@softeria/ms-365-mcp-server 0.88.2 → 0.90.0

package/dist/endpoints.json

@@ -500,6 +500,27 @@
     "scopes": ["Files.ReadWrite"],
     "llmTip": "Shares a file or folder with specific users. Body: { recipients: [{ email: 'user@example.com' }], roles: ['read'], sendInvitation: true, message: 'Please review this file.' }. Roles: 'read', 'write', 'owner'. Set requireSignIn to true to require authentication."
   },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/createLink",
+    "method": "post",
+    "toolName": "create-drive-item-share-link",
+    "scopes": ["Files.ReadWrite"],
+    "llmTip": "Create a shareable link for a file or folder WITHOUT sending an email invitation. Body: { type: 'view' | 'edit' | 'embed', scope: 'anonymous' | 'organization' | 'users', password?: string, expirationDateTime?: ISO-8601, retainInheritedPermissions?: boolean }. Returns a permission with link.webUrl. Pair with share-drive-item when you want to grant explicit access; use this when you only need a URL to paste into a doc/email/chat without triggering OneDrive notifications."
+  },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/copy",
+    "method": "post",
+    "toolName": "copy-drive-item",
+    "scopes": ["Files.ReadWrite"],
+    "llmTip": "Asynchronously copy a file or folder to a new location and/or name. Body: { parentReference: { driveId: '...', id: '...' }, name?: 'New Name.xlsx' }. Returns 202 Accepted with a Location header pointing at a monitor URL for the async job. Ideal for duplicating templates (e.g. clone an Armhr Census Template per prospect), bulk file provisioning, or preserving an immutable snapshot of a working file."
+  },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/preview",
+    "method": "post",
+    "toolName": "create-drive-item-preview",
+    "scopes": ["Files.Read"],
+    "llmTip": "Generate a short-lived embeddable preview URL for a file (Office docs, PDFs, images). Body: { page?: number | string, zoom?: number, viewer?: 'onedrive' | 'office' }. Returns getUrl (interactive) and postUrl (form-post). Useful for surfacing inline previews in summary emails or chat messages without needing the recipient to open the file."
+  },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/permissions",
     "method": "get",
@@ -1715,5 +1736,26 @@
     "toolName": "reauthorize-subscription",
     "scopes": [],
     "llmTip": "Reauthorizes a subscription after receiving a 'reauthorizationRequired' lifecycle notification from Microsoft Graph. No body required. Must be called within the reauthorizationRequiredDateTime window (typically 48h) to avoid subscription expiry."
+  },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/extractSensitivityLabels",
+    "method": "post",
+    "toolName": "extract-drive-item-sensitivity-labels",
+    "workScopes": ["Files.Read.All"],
+    "llmTip": "Returns the Microsoft Information Protection (MIP) sensitivity labels assigned to a file. No request body. Response: { value: { labels: [{ sensitivityLabelId, assignmentMethod, tenantId }] } }. Use list-sensitivity-labels to map sensitivityLabelId to a human-readable name. Not supported for personal Microsoft accounts. May return 423 Locked if the file is double-key-encrypted or decryption is deferred."
+  },
+  {
+    "pathPattern": "/me/dataSecurityAndGovernance/sensitivityLabels",
+    "method": "get",
+    "toolName": "list-sensitivity-labels",
+    "workScopes": ["SensitivityLabel.Read"],
+    "llmTip": "Lists Microsoft Information Protection (MIP) sensitivity labels available to the signed-in user. Use to map label IDs (returned by extract-drive-item-sensitivity-labels) to human-readable names. Not supported for personal Microsoft accounts."
+  },
+  {
+    "pathPattern": "/me/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}",
+    "method": "get",
+    "toolName": "get-sensitivity-label",
+    "workScopes": ["SensitivityLabel.Read"],
+    "llmTip": "Gets a single MIP sensitivity label by id. Use list-sensitivity-labels to find ids. Not supported for personal Microsoft accounts."
