@softeria/ms-365-mcp-server 0.79.6 → 0.80.0

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import { readFileSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
@@ -33,8 +33,13 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
   "--auth-browser",
   "Use browser-based interactive OAuth flow instead of device code for stdio mode. Opens system browser with localhost callback for seamless sign-in."
 ).option(
-  "--base-url <url>",
-  "Public base URL for OAuth metadata when running behind a reverse proxy (e.g. https://mcp.example.com)"
+  "--public-url <url>",
+  "Public base URL (e.g. https://mcp.example.com) used in browser-facing OAuth redirects when running behind a reverse proxy. Server-to-server endpoints (token, register) stay on the request host."
+).addOption(
+  // DEPRECATED: kept only so existing deployments that set --base-url or
+  // MS365_MCP_BASE_URL do not crash at startup. Use --public-url /
+  // MS365_MCP_PUBLIC_URL instead. Hidden from --help; undocumented.
+  new Option("--base-url <url>", "deprecated: use --public-url").hideHelp()
 );
 function parseArgs() {
   program.parse();

package/dist/server.js

@@ -147,14 +147,17 @@ class MicrosoftGraphServer {
         next();
       });
       const oauthProvider = new MicrosoftOAuthProvider(this.authManager, this.secrets);
+      const publicUrlRaw = this.options.publicUrl || process.env.MS365_MCP_PUBLIC_URL || this.options.baseUrl || process.env.MS365_MCP_BASE_URL || null;
+      const publicBase = publicUrlRaw ? new URL(publicUrlRaw).href.replace(/\/$/, "") : null;
       app.get("/.well-known/oauth-authorization-server", async (req, res) => {
         const protocol = req.secure ? "https" : "http";
-        const url = new URL(`${protocol}://${req.get("host")}`);
+        const requestOrigin = `${protocol}://${req.get("host")}`;
+        const browserBase = publicBase ?? requestOrigin;
         const scopes = buildScopesFromEndpoints(this.options.orgMode, this.options.enabledTools);
         const metadata = {
-          issuer: url.origin,
-          authorization_endpoint: `${url.origin}/authorize`,
-          token_endpoint: `${url.origin}/token`,
+          issuer: browserBase,
+          authorization_endpoint: `${browserBase}/authorize`,
+          token_endpoint: `${requestOrigin}/token`,
           response_types_supported: ["code"],
           response_modes_supported: ["query"],
           grant_types_supported: ["authorization_code", "refresh_token"],
@@ -163,20 +166,21 @@ class MicrosoftGraphServer {
           scopes_supported: scopes
         };
         if (this.options.enableDynamicRegistration) {
-          metadata.registration_endpoint = `${url.origin}/register`;
+          metadata.registration_endpoint = `${requestOrigin}/register`;
         }
         res.json(metadata);
       });
       app.get("/.well-known/oauth-protected-resource", async (req, res) => {
         const protocol = req.secure ? "https" : "http";
-        const url = new URL(`${protocol}://${req.get("host")}`);
+        const requestOrigin = `${protocol}://${req.get("host")}`;
+        const browserBase = publicBase ?? requestOrigin;
         const scopes = buildScopesFromEndpoints(this.options.orgMode, this.options.enabledTools);
         res.json({
-          resource: `${url.origin}/mcp`,
-          authorization_servers: [url.origin],
+          resource: `${requestOrigin}/mcp`,
+          authorization_servers: [browserBase],
           scopes_supported: scopes,
           bearer_methods_supported: ["header"],
-          resource_documentation: `${url.origin}`
+          resource_documentation: browserBase
         });
       });
       if (this.options.enableDynamicRegistration) {
@@ -362,9 +366,7 @@ class MicrosoftGraphServer {
       app.use(
         mcpAuthRouter({
           provider: oauthProvider,
-          issuerUrl: new URL(
-            this.options.baseUrl || process.env.MS365_MCP_BASE_URL || `http://localhost:${port}`
-          )
+          issuerUrl: new URL(publicBase ?? `http://localhost:${port}`)
         })
       );
       app.get(

package/docs/deployment.md

@@ -42,7 +42,7 @@ For production, use Azure Key Vault instead of environment variables for secrets
 docker run -p 3000:3000 \
   -e MS365_MCP_KEYVAULT_URL=https://your-keyvault.vault.azure.net \
   -e MS365_MCP_ORG_MODE=true \
-  -e MS365_MCP_BASE_URL=https://mcp.example.com \
+  -e MS365_MCP_PUBLIC_URL=https://mcp.example.com \
   ms-365-mcp-server \
   --http 3000 --org-mode
 ```
@@ -72,7 +72,7 @@ docker run -p 3000:3000 \
      --env-vars \
        "MS365_MCP_KEYVAULT_URL=https://your-keyvault.vault.azure.net" \
        "MS365_MCP_ORG_MODE=true" \
-       "MS365_MCP_BASE_URL=https://mcp.example.com" \
+       "MS365_MCP_PUBLIC_URL=https://mcp.example.com" \
      --command "node" "dist/index.js" "--http" "3000" "--org-mode"
    ```
 
@@ -99,7 +99,7 @@ az webapp config appsettings set --name mcp-server --resource-group your-rg \
   --settings \
     MS365_MCP_KEYVAULT_URL="https://your-keyvault.vault.azure.net" \
     MS365_MCP_ORG_MODE="true" \
-    MS365_MCP_BASE_URL="https://mcp-server.azurewebsites.net" \
+    MS365_MCP_PUBLIC_URL="https://mcp-server.azurewebsites.net" \
     WEBSITES_PORT="3000"
 
 az webapp config set --name mcp-server --resource-group your-rg \
@@ -130,17 +130,17 @@ When deploying for an organization, create a dedicated app registration instead
 
 ## Reverse Proxy / Custom Domain
 
-When running behind a reverse proxy or custom domain, set `MS365_MCP_BASE_URL` so OAuth discovery endpoints return the correct public URL:
+When running behind a reverse proxy, set `MS365_MCP_PUBLIC_URL` so that the OAuth authorize URL handed back to the user's browser is resolvable from outside the server's network:
 
 ```bash
 # Via environment variable
-MS365_MCP_BASE_URL=https://mcp.example.com
+MS365_MCP_PUBLIC_URL=https://mcp.example.com
 
 # Or via CLI flag
---base-url https://mcp.example.com
+--public-url https://mcp.example.com
 ```
 
-Without this, `/.well-known/oauth-authorization-server` would advertise `http://localhost:3000` as the authorization endpoint.
+Only browser-facing fields (`issuer`, `authorization_endpoint`, `authorization_servers`) are pinned to this URL. Server-to-server endpoints (`token_endpoint`, `registration_endpoint`, `resource`) stay on the request origin, so clients that reach the server over an internal network (e.g. another container on the same Docker network) don't have to round-trip back through the public URL.
 
 ## Client Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.79.6",
+  "version": "0.80.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",