@softeria/ms-365-mcp-server 0.63.2 → 0.65.0

package/README.md

@@ -553,6 +553,8 @@ Parent directories are created automatically. Files are written with `0600` perm
 
 > **Security note**: File-based token storage writes sensitive credentials to disk. Ensure the chosen directory has appropriate access controls. The OS credential store (keytar) is preferred when available.
 
+> **Hosted/sandboxed environments** (e.g. Anthropic Cowork): Set `MS365_MCP_TOKEN_CACHE_PATH` and `MS365_MCP_SELECTED_ACCOUNT_PATH` to a persistent mount so tokens survive between sessions.
+
 ## Azure Key Vault Integration
 
 For production deployments, you can store secrets in Azure Key Vault instead of environment variables. This is particularly useful for Azure Container Apps with managed identity.

package/dist/endpoints.json

@@ -133,6 +133,13 @@
     "scopes": ["Mail.ReadWrite"],
     "llmTip": "Max 3MB. Body requires @odata.type: {\"@odata.type\": \"#microsoft.graph.fileAttachment\", \"name\": \"file.pdf\", \"contentBytes\": \"<base64>\"}."
   },
+  {
+    "pathPattern": "/me/messages/{message-id}/attachments/createUploadSession",
+    "method": "post",
+    "toolName": "create-mail-attachment-upload-session",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "For large attachments (3-150MB). Body: { AttachmentItem: { attachmentType: 'file', name: 'report.pdf', size: 5000000 } }. Returns a pre-authenticated uploadUrl for direct PUT of file bytes."
+  },
   {
     "pathPattern": "/me/messages/{message-id}/attachments",
     "method": "get",
@@ -341,6 +348,12 @@
     "supportsExpandExtendedProperties": true,
     "llmTip": "Returns expanded recurring event instances (not just seriesMaster) within a date range for a specific calendar. Requires startDateTime and endDateTime query parameters in ISO 8601 format (e.g., 2024-01-01T00:00:00Z). Each instance includes seriesMasterId and type (occurrence/exception) fields for recurring event linkage. Use fetchAllPages=true to retrieve all results when there are many events. To find Teams meetings, use $filter=isOnlineMeeting eq true. Teams meetings include a joinWebUrl property needed for transcript access via list-online-meetings."
   },
+  {
+    "pathPattern": "/me/calendar/getSchedule",
+    "method": "post",
+    "toolName": "get-schedule",
+    "workScopes": ["Calendars.Read"]
+  },
   {
     "pathPattern": "/me/calendars/{calendar-id}/events/{event-id}/instances",
     "method": "get",
@@ -428,6 +441,13 @@
     "scopes": ["Files.ReadWrite"],
     "llmTip": "Max 4MB. For new files use path format: /items/root:/path/to/file.txt:/content. Overwrites existing files without warning."
   },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/createUploadSession",
+    "method": "post",
+    "toolName": "create-upload-session",
+    "scopes": ["Files.ReadWrite"],
+    "llmTip": "For large file uploads (no size limit). Returns a pre-authenticated uploadUrl for direct PUT of file bytes. For new files use path: /items/{parentId}:/{fileName}:/createUploadSession. Body (optional): { item: { '@microsoft.graph.conflictBehavior': 'rename' } }."
+  },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}",
     "method": "patch",