   }
 ]

package/dist/generated/client.js

@@ -763,30 +763,24 @@ const microsoft_graph_driveItemCollectionResponse = z.object({
   "@odata.nextLink": z.string().nullable(),
   value: z.array(microsoft_graph_driveItem)
 }).partial().passthrough();
-const create_upload_session_Body = z.object({ item: z.object({}).partial().passthrough() }).partial().passthrough();
-const microsoft_graph_uploadSession = z.object({
+const copy_drive_item_Body = z.object({
+  name: z.string().nullable(),
+  parentReference: z.union([microsoft_graph_itemReference, z.object({}).partial().passthrough()]),
+  childrenOnly: z.boolean().nullable().default(false),
+  includeAllVersionHistory: z.boolean().nullable().default(false)
+}).partial().passthrough();
+const create_drive_item_share_link_Body = z.object({
+  type: z.string().nullable(),
+  scope: z.string().nullable(),
   expirationDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
-  ).datetime({ offset: true }).describe(
-    "The date and time in UTC that the upload session expires. The complete file must be uploaded before this expiration time is reached. Each fragment uploaded during the session extends the expiration time."
-  ).nullish(),
-  nextExpectedRanges: z.array(z.string().nullable()).describe(
-    "A collection of byte ranges that the server is missing for the file. These ranges are zero indexed and of the format 'start-end' (for example '0-26' to indicate the first 27 bytes of the file). When uploading files as Outlook attachments, instead of a collection of ranges, this property always indicates a single value '{start}', the location in the file where the next upload should begin."
-  ).optional(),
-  uploadUrl: z.string().describe("The URL endpoint that accepts PUT requests for byte ranges of the file.").nullish()
-}).passthrough();
-const BaseDeltaFunctionResponse = z.object({ "@odata.nextLink": z.string().nullable(), "@odata.deltaLink": z.string().nullable() }).partial().passthrough();
-const share_drive_item_Body = z.object({
-  requireSignIn: z.boolean().nullable().default(false),
-  roles: z.array(z.string().nullable()),
-  sendInvitation: z.boolean().nullable().default(false),
+  ).datetime({ offset: true }).nullable(),
+  password: z.string().nullable(),
   message: z.string().nullable(),
   recipients: z.array(z.object({}).partial().passthrough()),
   retainInheritedPermissions: z.boolean().nullable().default(false),
-  expirationDateTime: z.string().nullable(),
-  password: z.string().nullable()
+  sendNotification: z.boolean().nullable().default(false)
 }).partial().passthrough();
-const BaseCollectionPaginationCountResponse = z.object({ "@odata.count": z.number().int().nullable(), "@odata.nextLink": z.string().nullable() }).partial().passthrough();
 const microsoft_graph_sharePointGroupIdentity = z.object({
   displayName: z.string().describe(
     "The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta."
@@ -867,6 +861,56 @@ const microsoft_graph_permission = z.object({
     "A unique token that can be used to access this shared item via the shares API. Read-only."
   ).nullish()
 }).passthrough();
+const create_upload_session_Body = z.object({ item: z.object({}).partial().passthrough() }).partial().passthrough();
+const microsoft_graph_uploadSession = z.object({
+  expirationDateTime: z.string().regex(
+    /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
+  ).datetime({ offset: true }).describe(
+    "The date and time in UTC that the upload session expires. The complete file must be uploaded before this expiration time is reached. Each fragment uploaded during the session extends the expiration time."
+  ).nullish(),
+  nextExpectedRanges: z.array(z.string().nullable()).describe(
+    "A collection of byte ranges that the server is missing for the file. These ranges are zero indexed and of the format 'start-end' (for example '0-26' to indicate the first 27 bytes of the file). When uploading files as Outlook attachments, instead of a collection of ranges, this property always indicates a single value '{start}', the location in the file where the next upload should begin."
+  ).optional(),
+  uploadUrl: z.string().describe("The URL endpoint that accepts PUT requests for byte ranges of the file.").nullish()
+}).passthrough();
+const BaseDeltaFunctionResponse = z.object({ "@odata.nextLink": z.string().nullable(), "@odata.deltaLink": z.string().nullable() }).partial().passthrough();
+const microsoft_graph_sensitivityLabelAssignmentMethod = z.enum([
+  "standard",
+  "privileged",
+  "auto",
+  "unknownFutureValue"
+]);
+const microsoft_graph_sensitivityLabelAssignment = z.object({
+  assignmentMethod: microsoft_graph_sensitivityLabelAssignmentMethod.optional(),
+  sensitivityLabelId: z.string().describe("The unique identifier for the sensitivity label assigned to the file.").optional(),
+  tenantId: z.string().describe(
+    "The unique identifier for the tenant that hosts the file when this label is applied."
