@softeria/ms-365-mcp-server 0.169.2 → 0.170.0

package/.env.example

@@ -15,7 +15,7 @@ MS365_MCP_CLIENT_SECRET=your-azure-ad-app-client-secret-here
 # Tenant ID - use "common" for multi-tenant or your specific tenant ID
 MS365_MCP_TENANT_ID=common
 
-# Cloud environment: global (default) or china (21Vianet)
+# Cloud environment: global (default), china (21Vianet) or gcc-high (US Government)
 # MS365_MCP_CLOUD_TYPE=global
 
 # Instructions for Global Cloud:
@@ -37,6 +37,11 @@ MS365_MCP_TENANT_ID=common
 # 3. Follow the same steps as above
 # 4. Set MS365_MCP_CLOUD_TYPE=china
 
+# Instructions for GCC High:
+# 1. Go to https://portal.azure.us
+# 2. Register an app in your government tenant (no default client ID exists)
+# 3. Set MS365_MCP_CLIENT_ID, MS365_MCP_TENANT_ID and MS365_MCP_CLOUD_TYPE=gcc-high
+
 # -------------------------------------------------------------------
 # Azure Key Vault Integration (Optional)
 # -------------------------------------------------------------------

package/README.md

@@ -11,10 +11,13 @@ API.
 
 This server supports multiple Microsoft cloud environments:
 
-| Cloud                | Description                        | Auth Endpoint             | Graph API Endpoint              |
-| -------------------- | ---------------------------------- | ------------------------- | ------------------------------- |
-| **Global** (default) | International Microsoft 365        | login.microsoftonline.com | graph.microsoft.com             |
-| **China** (21Vianet) | Microsoft 365 operated by 21Vianet | login.chinacloudapi.cn    | microsoftgraph.chinacloudapi.cn |
+| Cloud                | Description                          | Auth Endpoint             | Graph API Endpoint              |
+| -------------------- | ------------------------------------ | ------------------------- | ------------------------------- |
+| **Global** (default) | International Microsoft 365          | login.microsoftonline.com | graph.microsoft.com             |
+| **China** (21Vianet) | Microsoft 365 operated by 21Vianet   | login.chinacloudapi.cn    | microsoftgraph.chinacloudapi.cn |
+| **GCC High**         | Microsoft 365 US Government GCC High | login.microsoftonline.us  | graph.microsoft.us              |
+
+GCC High has no pre-registered client: register an app in your government tenant and set `MS365_MCP_CLIENT_ID` (and `MS365_MCP_TENANT_ID`), then use `--cloud gcc-high`.
 
 To route Graph traffic through a proxy of your own (one that terminates the client's plain HTTP and originates TLS to Microsoft), set `MS365_MCP_GRAPH_BASE_URL` to its base URL; see the environment variable list under CLI Options, including what still bypasses it.
 
