON.parse(result.content[0].text.replace(/^TOON:/, ""));
+      const toon = (args, responses = [page(membersBody)]) => run(args, responses, "list-team-members", "/teams/{team-id}/members", "toon");
+      it("filters when no projection or merge applies", async () => {
+        const { result } = await toon({ name: "jane" });
+        expect(parseToon(result).value.map((m) => m.id)).toEqual(["1"]);
+      });
+      it("filters when $select projects the body", async () => {
+        const { result } = await toon({ select: "id,displayName", name: "jane" });
+        expect(parseToon(result).value).toEqual([{ id: "1", displayName: "Jane Doe" }]);
+      });
+      it("filters after fetchAllPages merges the pages", async () => {
+        const { result } = await toon({ name: "ann", fetchAllPages: true }, [
+          page({
+            value: [{ id: "1", displayName: "Ann", email: "a@x.com" }],
+            "@odata.nextLink": "https://graph.microsoft.com/v1.0/teams/t1/members?$skiptoken=x"
+          }),
+          page({
+            value: [
+              { id: "2", displayName: "Bob", email: "b@x.com" },
+              { id: "3", displayName: "Annette", email: "n@x.com" }
+            ]
+          })
+        ]);
+        expect(parseToon(result).value.map((m) => m.id)).toEqual(["1", "3"]);
+      });
+    });
+    it("still matches a projected field", async () => {
+      const { result } = await run({ select: "id,displayName", name: "jane" });
+      expect(JSON.parse(result.content[0].text).value).toEqual([
+        { id: "1", displayName: "Jane Doe" }
+      ]);
+    });
+  });
 });

package/dist/endpoints.json

@@ -1737,7 +1737,7 @@
     "toolName": "list-chat-members",
     "presets": ["teams", "work"],
     "workScopes": ["ChatMember.Read"],
-    "llmTip": "Lists members of a chat. Each member has displayName, email, roles (owner/guest), and visibleHistoryStartDateTime. For meeting chats, use the chatInfo.threadId from get-online-meeting as the chat-id to see who participated in the meeting chat."
+    "llmTip": "Lists members of a chat. Each member has displayName, email, roles (owner/guest), and visibleHistoryStartDateTime. For meeting chats, use the chatInfo.threadId from get-online-meeting as the chat-id to see who participated in the meeting chat. Pass name to keep only members whose displayName or email contains that text (case-insensitive); use the returned userId in an @mention."
   },
   {
     "pathPattern": "/chats/{chat-id}/messages",
@@ -1958,7 +1958,8 @@
     "method": "get",
     "toolName": "list-team-members",
     "presets": ["teams", "work"],
-    "workScopes": ["TeamMember.Read.All"]
+    "workScopes": ["TeamMember.Read.All"],
+    "llmTip": "Lists members of a team. Each member has displayName, email, roles and userId. Pass name to keep only members whose displayName or email contains that text (case-insensitive); use the returned userId in an @mention."
   },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/filesFolder",

