@softeria/ms-365-mcp-server 0.4.0 → 0.4.2

package/README.md

@@ -82,6 +82,31 @@ integration method.
 
 Tokens are cached securely in your OS credential store (fallback to file).
 
+## CLI Options
+
+The following options can be used when running ms-365-mcp-server directly from the command line:
+
+```
+--login           Login using device code flow
+--logout          Log out and clear saved credentials
+--verify-login    Verify login without starting the server
+```
+
+### Server Options
+
+When running as an MCP server, the following options can be used:
+
+```
+-v                Enable verbose logging
+--read-only       Start server in read-only mode, disabling write operations
+```
+
+Environment variables:
+
+- `READ_ONLY=true|1`: Alternative to --read-only flag
+- `LOG_LEVEL`: Set logging level (default: 'info')
+- `SILENT=true`: Disable console output
+
 ## License
 
 MIT © 2025 Softeria

package/dist/auth.js

@@ -5,7 +5,7 @@ import path from 'path';
 import fs from 'fs';
 import logger from './logger.js';
 const endpoints = await import('./endpoints.json', {
-    assert: { type: 'json' },
+    with: { type: 'json' },
 });
 const SERVICE_NAME = 'ms-365-mcp-server';
 const TOKEN_CACHE_ACCOUNT = 'msal-token-cache';

package/dist/cli.js

@@ -14,8 +14,13 @@ program
     .option('-v', 'Enable verbose logging')
     .option('--login', 'Login using device code flow')
     .option('--logout', 'Log out and clear saved credentials')
-    .option('--verify-login', 'Verify login without starting the server');
+    .option('--verify-login', 'Verify login without starting the server')
+    .option('--read-only', 'Start server in read-only mode, disabling write operations');
 export function parseArgs() {
     program.parse();
-    return program.opts();
+    const options = program.opts();
+    if (process.env.READ_ONLY === 'true' || process.env.READ_ONLY === '1') {
+        options.readOnly = true;
+    }
+    return options;
 }

package/dist/graph-tools.js

@@ -1,9 +1,12 @@
 import logger from './logger.js';
 import { api } from './generated/client.js';
 import { z } from 'zod';
-export function registerGraphTools(server, graphClient) {
+export function registerGraphTools(server, graphClient, readOnly = false) {
     for (const tool of api.endpoints) {
-        // Create a zod schema for the parameters
+        if (readOnly && tool.method.toUpperCase() !== 'GET') {
+            logger.info(`Skipping write operation ${tool.alias} in read-only mode`);
+            continue;
+        }
         const paramSchema = {};
         if (tool.parameters && tool.parameters.length > 0) {
             for (const param of tool.parameters) {

package/dist/server.js

@@ -17,13 +17,16 @@ class MicrosoftGraphServer {
             version,
         });
         registerAuthTools(this.server, this.authManager);
-        registerGraphTools(this.server, this.graphClient);
+        registerGraphTools(this.server, this.graphClient, this.options.readOnly);
     }
     async start() {
         if (this.options.v) {
             enableConsoleLogging();
         }
         logger.info('Microsoft 365 MCP Server starting...');
+        if (this.options.readOnly) {
+            logger.info('Server running in READ-ONLY mode. Write operations are disabled.');
+        }
         const transport = new StdioServerTransport();
         await this.server.connect(transport);
         logger.info('Server connected to transport');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Microsoft 365 MCP Server",
   "type": "module",
   "main": "dist/index.js",

package/src/auth.ts

@@ -7,7 +7,7 @@ import fs from 'fs';
 import logger from './logger.js';
 
 const endpoints = await import('./endpoints.json', {
-  assert: { type: 'json' },
+  with: { type: 'json' },
 });
 
 const SERVICE_NAME = 'ms-365-mcp-server';

package/src/cli.ts

@@ -17,17 +17,26 @@ program
   .option('-v', 'Enable verbose logging')
   .option('--login', 'Login using device code flow')
   .option('--logout', 'Log out and clear saved credentials')
-  .option('--verify-login', 'Verify login without starting the server');
+  .option('--verify-login', 'Verify login without starting the server')
+  .option('--read-only', 'Start server in read-only mode, disabling write operations');
 
 export interface CommandOptions {
   v?: boolean;
   login?: boolean;
   logout?: boolean;
   verifyLogin?: boolean;
+  readOnly?: boolean;
+
   [key: string]: any;
 }
 