+  ).optional()
+}).passthrough();
+const microsoft_graph_extractSensitivityLabelsResult = z.object({
+  labels: z.array(microsoft_graph_sensitivityLabelAssignment).describe("List of sensitivity labels assigned to a file.").optional()
+}).passthrough();
+const share_drive_item_Body = z.object({
+  requireSignIn: z.boolean().nullable().default(false),
+  roles: z.array(z.string().nullable()),
+  sendInvitation: z.boolean().nullable().default(false),
+  message: z.string().nullable(),
+  recipients: z.array(z.object({}).partial().passthrough()),
+  retainInheritedPermissions: z.boolean().nullable().default(false),
+  expirationDateTime: z.string().nullable(),
+  password: z.string().nullable()
+}).partial().passthrough();
+const BaseCollectionPaginationCountResponse = z.object({ "@odata.count": z.number().int().nullable(), "@odata.nextLink": z.string().nullable() }).partial().passthrough();
+const ReferenceNumeric = z.enum(["-INF", "INF", "NaN"]);
+const create_drive_item_preview_Body = z.object({
+  page: z.string().nullable(),
+  zoom: z.union([z.number(), z.string(), ReferenceNumeric])
+}).partial().passthrough();
+const microsoft_graph_itemPreviewInfo = z.object({
+  getUrl: z.string().nullish(),
+  postParameters: z.string().nullish(),
+  postUrl: z.string().nullish()
+}).passthrough();
 const microsoft_graph_permissionCollectionResponse = z.object({
   "@odata.count": z.number().int().nullable(),
   "@odata.nextLink": z.string().nullable(),
@@ -1975,6 +2019,67 @@ const microsoft_graph_contactCollectionResponse = z.object({
   "@odata.nextLink": z.string().nullable(),
   value: z.array(microsoft_graph_contact)
 }).partial().passthrough();
+const microsoft_graph_labelActionSource = z.enum([
+  "manual",
+  "automatic",
+  "recommended",
+  "none",
+  "unknownFutureValue"
+]);
+const microsoft_graph_usageRights = z.enum([
+  "unknown",
+  "docEdit",
+  "edit",
+  "comment",
+  "export",
+  "forward",
+  "owner",
+  "print",
+  "reply",
+  "replyAll",
+  "view",
+  "extract",
+  "viewRightsData",
+  "editRightsData",
+  "objModel",
+  "accessDenied",
+  "userDefinedProtectionTypeNotSupportedException",
+  "encryptedProtectionTypeNotSupportedException",
+  "purviewClaimsChallengeNotSupportedException",
+  "exception",
+  "labelNotFoundException",
+  "unknownFutureValue"
+]);
+const microsoft_graph_usageRightsIncluded = z.object({
+  id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
+  ownerEmail: z.string().describe("The email of owner label rights.").nullish(),
+  userEmail: z.string().describe("The email of user with label user rights.").nullish(),
+  value: microsoft_graph_usageRights.optional()
+}).passthrough();
+const microsoft_graph_sensitivityLabel = z.lazy(
+  () => z.object({
+    id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
+    actionSource: microsoft_graph_labelActionSource.optional(),
+    autoTooltip: z.string().nullish(),
+    description: z.string().nullish(),
+    displayName: z.string().nullish(),
+    hasProtection: z.boolean().nullish(),
+    isDefault: z.boolean().nullish(),
+    isEndpointProtectionEnabled: z.boolean().nullish(),
+    isScopedToUser: z.boolean().nullish(),
+    locale: z.string().nullish(),
+    name: z.string().nullish(),
+    priority: z.number().gte(-2147483648).lte(2147483647).nullish(),
+    toolTip: z.string().nullish(),
+    rights: microsoft_graph_usageRightsIncluded.optional(),
+    sublabels: z.array(microsoft_graph_sensitivityLabel).optional()
+  }).passthrough()
+);
+const microsoft_graph_sensitivityLabelCollectionResponse = z.object({
+  "@odata.count": z.number().int().nullable(),
+  "@odata.nextLink": z.string().nullable(),
+  value: z.array(microsoft_graph_sensitivityLabel)
+}).partial().passthrough();
 const microsoft_graph_storagePlanInformation = z.object({
   upgradeAvailable: z.boolean().describe("Indicates whether there are higher storage quota plans available. Read-only.").nullish()
 }).passthrough();
@@ -3004,7 +3109,6 @@ const microsoft_graph_timeConstraint = z.object({
   activityDomain: microsoft_graph_activityDomain.optional(),
   timeSlots: z.array(microsoft_graph_timeSlot).optional()
 }).passthrough();
-const ReferenceNumeric = z.enum(["-INF", "INF", "NaN"]);
 const find_meeting_times_Body = z.object({
   attendees: z.array(microsoft_graph_attendeeBase),
   locationConstraint: z.union([
@@ -4401,17 +4505,25 @@ const schemas = {
   microsoft_graph_pendingOperations,
   microsoft_graph_driveItem,
   microsoft_graph_driveItemCollectionResponse,
-  create_upload_session_Body,
-  microsoft_graph_uploadSession,
-  BaseDeltaFunctionResponse,
-  share_drive_item_Body,
-  BaseCollectionPaginationCountResponse,
+  copy_drive_item_Body,
+  create_drive_item_share_link_Body,