package/dist/generated/client.js

@@ -748,6 +748,18 @@ const microsoft_graph_driveItemCollectionResponse = z.object({
   "@odata.nextLink": z.string().nullable(),
   value: z.array(microsoft_graph_driveItem)
 }).partial().passthrough();
+const create_upload_session_Body = z.object({ item: z.object({}).partial().passthrough() }).partial().passthrough();
+const microsoft_graph_uploadSession = z.object({
+  expirationDateTime: z.string().regex(
+    /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
+  ).datetime({ offset: true }).describe(
+    "The date and time in UTC that the upload session expires. The complete file must be uploaded before this expiration time is reached. Each fragment uploaded during the session extends the expiration time."
+  ).nullish(),
+  nextExpectedRanges: z.array(z.string().nullable()).describe(
+    "A collection of byte ranges that the server is missing for the file. These ranges are zero indexed and of the format 'start-end' (for example '0-26' to indicate the first 27 bytes of the file). When uploading files as Outlook attachments, instead of a collection of ranges, this property always indicates a single value '{start}', the location in the file where the next upload should begin."
+  ).optional(),
+  uploadUrl: z.string().describe("The URL endpoint that accepts PUT requests for byte ranges of the file.").nullish()
+}).passthrough();
 const microsoft_graph_workbookIcon = z.object({
   index: z.number().gte(-2147483648).lte(2147483647).describe("The index of the icon in the given set.").optional(),
   set: z.string().describe(
@@ -1334,6 +1346,68 @@ const microsoft_graph_conversationThreadCollectionResponse = z.object({
   value: z.array(microsoft_graph_conversationThread)
 }).partial().passthrough();
 const reply_to_group_thread_Body = z.object({ Post: microsoft_graph_post }).partial().passthrough();
+const get_schedule_Body = z.object({
+  Schedules: z.array(z.string().nullable()),
+  EndTime: z.union([microsoft_graph_dateTimeTimeZone, z.object({}).partial().passthrough()]),
+  StartTime: z.union([microsoft_graph_dateTimeTimeZone, z.object({}).partial().passthrough()]),
+  AvailabilityViewInterval: z.number().gte(-2147483648).lte(2147483647).nullable()
+}).partial().passthrough();
+const BaseCollectionPaginationCountResponse = z.object({ "@odata.count": z.number().int().nullable(), "@odata.nextLink": z.string().nullable() }).partial().passthrough();
+const microsoft_graph_freeBusyError = z.object({
+  message: z.string().describe("Describes the error.").nullish(),
+  responseCode: z.string().describe(
+    "The response code from querying for the availability of the user, distribution list, or resource."
+  ).nullish()
+}).passthrough();
+const microsoft_graph_freeBusyStatus = z.enum([
+  "unknown",
+  "free",
+  "tentative",
+  "busy",
+  "oof",
+  "workingElsewhere"
+]);
+const microsoft_graph_scheduleItem = z.object({
+  end: microsoft_graph_dateTimeTimeZone.optional(),
+  isPrivate: z.boolean().describe(
+    "The sensitivity of the corresponding event. True if the event is marked private, false otherwise. Optional."
+  ).nullish(),
+  location: z.string().describe("The location where the corresponding event is held or attended from. Optional.").nullish(),
+  start: microsoft_graph_dateTimeTimeZone.optional(),
+  status: microsoft_graph_freeBusyStatus.optional(),
+  subject: z.string().describe("The corresponding event's subject line. Optional.").nullish()
+}).passthrough();
+const microsoft_graph_dayOfWeek = z.enum([
+  "sunday",
+  "monday",
+  "tuesday",
+  "wednesday",
+  "thursday",
+  "friday",
+  "saturday"
+]);
+const microsoft_graph_timeZoneBase = z.object({
+  name: z.string().describe(
+    "The name of a time zone. It can be a standard time zone name such as 'Hawaii-Aleutian Standard Time', or 'Customized Time Zone' for a custom time zone."
+  ).nullish()
+}).passthrough();
+const microsoft_graph_workingHours = z.object({
+  daysOfWeek: z.array(z.union([microsoft_graph_dayOfWeek, z.object({}).partial().passthrough()])).describe("The days of the week on which the user works.").optional(),
+  endTime: z.string().regex(/^([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?$/).describe("The time of the day that the user stops working.").nullish(),
+  startTime: z.string().regex(/^([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?$/).describe("The time of the day that the user starts working.").nullish(),