@@ -673,7 +676,7 @@ The following options can be used when running ms-365-mcp-server directly from t
 --org-mode        Enable organization/work mode from start (includes Teams, SharePoint, etc.)
 --work-mode       Alias for --org-mode
 --force-work-scopes Backwards compatibility alias for --org-mode (deprecated)
---cloud <type>    Microsoft cloud environment: global (default) or china (21Vianet)
+--cloud <type>    Microsoft cloud environment: global (default), china (21Vianet) or gcc-high
 --allowed-scopes <scopes> Limit exposed tools to Graph scopes covered by this allowlist
 --extra-scopes <scopes> Append additional Graph scopes to the token request (for use with your own app registration + graph-batch)
 --expected-username <username> Require local MSAL auth to use this account username
@@ -745,7 +748,7 @@ Environment variables:
 - `MS365_MCP_ATTACHMENT_HOST=<host>`: Interface the `MS365_MCP_ATTACHMENT_PORT` listener binds (alternative to --attachment-host; requires `--attachment-port`). Defaults to the host `--http` bound — which for a wildcard `--http` means both ports answer everywhere and the port split isolates nothing. See "Splitting the attachment listener"
 - `MS365_MCP_HTTP_LOCAL_FILE_TOOLS=true|1`: Register download-bytes-to-file, and upload-attachment-from-file when `MS365_MCP_UPLOAD_DIRS` is set, over HTTP (alternative to --http-local-file-tools; same restrictions)
 - `MS365_MCP_UPLOAD_DIRS=<dirs>`: Directories `upload-attachment-from-file` may read from, as absolute paths separated like `PATH`. Unset (the default) leaves the tool unregistered. See "Attaching a local file in stdio mode"
-- `MS365_MCP_CLOUD_TYPE=global|china`: Microsoft cloud environment (alternative to --cloud flag)
+- `MS365_MCP_CLOUD_TYPE=global|china|gcc-high`: Microsoft cloud environment (alternative to --cloud flag)
 - `MS365_MCP_GRAPH_BASE_URL=<url>`: Send Graph API requests to this base URL instead of the cloud's `graph.microsoft.com` (e.g. `http://127.0.0.1:10255/tenant-a/graph` for an egress proxy that originates TLS itself). Absolute http(s) URL without query or fragment; a path prefix is kept, so requests go to `<url>/v1.0/...`. The login authority and the On-Behalf-Of token resource are unchanged. Two things bypass it: `get-download-url` returns Graph's pre-authenticated SharePoint URL, and the `302` from `/content` points straight at SharePoint, so whoever follows either connects to SharePoint directly; if you control egress, allow those SharePoint hosts or disable those tools. Not read from `.env`
 - `LOG_LEVEL`: Set logging level (default: 'info')
 - `SILENT=true|1`: Disable console output

package/dist/cli.js

@@ -55,7 +55,10 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 ).option("--list-presets", "List all available presets and exit").option("--list-permissions", "List all required Graph API permissions and exit").option(
   "--org-mode",
   "Enable organization/work mode from start (includes Teams, SharePoint, etc.)"
-).option("--work-mode", "Alias for --org-mode").option("--force-work-scopes", "Backwards compatibility alias for --org-mode (deprecated)").option("--toon", "(experimental) Enable TOON output format for 30-60% token reduction").option("--discovery", "Enable runtime tool discovery and loading (experimental feature)").option("--cloud <type>", "Microsoft cloud environment: global (default) or china (21Vianet)").option(
+).option("--work-mode", "Alias for --org-mode").option("--force-work-scopes", "Backwards compatibility alias for --org-mode (deprecated)").option("--toon", "(experimental) Enable TOON output format for 30-60% token reduction").option("--discovery", "Enable runtime tool discovery and loading (experimental feature)").option(
+  "--cloud <type>",
+  "Microsoft cloud environment: global (default), china (21Vianet) or gcc-high (US Government GCC High)"
+).option(
   "--enable-dynamic-registration",
   "Enable OAuth Dynamic Client Registration endpoint (kept for backwards compatibility, now enabled by default in HTTP mode)"
 ).option(

package/dist/cloud-config.js

@@ -8,6 +8,11 @@ const CLOUD_ENDPOINTS = {
     authority: "https://login.chinacloudapi.cn",
     graphApi: "https://microsoftgraph.chinacloudapi.cn",
     portal: "https://portal.azure.cn"
+  },
+  "gcc-high": {
+    authority: "https://login.microsoftonline.us",
+    graphApi: "https://graph.microsoft.us",
+    portal: "https://portal.azure.us"
   }
 };
 const DEFAULT_CLIENT_IDS = {
@@ -15,7 +20,13 @@ const DEFAULT_CLIENT_IDS = {
   china: "f3e61a6e-bc26-4281-8588-2c7359a02141"
 };
 function getDefaultClientId(cloudType = "global") {
-  return DEFAULT_CLIENT_IDS[cloudType];
+  const clientId = DEFAULT_CLIENT_IDS[cloudType];
+  if (!clientId) {
+    throw new Error(
+      `No default client ID exists for the ${cloudType} cloud. Register an app in the ${cloudType} tenant and set MS365_MCP_CLIENT_ID.`
+    );
+  }
+  return clientId;
 }
 const GRAPH_BASE_URL_ENV = "MS365_MCP_GRAPH_BASE_URL";
 function getGraphBaseUrlOverride() {