   microsoft_graph_sharePointGroupIdentity,
   microsoft_graph_sharePointIdentity,
   microsoft_graph_sharePointIdentitySet,
   microsoft_graph_sharingInvitation,
   microsoft_graph_sharingLink,
   microsoft_graph_permission,
+  create_upload_session_Body,
+  microsoft_graph_uploadSession,
+  BaseDeltaFunctionResponse,
+  microsoft_graph_sensitivityLabelAssignmentMethod,
+  microsoft_graph_sensitivityLabelAssignment,
+  microsoft_graph_extractSensitivityLabelsResult,
+  share_drive_item_Body,
+  BaseCollectionPaginationCountResponse,
+  ReferenceNumeric,
+  create_drive_item_preview_Body,
+  microsoft_graph_itemPreviewInfo,
   microsoft_graph_permissionCollectionResponse,
   microsoft_graph_publicationFacet,
   microsoft_graph_driveItemVersion,
@@ -4520,6 +4632,11 @@ const schemas = {
   microsoft_graph_chatCollectionResponse,
   microsoft_graph_contact,
   microsoft_graph_contactCollectionResponse,
+  microsoft_graph_labelActionSource,
+  microsoft_graph_usageRights,
+  microsoft_graph_usageRightsIncluded,
+  microsoft_graph_sensitivityLabel,
+  microsoft_graph_sensitivityLabelCollectionResponse,
   microsoft_graph_storagePlanInformation,
   microsoft_graph_quota,
   microsoft_graph_systemFacet,
@@ -4620,7 +4737,6 @@ const schemas = {
   microsoft_graph_locationConstraint,
   microsoft_graph_activityDomain,
   microsoft_graph_timeConstraint,
-  ReferenceNumeric,
   find_meeting_times_Body,
   send_mail_Body,
   microsoft_graph_externalLink,
@@ -5402,6 +5518,39 @@ const endpoints = makeApi([
     ],
     response: z.void()
   },
+  {
+    method: "post",
+    path: "/drives/:driveId/items/:driveItemId/copy",
+    alias: "copy-drive-item",
+    description: `Invoke action copy`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `Action parameters`,
+        type: "Body",
+        schema: copy_drive_item_Body
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "post",
+    path: "/drives/:driveId/items/:driveItemId/createLink",
+    alias: "create-drive-item-share-link",
+    description: `Create a link to share a driveItem driveItem. The createLink action creates a new sharing link if the specified link type doesn't already exist for the calling application.
+If a sharing link of the specified type already exists for the app, the existing sharing link is returned. DriveItem resources inherit sharing permissions from their ancestors.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `Action parameters`,
+        type: "Body",
+        schema: create_drive_item_share_link_Body
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "post",
     path: "/drives/:driveId/items/:driveItemId/createUploadSession",
@@ -5472,6 +5621,14 @@ Items with this property set should be removed from your local state.`,
     ],
     response: z.void()
   },
+  {
+    method: "post",
+    path: "/drives/:driveId/items/:driveItemId/extractSensitivityLabels",
+    alias: "extract-drive-item-sensitivity-labels",
+    description: `Invoke action extractSensitivityLabels`,
+    requestFormat: "json",
+    response: z.void()
+  },
   {
     method: "post",
     path: "/drives/:driveId/items/:driveItemId/invite",
@@ -5553,6 +5710,22 @@ Items with this property set should be removed from your local state.`,
     ],
     response: z.void()
   },
+  {
+    method: "post",
+    path: "/drives/:driveId/items/:driveItemId/preview",
+    alias: "create-drive-item-preview",
+    description: `Invoke action preview`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `Action parameters`,
+        type: "Body",
+        schema: create_drive_item_preview_Body
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/drives/:driveId/items/:driveItemId/versions",
@@ -7571,6 +7744,76 @@ or from some other calendar of the user.`,
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/me/dataSecurityAndGovernance/sensitivityLabels",
+    alias: "list-sensitivity-labels",
+    description: `Get sensitivityLabels from me`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "get",
+    path: "/me/dataSecurityAndGovernance/sensitivityLabels/:sensitivityLabelId",
+    alias: "get-sensitivity-label",
+    description: `Get sensitivityLabels from me`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/me/directReports",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.88.2",
+  "version": "0.90.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -500,6 +500,27 @@
     "scopes": ["Files.ReadWrite"],
     "llmTip": "Shares a file or folder with specific users. Body: { recipients: [{ email: 'user@example.com' }], roles: ['read'], sendInvitation: true, message: 'Please review this file.' }. Roles: 'read', 'write', 'owner'. Set requireSignIn to true to require authentication."