package/dist/graph-tools.js

@@ -203,6 +203,17 @@ function rewriteMailSearchQuotes(expr) {
   }
   return balanceTrailingSlashes(out.trim());
 }
+const MEMBER_NAME_FILTER_TOOLS = /* @__PURE__ */ new Set(["list-team-members", "list-chat-members"]);
+const MEMBER_NAME_PARAM_DESCRIPTION = "Case-insensitive text to match against each member's displayName and email. Applied after $select projection, so only fields you can see are matched. Without fetchAllPages only the fetched page is filtered, and @odata.count still reports the unfiltered total.";
+function filterMembersByName(parsed, name) {
+  const needle = name.trim().toLowerCase();
+  if (needle === "" || !isPlainObject(parsed) || !Array.isArray(parsed.value)) return parsed;
+  const matches = (member) => isPlainObject(member) && ["displayName", "email"].some((field) => {
+    const value = member[field];
+    return typeof value === "string" && value.toLowerCase().includes(needle);
+  });
+  return { ...parsed, value: parsed.value.filter(matches) };
+}
 function normalizeSearchQueryParam(queryParams, path2, toolAlias) {
   if (!isOutlookMailPath(path2)) return;
   const raw = queryParams["$search"];
@@ -1541,8 +1552,10 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
       parameterDefinitions.find((p) => p.type === "Body")?.schema
     );
     const strayBodyFields = {};
+    const memberNameFilter = MEMBER_NAME_FILTER_TOOLS.has(tool.alias) && typeof params.name === "string" ? params.name : void 0;
     for (const [paramName, paramValue] of Object.entries(params)) {
       if (paramName === "fileName" && config?.blobOutput) continue;
+      if (paramName === "name" && MEMBER_NAME_FILTER_TOOLS.has(tool.alias)) continue;
       if ([
         "account",
         "confirm",
@@ -1848,12 +1861,23 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
     const mergePages = fetchAllPages && paginationEnabled;
     const willProject = (requestedSelect.length > 0 || isUserFieldBoundary) && params.excludeResponse !== true;
     const willProjectBatch = batchRestricted.size > 0 && params.excludeResponse !== true;
-    if (mergePages || willProject || willProjectBatch) {
+    const willFilterMembers = memberNameFilter !== void 0 && memberNameFilter.trim() !== "" && params.excludeResponse !== true;
+    if (mergePages || willProject || willProjectBatch || willFilterMembers) {
       options.forceJsonOutput = true;
     }
     let response = await graphClient.graphRequest(path2, options);
     const shouldProject = willProject && !response?.isError;
     let projectionHandled = false;
+    let memberFilterHandled = false;
+    const applyMemberFilter = (body2) => {
+      if (!willFilterMembers) return body2;
+      memberFilterHandled = true;
+      const filtered = filterMembersByName(body2, memberNameFilter);
+      if (isPlainObject(filtered) && Array.isArray(filtered.value) && response._meta) {
+        response._meta = { ...response._meta, result_count: filtered.value.length };
+      }
+      return filtered;
+    };
     const applyProjection = (body2) => {
       if (isTransportEnvelope(body2)) {
         logger.info("Skipping $select projection: body is a transport envelope, not a resource");
@@ -1948,7 +1972,9 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
         logger.error(`Error during pagination: ${e}`);
       }
       if (combinedResponse !== void 0) {
-        const merged = shouldProject ? applyProjection(combinedResponse) : combinedResponse;
+        const merged = applyMemberFilter(
+          shouldProject ? applyProjection(combinedResponse) : combinedResponse
+        );
         projectionHandled = shouldProject;
         response.content[0].text = graphClient.serialize(merged);
       }
@@ -1956,7 +1982,9 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
     if (shouldProject && !projectionHandled && !response?.isError && response?.content?.[0]?.text) {
       try {
         const parsed = JSON.parse(response.content[0].text);
-        response.content[0].text = graphClient.serialize(applyProjection(parsed));
+        response.content[0].text = graphClient.serialize(
+          applyMemberFilter(applyProjection(parsed))
+        );
       } catch {
       }
     }
@@ -1969,6 +1997,14 @@ async function executeGraphTool(tool, config, graphClient, params, authManager,
       } catch {
       }
     }
+    if (willFilterMembers && !memberFilterHandled && !response?.isError && response?.content?.[0]?.text) {
+      try {
+        response.content[0].text = graphClient.serialize(
+          applyMemberFilter(JSON.parse(response.content[0].text))
+        );
+      } catch {
+      }
+    }
     if (response?.content?.[0]?.text) {
       const responseText = response.content[0].text;
       logger.info(`Response size: ${responseText.length} characters`);
@@ -2125,6 +2161,9 @@ function registerGraphTools(server, graphClient, options = {}) {
       const maxPages = getMaxPages();
       paramSchema["fetchAllPages"] = z.boolean().describe(getFetchAllPagesParamDescription(maxPages, tool.alias)).optional();
     }
+    if (MEMBER_NAME_FILTER_TOOLS.has(tool.alias)) {
+      paramSchema["name"] = z.string().describe(MEMBER_NAME_PARAM_DESCRIPTION).optional();
+    }
     if (isSkiptokenApplicable(tool, Object.keys(paramSchema))) {
       paramSchema["skiptoken"] = z.string().describe(SKIPTOKEN_PARAM_DESCRIPTION).optional();
     }
@@ -2545,6 +2584,7 @@ export {
   UTILITY_TOOLS,
   buildDiscoverySearchIndex,
   buildToolsRegistry,
+  filterMembersByName,
   isDestructiveOperation,
   registerDiscoveryTools,
   registerGraphTools,