+  timeZone: microsoft_graph_timeZoneBase.optional()
+}).passthrough();
+const microsoft_graph_scheduleInformation = z.object({
+  availabilityView: z.string().describe(
+    "Represents a merged view of availability of all the items in scheduleItems. The view consists of time slots. Availability during each time slot is indicated with: 0= free or working elswhere, 1= tentative, 2= busy, 3= out of office.Note: Working elsewhere is set to 0 instead of 4 for backward compatibility. For details, see the Q&A and Exchange 2007 and Exchange 2010 do not use the WorkingElsewhere value."
+  ).nullish(),
+  error: microsoft_graph_freeBusyError.optional(),
+  scheduleId: z.string().describe(
+    "An SMTP address of the user, distribution list, or resource, identifying an instance of scheduleInformation."
+  ).nullish(),
+  scheduleItems: z.array(microsoft_graph_scheduleItem).describe("Contains the items that describe the availability of the user or resource.").optional(),
+  workingHours: microsoft_graph_workingHours.optional()
+}).passthrough();
 const microsoft_graph_onlineMeetingProviderType = z.enum([
   "unknown",
   "skypeForBusiness",
@@ -1430,14 +1504,6 @@ const microsoft_graph_location = z.object({
   uniqueId: z.string().describe("For internal use only.").nullish(),
   uniqueIdType: microsoft_graph_locationUniqueIdType.optional()
 }).passthrough();
-const microsoft_graph_freeBusyStatus = z.enum([
-  "unknown",
-  "free",
-  "tentative",
-  "busy",
-  "oof",
-  "workingElsewhere"
-]);
 const microsoft_graph_sensitivity = z.enum(["normal", "personal", "private", "confidential"]);
 const microsoft_graph_importance = z.enum(["low", "normal", "high"]);
 const microsoft_graph_attendeeType = z.enum(["required", "optional", "resource"]);
@@ -1467,15 +1533,6 @@ const microsoft_graph_attendee = z.object({
   proposedNewTime: microsoft_graph_timeSlot.optional(),
   status: microsoft_graph_responseStatus.optional()
 }).passthrough();
-const microsoft_graph_dayOfWeek = z.enum([
-  "sunday",
-  "monday",
-  "tuesday",
-  "wednesday",
-  "thursday",
-  "friday",
-  "saturday"
-]);
 const microsoft_graph_weekIndex = z.enum(["first", "second", "third", "fourth", "last"]);
 const microsoft_graph_recurrencePatternType = z.enum([
   "daily",
@@ -2494,17 +2551,6 @@ const microsoft_graph_userPurpose = z.enum([
   "others",
   "unknownFutureValue"
 ]);
-const microsoft_graph_timeZoneBase = z.object({
-  name: z.string().describe(
-    "The name of a time zone. It can be a standard time zone name such as 'Hawaii-Aleutian Standard Time', or 'Customized Time Zone' for a custom time zone."
-  ).nullish()
-}).passthrough();
-const microsoft_graph_workingHours = z.object({
-  daysOfWeek: z.array(z.union([microsoft_graph_dayOfWeek, z.object({}).partial().passthrough()])).describe("The days of the week on which the user works.").optional(),
-  endTime: z.string().regex(/^([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?$/).describe("The time of the day that the user stops working.").nullish(),
-  startTime: z.string().regex(/^([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?$/).describe("The time of the day that the user starts working.").nullish(),
-  timeZone: microsoft_graph_timeZoneBase.optional()
-}).passthrough();
 const microsoft_graph_mailboxSettings = z.object({
   archiveFolder: z.string().describe("Folder ID of an archive folder for the user.").nullish(),
   automaticRepliesSetting: microsoft_graph_automaticRepliesSetting.optional(),
@@ -3609,7 +3655,6 @@ const microsoft_graph_searchRequest = z.object({
   ).optional()
 }).passthrough();
 const search_query_Body = z.object({ requests: z.array(microsoft_graph_searchRequest) }).partial().passthrough();
-const BaseCollectionPaginationCountResponse = z.object({ "@odata.count": z.number().int().nullable(), "@odata.nextLink": z.string().nullable() }).partial().passthrough();
 const microsoft_graph_searchBucket = z.object({
   aggregationFilterToken: z.string().describe(
     "A token containing the encoded filter to aggregate search matches by the specific key value. To use the filter, pass the token as part of the aggregationFilter property in a searchRequest object, in the format '{field}:/'{aggregationFilterToken}/''. See an example."
@@ -3865,6 +3910,8 @@ const schemas = {
   microsoft_graph_pendingOperations,
   microsoft_graph_driveItem,
   microsoft_graph_driveItemCollectionResponse,
+  create_upload_session_Body,
