@softeria/ms-365-mcp-server 0.79.1 → 0.79.3

package/dist/graph-tools.js

@@ -214,7 +214,9 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         let allItems = combinedResponse.value || [];
         let nextLink = combinedResponse["@odata.nextLink"];
         let pageCount = 1;
-        while (nextLink && pageCount < 100) {
+        const maxPages = 100;
+        const maxItems = 1e4;
+        while (nextLink && pageCount < maxPages && allItems.length < maxItems) {
           logger.info(`Fetching page ${pageCount + 1} from: ${nextLink}`);
           const url = new URL(nextLink);
           const nextPath = url.pathname.replace("/v1.0", "");
@@ -236,8 +238,13 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
             break;
           }
         }
-        if (pageCount >= 100) {
-          logger.warn(`Reached maximum page limit (100) for pagination`);
+        if (pageCount >= maxPages) {
+          logger.warn(`Reached maximum page limit (${maxPages}) for pagination`);
+        }
+        if (allItems.length >= maxItems) {
+          logger.warn(
+            `Reached maximum item limit (${maxItems}) for pagination \u2014 truncated at ${allItems.length} items`
+          );
         }
         combinedResponse.value = allItems;
         if (combinedResponse["@odata.count"]) {

package/dist/logger.js

@@ -2,10 +2,11 @@ import winston from "winston";
 import path from "path";
 import { fileURLToPath } from "url";
 import fs from "fs";
+import os from "os";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const logsDir = path.join(__dirname, "..", "logs");
+const logsDir = process.env.MS365_MCP_LOG_DIR || path.join(os.homedir(), ".ms-365-mcp-server", "logs");
 if (!fs.existsSync(logsDir)) {
-  fs.mkdirSync(logsDir);
+  fs.mkdirSync(logsDir, { recursive: true, mode: 448 });
 }
 const logger = winston.createLogger({
   level: process.env.LOG_LEVEL || "info",

package/dist/server.js

@@ -225,18 +225,30 @@ class MicrosoftGraphServer {
         if (clientCodeChallenge && state) {
           const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
           const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+          const now = Date.now();
+          const maxAge = 10 * 60 * 1e3;
+          const maxEntries = 1e3;
+          for (const [key, value] of this.pkceStore) {
+            if (now - value.createdAt > maxAge) {
+              this.pkceStore.delete(key);
+            }
+          }
+          if (this.pkceStore.size >= maxEntries) {
+            logger.warn(
+              `PKCE store at capacity (${maxEntries} entries) \u2014 rejecting new authorization request`
+            );
+            res.status(503).json({
+              error: "server_busy",
+              error_description: "Too many pending authorization requests. Try again later."
+            });
+            return;
+          }
           this.pkceStore.set(state, {
             clientCodeChallenge,
             clientCodeChallengeMethod: clientCodeChallengeMethod || "S256",
             serverCodeVerifier,
             createdAt: Date.now()
           });
-          const now = Date.now();
-          for (const [key, value] of this.pkceStore) {
-            if (now - value.createdAt > 10 * 60 * 1e3) {
-              this.pkceStore.delete(key);
-            }
-          }
           microsoftAuthUrl.searchParams.set("code_challenge", serverCodeChallenge);
           microsoftAuthUrl.searchParams.set("code_challenge_method", "S256");
           logger.info("Two-leg PKCE: stored client challenge, generated server challenge", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.79.1",
+  "version": "0.79.3",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/logs/mcp-server.log

@@ -1,11 +0,0 @@
-2026-04-14 21:33:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-14 21:33:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-14 21:33:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-14 21:33:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
-2026-04-14 21:33:26 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
-2026-04-14 21:33:27 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/photo/$value
-2026-04-14 21:33:28 INFO: Using environment variables for secrets
-2026-04-14 21:33:28 INFO: Using environment variables for secrets
-2026-04-14 21:33:28 INFO: Using environment variables for secrets
-2026-04-14 21:33:28 INFO: Using environment variables for secrets
-2026-04-14 21:33:28 INFO: Using environment variables for secrets