 export function parseArgs(): CommandOptions {
   program.parse();
-  return program.opts();
+  const options = program.opts();
+
+  if (process.env.READ_ONLY === 'true' || process.env.READ_ONLY === '1') {
+    options.readOnly = true;
+  }
+
+  return options;
 }

package/src/graph-tools.ts

@@ -58,9 +58,17 @@ interface CallToolResult {
   [key: string]: unknown;
 }
 
-export function registerGraphTools(server: McpServer, graphClient: GraphClient): void {
+export function registerGraphTools(
+  server: McpServer,
+  graphClient: GraphClient,
+  readOnly: boolean = false
+): void {
   for (const tool of api.endpoints) {
-    // Create a zod schema for the parameters
+    if (readOnly && tool.method.toUpperCase() !== 'GET') {
+      logger.info(`Skipping write operation ${tool.alias} in read-only mode`);
+      continue;
+    }
+
     const paramSchema: Record<string, any> = {};
     if (tool.parameters && tool.parameters.length > 0) {
       for (const param of tool.parameters) {

package/src/server.ts

@@ -27,7 +27,7 @@ class MicrosoftGraphServer {
     });
 
     registerAuthTools(this.server, this.authManager);
-    registerGraphTools(this.server, this.graphClient);
+    registerGraphTools(this.server, this.graphClient, this.options.readOnly);
   }
 
   async start(): Promise<void> {
@@ -36,6 +36,9 @@ class MicrosoftGraphServer {
     }
 
     logger.info('Microsoft 365 MCP Server starting...');
+    if (this.options.readOnly) {
+      logger.info('Server running in READ-ONLY mode. Write operations are disabled.');
+    }
 
     const transport = new StdioServerTransport();
     await this.server!.connect(transport);

package/test/read-only.test.ts

@@ -0,0 +1,96 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { parseArgs } from '../src/cli.js';
+import { registerGraphTools } from '../src/graph-tools.js';
+
+vi.mock('../src/cli.js', () => {
+  const parseArgsMock = vi.fn();
+  return {
+    parseArgs: parseArgsMock,
+  };
+});
+
+vi.mock('../src/generated/client.js', () => {
+  return {
+    api: {
+      endpoints: [
+        {
+          alias: 'list-mail-messages',
+          method: 'get',
+          path: '/me/messages',
+          parameters: [],
+        },
+        {
+          alias: 'send-mail',
+          method: 'post',
+          path: '/me/sendMail',
+          parameters: [],
+        },
+        {
+          alias: 'delete-mail-message',
+          method: 'delete',
+          path: '/me/messages/{message-id}',
+          parameters: [],
+        },
+      ],
+    },
+  };
+});
+
+vi.mock('../src/logger.js', () => {
+  return {
+    default: {
+      info: vi.fn(),
+      error: vi.fn(),
+    },
+  };
+});
+
+describe('Read-Only Mode', () => {
+  let mockServer: any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    delete process.env.READ_ONLY;
+
+    mockServer = {
+      tool: vi.fn(),
+    };
+  });
+
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  it('should respect --read-only flag from CLI', () => {
+    vi.mocked(parseArgs).mockReturnValue({ readOnly: true } as any);
+
+    const options = parseArgs();
+    expect(options.readOnly).toBe(true);
+
+    registerGraphTools(mockServer, {} as any, options.readOnly);
+
+    expect(mockServer.tool).toHaveBeenCalledTimes(1);
+
+    const toolCalls = mockServer.tool.mock.calls.map((call: any[]) => call[0]);
+    expect(toolCalls).toContain('list-mail-messages');
+    expect(toolCalls).not.toContain('send-mail');
+    expect(toolCalls).not.toContain('delete-mail-message');
+  });
+
+  it('should register all endpoints when not in read-only mode', () => {
+    vi.mocked(parseArgs).mockReturnValue({ readOnly: false } as any);
+
+    const options = parseArgs();
+    expect(options.readOnly).toBe(false);
+
+    registerGraphTools(mockServer, {} as any, options.readOnly);
+
+    expect(mockServer.tool).toHaveBeenCalledTimes(3);
+
+    const toolCalls = mockServer.tool.mock.calls.map((call: any[]) => call[0]);
+    expect(toolCalls).toContain('list-mail-messages');
+    expect(toolCalls).toContain('send-mail');
+    expect(toolCalls).toContain('delete-mail-message');
+  });
+});