@softeria/ms-365-mcp-server 0.77.0 → 0.79.0

package/dist/endpoints.json

@@ -352,6 +352,7 @@
     "pathPattern": "/me/calendar/getSchedule",
     "method": "post",
     "toolName": "get-schedule",
+    "readOnly": true,
     "workScopes": ["Calendars.Read"]
   },
   {
@@ -407,6 +408,7 @@
     "pathPattern": "/me/findMeetingTimes",
     "method": "post",
     "toolName": "find-meeting-times",
+    "readOnly": true,
     "workScopes": ["Calendars.Read.Shared"]
   },
   {
@@ -944,6 +946,21 @@
     "toolName": "get-chat-message",
     "workScopes": ["ChatMessage.Read"]
   },
+  {
+    "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}/hostedContents",
+    "method": "get",
+    "toolName": "list-chat-message-hosted-contents",
+    "workScopes": ["ChatMessage.Read"],
+    "llmTip": "Lists hosted-content references (inline images, code snippets) attached to a Teams chat message. Returns an array of { id, contentType }. Use get-chat-message-hosted-content with the id to download the bytes. Hosted content IDs can also be parsed from the <img src> URL in the message body between /hostedContents/ and /$value."
+  },
+  {
+    "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}/hostedContents/{chatMessageHostedContent-id}/$value",
+    "method": "get",
+    "toolName": "get-chat-message-hosted-content",
+    "workScopes": ["ChatMessage.Read"],
+    "returnDownloadUrl": true,
+    "llmTip": "Returns raw bytes of a hosted content item (typically image/png or image/jpeg) attached to a Teams 1:1 or group chat message. Use list-chat-message-hosted-contents to discover IDs, or extract the ID from the <img src> URL in the message body."
+  },
   {
     "pathPattern": "/chats/{chat-id}/messages",
     "method": "post",
@@ -1005,6 +1022,21 @@
     "toolName": "get-channel-message",
     "workScopes": ["ChannelMessage.Read.All"]
   },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents",
+    "method": "get",
+    "toolName": "list-channel-message-hosted-contents",
+    "workScopes": ["ChannelMessage.Read.All"],
+    "llmTip": "Lists hosted-content references (inline images, code snippets) attached to a Teams channel message. Returns an array of { id, contentType }. Use get-channel-message-hosted-content with the id to download bytes."
+  },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents/{chatMessageHostedContent-id}/$value",
+    "method": "get",
+    "toolName": "get-channel-message-hosted-content",
+    "workScopes": ["ChannelMessage.Read.All"],
+    "returnDownloadUrl": true,
+    "llmTip": "Returns raw bytes of a hosted content item attached to a Teams channel message. Use list-channel-message-hosted-contents to discover IDs."
+  },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages",
     "method": "post",

package/dist/generated/client.js

@@ -422,6 +422,11 @@ const microsoft_graph_chatMessageCollectionResponse = z.object({
   "@odata.nextLink": z.string().nullable(),
   value: z.array(microsoft_graph_chatMessage)
 }).partial().passthrough();
+const microsoft_graph_chatMessageHostedContentCollectionResponse = z.object({
+  "@odata.count": z.number().int().nullable(),
+  "@odata.nextLink": z.string().nullable(),
+  value: z.array(microsoft_graph_chatMessageHostedContent)
+}).partial().passthrough();
 const microsoft_graph_pinnedChatMessageInfoCollectionResponse = z.object({
   "@odata.count": z.number().int().nullable(),
   "@odata.nextLink": z.string().nullable(),
@@ -4303,6 +4308,7 @@ const schemas = {
   microsoft_graph_ODataErrors_ODataError,
   microsoft_graph_conversationMemberCollectionResponse,
   microsoft_graph_chatMessageCollectionResponse,
+  microsoft_graph_chatMessageHostedContentCollectionResponse,
   microsoft_graph_pinnedChatMessageInfoCollectionResponse,
   microsoft_graph_outOfOfficeSettings,
   microsoft_graph_dateTimeTimeZone,
@@ -4840,6 +4846,64 @@ const endpoints = makeApi([
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/chats/:chatId/messages/:chatMessageId/hostedContents",
+    alias: "list-chat-message-hosted-contents",
+    description: `Retrieve the list of chatMessageHostedContent objects from a message. This API only lists the hosted content objects. To get the content bytes, see get chatmessage hosted content.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "get",
+    path: "/chats/:chatId/messages/:chatMessageId/hostedContents/:chatMessageHostedContentId/$value",
+    alias: "get-chat-message-hosted-content",
+    description: `Retrieve the list of chatMessageHostedContent objects from a message. This API only lists the hosted content objects. To get the content bytes, see get chatmessage hosted content.`,
+    requestFormat: "json",
+    response: z.void()
+  },
   {
     method: "get",
     path: "/chats/:chatId/messages/:chatMessageId/replies",
@@ -10608,6 +10672,64 @@ To monitor future changes, call the delta API by using the @odata.deltaLink in t
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId/hostedContents",
+    alias: "list-channel-message-hosted-contents",
+    description: `Retrieve the list of chatMessageHostedContent objects from a message. This API only lists the hosted content objects. To get the content bytes, see get chatmessage hosted content.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "get",
+    path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId/hostedContents/:chatMessageHostedContentId/$value",
+    alias: "get-channel-message-hosted-content",
+    description: `Retrieve the list of chatMessageHostedContent objects from a message. This API only lists the hosted content objects. To get the content bytes, see get chatmessage hosted content.`,
+    requestFormat: "json",
+    response: z.void()
+  },
   {
     method: "get",
     path: "/teams/:teamId/channels/:channelId/messages/:chatMessageId/replies",