package/dist/lib/user-field-policy.js

@@ -3,10 +3,29 @@ const USER_ENTITY_PATH = /^\/users(?:\/[^/]+)?\/?$/i;
 const DIRECTORY_NAVIGATION_PATH = /^(?:\/me|\/users\/[^/]+)\/(?:manager|directReports)\/?$|^\/groups\/[^/]+\/(?:members|owners)\/?$/i;
 const EXPAND_USER_PATH = /^\/me\/?$|^\/groups(?:\/[^/]+)?\/?$/i;
 function normalizePath(path) {
-  const withoutQuery = path.split("?")[0];
+  let withoutQuery = path.split("?")[0];
+  for (let i = 0; i < 4; i++) {
+    const next = withoutQuery.replace(
+      /%([0-9a-f]{2})/gi,
+      (_, hex) => String.fromCharCode(parseInt(hex, 16))
+    );
+    if (next === withoutQuery) break;
+    withoutQuery = next;
+  }
   return withoutQuery.startsWith("/") ? withoutQuery : `/${withoutQuery}`;
 }
+const ENCODED_SEPARATOR = /%(?:25)*(?:2f|5c)/i;
+function deleteOdataOption(params, name) {
+  const values = [];
+  for (const key of [...new Set(params.keys())]) {
+    if (key.replace(/^\$/, "").toLowerCase() !== name) continue;
+    values.push(...params.getAll(key));
+    params.delete(key);
+  }
+  return values;
+}
 function userFieldEnforcement(path) {
+  if (ENCODED_SEPARATOR.test(path.split("?")[0])) return "request-and-response";
   const normalized = normalizePath(path);
   if (USER_ENTITY_PATH.test(normalized)) return "request-and-response";
   if (DIRECTORY_NAVIGATION_PATH.test(normalized)) return "response-only";
@@ -23,8 +42,7 @@ function stripUserFieldExpandFromUrl(url) {
   const [path, query = ""] = url.split("?");
   if (!shouldStripUserFieldExpand(path) || query === "") return url;
   const params = new URLSearchParams(query);
-  if (!params.has("$expand")) return url;
-  params.delete("$expand");
+  if (deleteOdataOption(params, "expand").length === 0) return url;
   const rebuilt = params.toString();
   if (rebuilt === "") return path;
   return `${path}?${rebuilt.replace(/%24/gi, "$").replace(/%2C/gi, ",")}`;
@@ -46,14 +64,15 @@ function restrictUserFieldQuery(queryParams, allowlist, enforcement) {
 function restrictUserFieldUrl(url, allowlist, enforcement) {
   const [path, query = ""] = url.split("?");
   const params = new URLSearchParams(query);
+  const requested = enforcement === "request-and-response" ? deleteOdataOption(params, "select") : params.getAll("$select");
   const fields = effectiveUserFields(
-    parseSelectFields(params.get("$select") ?? void 0),
+    parseSelectFields(requested.join(",") || void 0),
     allowlist
   );
   if (enforcement === "request-and-response") {
     params.set("$select", fields.join(","));
   }
-  params.delete("$expand");
+  deleteOdataOption(params, "expand");
   const rebuilt = params.toString();
   if (rebuilt === "") return { url: path, fields };
   return { url: `${path}?${rebuilt.replace(/%24/gi, "$").replace(/%2C/gi, ",")}`, fields };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.169.2",
+  "version": "0.170.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",