package/dist/lib/log-redactor.js

@@ -22,13 +22,30 @@ const REDACTIONS = [
   {
     pattern: /([?&]code=)[^&\s"']+/gi,
     replacement: "$1[REDACTED]"
-  },
-  // Email addresses / UPNs
-  {
-    pattern: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,
-    replacement: "[REDACTED_EMAIL]"
   }
 ];
+const EMAIL_LOCAL_CHAR = /[A-Za-z0-9._%+-]/;
+const EMAIL_DOMAIN = /[A-Za-z0-9.-]+\.[A-Za-z]{2,}/y;
+function redactEmails(input) {
+  let at = input.indexOf("@");
+  if (at === -1) return input;
+  let out = "";
+  let copied = 0;
+  while (at !== -1) {
+    let start = at;
+    while (start > copied && EMAIL_LOCAL_CHAR.test(input[start - 1])) start--;
+    EMAIL_DOMAIN.lastIndex = at + 1;
+    const domain = start < at ? EMAIL_DOMAIN.exec(input) : null;
+    if (domain) {
+      out += input.slice(copied, start) + "[REDACTED_EMAIL]";
+      copied = at + 1 + domain[0].length;
+      at = input.indexOf("@", copied);
+    } else {
+      at = input.indexOf("@", at + 1);
+    }
+  }
+  return out + input.slice(copied);
+}
 function redactionEnabled() {
   const raw = process.env.MS365_MCP_REDACT_PII;
   if (raw === void 0) return true;
@@ -39,7 +56,7 @@ function redactSensitive(input) {
   for (const { pattern, replacement } of REDACTIONS) {
     out = out.replace(pattern, replacement);
   }
-  return out;
+  return redactEmails(out);
 }
 export {
   redactSensitive,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.166.0",
+  "version": "0.167.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -1737,7 +1737,7 @@
     "toolName": "list-chat-members",
     "presets": ["teams", "work"],
     "workScopes": ["ChatMember.Read"],
-    "llmTip": "Lists members of a chat. Each member has displayName, email, roles (owner/guest), and visibleHistoryStartDateTime. For meeting chats, use the chatInfo.threadId from get-online-meeting as the chat-id to see who participated in the meeting chat."
+    "llmTip": "Lists members of a chat. Each member has displayName, email, roles (owner/guest), and visibleHistoryStartDateTime. For meeting chats, use the chatInfo.threadId from get-online-meeting as the chat-id to see who participated in the meeting chat. Pass name to keep only members whose displayName or email contains that text (case-insensitive); use the returned userId in an @mention."
   },
   {
     "pathPattern": "/chats/{chat-id}/messages",
@@ -1958,7 +1958,8 @@
     "method": "get",
     "toolName": "list-team-members",
     "presets": ["teams", "work"],
-    "workScopes": ["TeamMember.Read.All"]
+    "workScopes": ["TeamMember.Read.All"],
+    "llmTip": "Lists members of a team. Each member has displayName, email, roles and userId. Pass name to keep only members whose displayName or email contains that text (case-insensitive); use the returned userId in an @mention."
   },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/filesFolder",