package/dist/graph-client.js

@@ -3,6 +3,27 @@ import { refreshAccessToken } from "./lib/microsoft-auth.js";
 import { encode as toonEncode } from "@toon-format/toon";
 import { getCloudEndpoints } from "./cloud-config.js";
 import { getRequestTokens } from "./request-context.js";
+function isBinaryContentType(contentType) {
+  if (!contentType) return false;
+  const lower = contentType.toLowerCase().split(";")[0].trim();
+  if (!lower) return false;
+  if (lower.startsWith("image/") || lower.startsWith("video/") || lower.startsWith("audio/") || lower.startsWith("font/")) {
+    return true;
+  }
+  if (lower === "application/octet-stream" || lower === "application/pdf") {
+    return true;
+  }
+  if (lower.startsWith("application/zip") || lower.startsWith("application/x-zip")) {
+    return true;
+  }
+  if (lower.startsWith("application/vnd.") || lower.startsWith("application/x-")) {
+    if (lower.endsWith("+json") || lower.endsWith("+xml") || lower.endsWith("+text")) {
+      return false;
+    }
+    return true;
+  }
+  return false;
+}
 class GraphClient {
   constructor(authManager, secrets, outputFormat = "json") {
     this.outputFormat = "json";
@@ -40,15 +61,28 @@ class GraphClient {
           `Microsoft Graph API error: ${response.status} ${response.statusText} - ${await response.text()}`
         );
       }
-      const text = await response.text();
+      const contentTypeHeader = response.headers?.get?.("content-type") || "";
+      const isBinaryResponse = isBinaryContentType(contentTypeHeader);
       let result;
-      if (text === "") {
-        result = { message: "OK!" };
+      if (isBinaryResponse) {
+        const buffer = Buffer.from(await response.arrayBuffer());
+        result = {
+          message: "OK!",
+          contentType: contentTypeHeader,
+          encoding: "base64",
+          contentLength: buffer.byteLength,
+          contentBytes: buffer.toString("base64")
+        };
       } else {
-        try {
-          result = JSON.parse(text);
-        } catch {
-          result = { message: "OK!", rawResponse: text };
+        const text = await response.text();
+        if (text === "") {
+          result = { message: "OK!" };
+        } else {
+          try {
+            result = JSON.parse(text);
+          } catch {
+            result = { message: "OK!", rawResponse: text };
+          }
         }
       }
       if (options.includeHeaders) {
@@ -205,5 +239,6 @@ class GraphClient {
 }
 var graph_client_default = GraphClient;
 export {
-  graph_client_default as default
+  graph_client_default as default,
+  isBinaryContentType
 };