+  microsoft_graph_uploadSession,
   microsoft_graph_workbookIcon,
   microsoft_graph_workbookFilterCriteria,
   microsoft_graph_workbookFilter,
@@ -3923,6 +3970,15 @@ const schemas = {
   microsoft_graph_conversationCollectionResponse,
   microsoft_graph_conversationThreadCollectionResponse,
   reply_to_group_thread_Body,
+  get_schedule_Body,
+  BaseCollectionPaginationCountResponse,
+  microsoft_graph_freeBusyError,
+  microsoft_graph_freeBusyStatus,
+  microsoft_graph_scheduleItem,
+  microsoft_graph_dayOfWeek,
+  microsoft_graph_timeZoneBase,
+  microsoft_graph_workingHours,
+  microsoft_graph_scheduleInformation,
   microsoft_graph_onlineMeetingProviderType,
   microsoft_graph_calendarColor,
   microsoft_graph_calendarRoleType,
@@ -3933,7 +3989,6 @@ const schemas = {
   microsoft_graph_locationType,
   microsoft_graph_locationUniqueIdType,
   microsoft_graph_location,
-  microsoft_graph_freeBusyStatus,
   microsoft_graph_sensitivity,
   microsoft_graph_importance,
   microsoft_graph_attendeeType,
@@ -3941,7 +3996,6 @@ const schemas = {
   microsoft_graph_responseType,
   microsoft_graph_responseStatus,
   microsoft_graph_attendee,
-  microsoft_graph_dayOfWeek,
   microsoft_graph_weekIndex,
   microsoft_graph_recurrencePatternType,
   microsoft_graph_recurrencePattern,
@@ -4031,8 +4085,6 @@ const schemas = {
   microsoft_graph_delegateMeetingMessageDeliveryOptions,
   microsoft_graph_localeInfo,
   microsoft_graph_userPurpose,
-  microsoft_graph_timeZoneBase,
-  microsoft_graph_workingHours,
   microsoft_graph_mailboxSettings,
   microsoft_graph_messageRuleActions,
   microsoft_graph_messageActionFlag,
@@ -4143,7 +4195,6 @@ const schemas = {
   microsoft_graph_sortProperty,
   microsoft_graph_searchRequest,
   search_query_Body,
-  BaseCollectionPaginationCountResponse,
   microsoft_graph_searchBucket,
   microsoft_graph_searchAggregation,
   microsoft_graph_entity,
@@ -4604,6 +4655,22 @@ const endpoints = makeApi([
     ],
     response: z.void()
   },
+  {
+    method: "post",
+    path: "/drives/:driveId/items/:driveItemId/createUploadSession",
+    alias: "create-upload-session",
+    description: `Invoke action createUploadSession`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `Action parameters`,
+        type: "Body",
+        schema: create_upload_session_Body
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/drives/:driveId/items/:driveItemId/workbook/tables",
@@ -5011,6 +5078,22 @@ const endpoints = makeApi([
     ],
     response: z.void()
   },
+  {
+    method: "post",
+    path: "/me/calendar/getSchedule",
+    alias: "get-schedule",
+    description: `Get the free/busy availability information for a collection of users, distributions lists, or resources (rooms or equipment) for a specified time period.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `Action parameters`,
+        type: "Body",
+        schema: get_schedule_Body
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/me/calendars",
@@ -6927,6 +7010,22 @@ resource.`,
     ],
     response: z.void()
   },
+  {
+    method: "post",
+    path: "/me/messages/:messageId/attachments/createUploadSession",
+    alias: "create-mail-attachment-upload-session",
+    description: `Create an upload session that allows an app to iteratively upload ranges of a file, so as to attach the file to the specified Outlook item. The item can be a message or event. Use this approach to attach a file if the file size is between 3 MB and 150 MB. To attach a file that's smaller than 3 MB, do a POST operation on the attachments navigation property of the Outlook item; see how to do this for a message or for an event. As part of the response, this action returns an upload URL that you can use in subsequent sequential PUT queries. Request headers for each PUT operation let you specify the exact range of bytes to be uploaded. This allows transfer to be resumed, in case the network connection is dropped during upload. The following are the steps to attach a file to an Outlook item using an upload session: See attach large files to Outlook messages or events for an example.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `Action parameters`,
+        type: "Body",
+        schema: z.object({ AttachmentItem: z.object({}).partial().passthrough() }).partial().passthrough()
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "post",
     path: "/me/messages/:messageId/createForward",