   },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/createLink",
+    "method": "post",
+    "toolName": "create-drive-item-share-link",
+    "scopes": ["Files.ReadWrite"],
+    "llmTip": "Create a shareable link for a file or folder WITHOUT sending an email invitation. Body: { type: 'view' | 'edit' | 'embed', scope: 'anonymous' | 'organization' | 'users', password?: string, expirationDateTime?: ISO-8601, retainInheritedPermissions?: boolean }. Returns a permission with link.webUrl. Pair with share-drive-item when you want to grant explicit access; use this when you only need a URL to paste into a doc/email/chat without triggering OneDrive notifications."
+  },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/copy",
+    "method": "post",
+    "toolName": "copy-drive-item",
+    "scopes": ["Files.ReadWrite"],
+    "llmTip": "Asynchronously copy a file or folder to a new location and/or name. Body: { parentReference: { driveId: '...', id: '...' }, name?: 'New Name.xlsx' }. Returns 202 Accepted with a Location header pointing at a monitor URL for the async job. Ideal for duplicating templates (e.g. clone an Armhr Census Template per prospect), bulk file provisioning, or preserving an immutable snapshot of a working file."
+  },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/preview",
+    "method": "post",
+    "toolName": "create-drive-item-preview",
+    "scopes": ["Files.Read"],
+    "llmTip": "Generate a short-lived embeddable preview URL for a file (Office docs, PDFs, images). Body: { page?: number | string, zoom?: number, viewer?: 'onedrive' | 'office' }. Returns getUrl (interactive) and postUrl (form-post). Useful for surfacing inline previews in summary emails or chat messages without needing the recipient to open the file."
+  },
   {
     "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/permissions",
     "method": "get",
@@ -1715,5 +1736,26 @@
     "toolName": "reauthorize-subscription",
     "scopes": [],
     "llmTip": "Reauthorizes a subscription after receiving a 'reauthorizationRequired' lifecycle notification from Microsoft Graph. No body required. Must be called within the reauthorizationRequiredDateTime window (typically 48h) to avoid subscription expiry."
+  },
+  {
+    "pathPattern": "/drives/{drive-id}/items/{driveItem-id}/extractSensitivityLabels",
+    "method": "post",
+    "toolName": "extract-drive-item-sensitivity-labels",
+    "workScopes": ["Files.Read.All"],
+    "llmTip": "Returns the Microsoft Information Protection (MIP) sensitivity labels assigned to a file. No request body. Response: { value: { labels: [{ sensitivityLabelId, assignmentMethod, tenantId }] } }. Use list-sensitivity-labels to map sensitivityLabelId to a human-readable name. Not supported for personal Microsoft accounts. May return 423 Locked if the file is double-key-encrypted or decryption is deferred."
+  },
+  {
+    "pathPattern": "/me/dataSecurityAndGovernance/sensitivityLabels",
+    "method": "get",
+    "toolName": "list-sensitivity-labels",
+    "workScopes": ["SensitivityLabel.Read"],
+    "llmTip": "Lists Microsoft Information Protection (MIP) sensitivity labels available to the signed-in user. Use to map label IDs (returned by extract-drive-item-sensitivity-labels) to human-readable names. Not supported for personal Microsoft accounts."
+  },
+  {
+    "pathPattern": "/me/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}",
+    "method": "get",
+    "toolName": "get-sensitivity-label",
+    "workScopes": ["SensitivityLabel.Read"],
+    "llmTip": "Gets a single MIP sensitivity label by id. Use list-sensitivity-labels to find ids. Not supported for personal Microsoft accounts."
   }
 ]