package/dist/graph-tools.js

@@ -310,10 +310,13 @@ function registerGraphTools(server, graphClient, readOnly = false, enabledToolsP
       skippedCount++;
       continue;
     }
-    if (readOnly && tool.method.toUpperCase() !== "GET") {
-      logger.info(`Skipping write operation ${tool.alias} in read-only mode`);
-      skippedCount++;
-      continue;
+    const method = tool.method.toUpperCase();
+    if (readOnly && method !== "GET") {
+      if (!(method === "POST" && endpointConfig?.readOnly)) {
+        logger.info(`Skipping write operation ${tool.alias} in read-only mode`);
+        skippedCount++;
+        continue;
+      }
     }
     if (enabledToolsRegex && !enabledToolsRegex.test(tool.alias)) {
       logger.info(`Skipping tool ${tool.alias} - doesn't match filter pattern`);
@@ -464,8 +467,11 @@ function buildToolsRegistry(readOnly, orgMode) {
     if (!orgMode && endpointConfig && !endpointConfig.scopes && endpointConfig.workScopes) {
       continue;
     }
-    if (readOnly && tool.method.toUpperCase() !== "GET") {
-      continue;
+    const method = tool.method.toUpperCase();
+    if (readOnly && method !== "GET") {
+      if (!(method === "POST" && endpointConfig?.readOnly)) {
+        continue;
+      }
     }
     toolsMap.set(tool.alias, { tool, config: endpointConfig });
   }

package/dist/mcp-instructions.js

@@ -0,0 +1,25 @@
+function buildGeneralMcpInstructions(opts) {
+  const parts = [
+    "Microsoft 365 MCP exposes Microsoft Graph through MCP tools. Use each tool name, description, and parameter schema as the source of truth.",
+    "Microsoft Graph OData: do not combine $filter with $search on the same request. For lists, prefer modest $top (or top) and $select; avoid very large pages unless the user needs them.",
+    "Mail and message $search uses KQL; the $search query parameter value must be double-quoted per Graph (see search-query-parameter in Microsoft Graph docs).",
+    "When you need an organizational user or recipient address, resolve it with list-users (or another directory tool); do not invent SMTP addresses.",
+    "Directory $search on collections such as /users or /groups requires ConsistencyLevel: eventual when the tool exposes that header.",
+    "Teams chat and channel messages: prefer HTML contentType in the body; plain text is often mangled by Graph."
+  ];
+  if (opts.readOnly) parts.push("This server is read-only; write operations are disabled.");
+  if (opts.multiAccount)
+    parts.push("Multiple accounts: pass the account parameter when required (see list-accounts).");
+  if (!opts.orgMode)
+    parts.push("Work/school-only tools require starting the server with --org-mode.");
+  return parts.join(" ");
+}
+const DISCOVERY_MODE_INSTRUCTIONS_ADDON = "DISCOVERY MODE ADD-ON: Graph is reached via search-tools then execute-tool (plus auth helpers). Call search-tools with short keywords, then execute-tool with tool_name exactly as returned; put Graph parameters in the parameters object. If search-tools returns no matches, retry with shorter or different keywords.";
+function buildMcpServerInstructions(opts) {
+  const general = buildGeneralMcpInstructions(opts);
+  if (!opts.discovery) return general;
+  return `${general} ${DISCOVERY_MODE_INSTRUCTIONS_ADDON}`;
+}
+export {
+  buildMcpServerInstructions
+};

package/dist/server.js

@@ -6,6 +6,7 @@ import express from "express";
 import logger, { enableConsoleLogging } from "./logger.js";
 import { registerAuthTools } from "./auth-tools.js";
 import { registerGraphTools, registerDiscoveryTools } from "./graph-tools.js";
+import { buildMcpServerInstructions } from "./mcp-instructions.js";
 import GraphClient from "./graph-client.js";
 import { buildScopesFromEndpoints } from "./auth.js";
 import { MicrosoftOAuthProvider } from "./oauth-provider.js";
@@ -46,10 +47,20 @@ class MicrosoftGraphServer {
     this.secrets = null;
   }
   createMcpServer() {
-    const server = new McpServer({
-      name: "Microsoft365MCP",
-      version: this.version
-    });
+    const server = new McpServer(
+      {
+        name: "Microsoft365MCP",
+        version: this.version
+      },
+      {
+        instructions: buildMcpServerInstructions({
+          discovery: Boolean(this.options.discovery),
+          orgMode: Boolean(this.options.orgMode),
+          readOnly: Boolean(this.options.readOnly),
+          multiAccount: this.multiAccount
+        })
+      }
+    );
     const shouldRegisterAuthTools = !this.options.http || this.options.enableAuthTools;
     if (shouldRegisterAuthTools) {
       registerAuthTools(server, this.authManager);