package/logs/mcp-server.log

@@ -1,10 +1,10 @@
-2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
-2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
-2026-04-05 08:47:42 INFO: Using environment variables for secrets
-2026-04-05 08:47:42 INFO: Using environment variables for secrets
-2026-04-05 08:47:42 INFO: Using environment variables for secrets
-2026-04-05 08:47:42 INFO: Using environment variables for secrets
-2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 10:00:41 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 10:00:41 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 10:00:41 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 10:00:41 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
+2026-04-05 10:00:41 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
+2026-04-05 10:00:43 INFO: Using environment variables for secrets
+2026-04-05 10:00:43 INFO: Using environment variables for secrets
+2026-04-05 10:00:43 INFO: Using environment variables for secrets
+2026-04-05 10:00:43 INFO: Using environment variables for secrets
+2026-04-05 10:00:43 INFO: Using environment variables for secrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.63.2",
+  "version": "0.65.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -133,6 +133,13 @@
     "scopes": ["Mail.ReadWrite"],
     "llmTip": "Max 3MB. Body requires @odata.type: {\"@odata.type\": \"#microsoft.graph.fileAttachment\", \"name\": \"file.pdf\", \"contentBytes\": \"<base64>\"}."
   },
+  {
+    "pathPattern": "/me/messages/{message-id}/attachments/createUploadSession",
+    "method": "post",
+    "toolName": "create-mail-attachment-upload-session",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "For large attachments (3-150MB). Body: { AttachmentItem: { attachmentType: 'file', name: 'report.pdf', size: 5000000 } }. Returns a pre-authenticated uploadUrl for direct PUT of file bytes."
+  },
   {
     "pathPattern": "/me/messages/{message-id}/attachments",
     "method": "get",
@@ -341,6 +348,12 @@
     "supportsExpandExtendedProperties": true,
     "llmTip": "Returns expanded recurring event instances (not just seriesMaster) within a date range for a specific calendar. Requires startDateTime and endDateTime query parameters in ISO 8601 format (e.g., 2024-01-01T00:00:00Z). Each instance includes seriesMasterId and type (occurrence/exception) fields for recurring event linkage. Use fetchAllPages=true to retrieve all results when there are many events. To find Teams meetings, use $filter=isOnlineMeeting eq true. Teams meetings include a joinWebUrl property needed for transcript access via list-online-meetings."
   },
+  {
+    "pathPattern": "/me/calendar/getSchedule",
+    "method": "post",
+    "toolName": "get-schedule",
+    "workScopes": ["Calendars.Read"]
+  },
   {
     "pathPattern": "/me/calendars/{calendar-id}/events/{event-id}/instances",
     "method": "get",
@@ -428,6 +441,13 @@
     "scopes": ["Files.ReadWrite"],
     "llmTip": "Max 4MB. For new files use path format: /items/root:/path/to/file.txt:/content. Overwrites existing files without warning."
   },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/createUploadSession",
+    "method": "post",
+    "toolName": "create-upload-session",
+    "scopes": ["Files.ReadWrite"],
+    "llmTip": "For large file uploads (no size limit). Returns a pre-authenticated uploadUrl for direct PUT of file bytes. For new files use path: /items/{parentId}:/{fileName}:/createUploadSession. Body (optional): { item: { '@microsoft.graph.conflictBehavior': 'rename' } }."
+  },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}",
     "method": "patch",