package/logs/mcp-server.log

@@ -1,10 +1,11 @@
-2026-04-14 20:25:35 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-14 20:25:35 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-14 20:25:35 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-14 20:25:35 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
-2026-04-14 20:25:35 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
-2026-04-14 20:25:37 INFO: Using environment variables for secrets
-2026-04-14 20:25:37 INFO: Using environment variables for secrets
-2026-04-14 20:25:37 INFO: Using environment variables for secrets
-2026-04-14 20:25:37 INFO: Using environment variables for secrets
-2026-04-14 20:25:37 INFO: Using environment variables for secrets
+2026-04-14 21:28:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-14 21:28:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-14 21:28:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-14 21:28:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
+2026-04-14 21:28:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
+2026-04-14 21:28:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/photo/$value
+2026-04-14 21:28:27 INFO: Using environment variables for secrets
+2026-04-14 21:28:27 INFO: Using environment variables for secrets
+2026-04-14 21:28:27 INFO: Using environment variables for secrets
+2026-04-14 21:28:27 INFO: Using environment variables for secrets
+2026-04-14 21:28:27 INFO: Using environment variables for secrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.77.0",
+  "version": "0.79.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -352,6 +352,7 @@
     "pathPattern": "/me/calendar/getSchedule",
     "method": "post",
     "toolName": "get-schedule",
+    "readOnly": true,
     "workScopes": ["Calendars.Read"]
   },
   {
@@ -407,6 +408,7 @@
     "pathPattern": "/me/findMeetingTimes",
     "method": "post",
     "toolName": "find-meeting-times",
+    "readOnly": true,
     "workScopes": ["Calendars.Read.Shared"]
   },
   {
@@ -944,6 +946,21 @@
     "toolName": "get-chat-message",
     "workScopes": ["ChatMessage.Read"]
   },
+  {
+    "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}/hostedContents",
+    "method": "get",
+    "toolName": "list-chat-message-hosted-contents",
+    "workScopes": ["ChatMessage.Read"],
+    "llmTip": "Lists hosted-content references (inline images, code snippets) attached to a Teams chat message. Returns an array of { id, contentType }. Use get-chat-message-hosted-content with the id to download the bytes. Hosted content IDs can also be parsed from the <img src> URL in the message body between /hostedContents/ and /$value."
+  },
+  {
+    "pathPattern": "/chats/{chat-id}/messages/{chatMessage-id}/hostedContents/{chatMessageHostedContent-id}/$value",
+    "method": "get",
+    "toolName": "get-chat-message-hosted-content",
+    "workScopes": ["ChatMessage.Read"],
+    "returnDownloadUrl": true,
+    "llmTip": "Returns raw bytes of a hosted content item (typically image/png or image/jpeg) attached to a Teams 1:1 or group chat message. Use list-chat-message-hosted-contents to discover IDs, or extract the ID from the <img src> URL in the message body."
+  },
   {
     "pathPattern": "/chats/{chat-id}/messages",
     "method": "post",
@@ -1005,6 +1022,21 @@
     "toolName": "get-channel-message",
     "workScopes": ["ChannelMessage.Read.All"]
   },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents",
+    "method": "get",
+    "toolName": "list-channel-message-hosted-contents",
+    "workScopes": ["ChannelMessage.Read.All"],
+    "llmTip": "Lists hosted-content references (inline images, code snippets) attached to a Teams channel message. Returns an array of { id, contentType }. Use get-channel-message-hosted-content with the id to download bytes."
+  },
+  {
+    "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages/{chatMessage-id}/hostedContents/{chatMessageHostedContent-id}/$value",
+    "method": "get",
+    "toolName": "get-channel-message-hosted-content",
+    "workScopes": ["ChannelMessage.Read.All"],
+    "returnDownloadUrl": true,
+    "llmTip": "Returns raw bytes of a hosted content item attached to a Teams channel message. Use list-channel-message-hosted-contents to discover IDs."
+  },
   {
     "pathPattern": "/teams/{team-id}/channels/{channel-id}/messages",
     "method": "post",