@softeria/ms-365-mcp-server 0.9.13 → 0.10.1

package/.env.example

@@ -0,0 +1,24 @@
+# Microsoft 365 OAuth Configuration
+# Create an Azure AD app registration and get these values:
+
+# Your Azure AD App Registration Client ID
+MS365_MCP_CLIENT_ID=your-azure-ad-app-client-id-here
+
+# Your Azure AD App Registration Client Secret
+MS365_MCP_CLIENT_SECRET=your-azure-ad-app-client-secret-here
+
+# Tenant ID - use "common" for multi-tenant or your specific tenant ID
+MS365_MCP_TENANT_ID=common
+
+# Instructions:
+# 1. Go to https://portal.azure.com
+# 2. Navigate to Azure Active Directory → App registrations → New registration
+# 3. Set name: "MS365 MCP Server"
+# 4. Add these redirect URIs (for MCP Inspector testing):
+#    - http://localhost:6274/oauth/callback
+#    - http://localhost:6274/oauth/callback/debug
+#    - http://localhost:3000/callback (optional, for server callback)
+# 5. Copy the Client ID from Overview page
+# 6. Go to Certificates & secrets → New client secret → Copy the secret value
+# 7. Replace the values above with your actual credentials
+# 8. Rename this file to .env 

package/README.md

@@ -144,6 +144,35 @@ This mode:
 
 MCP clients will automatically handle the OAuth flow when they see the advertised capabilities.
 
+##### Setting up Azure AD for OAuth Testing
+
+To use OAuth mode with custom Azure credentials (recommended for production), you'll need to set up an Azure AD app registration:
+
+1. **Create Azure AD App Registration**:
+   - Go to [Azure Portal](https://portal.azure.com)
+   - Navigate to Azure Active Directory → App registrations → New registration
+   - Set name: "MS365 MCP Server"
+
+2. **Configure Redirect URIs**:
+   Add these redirect URIs for testing with MCP Inspector:
+   - `http://localhost:6274/oauth/callback`
+   - `http://localhost:6274/oauth/callback/debug`
+   - `http://localhost:3000/callback` (optional, for server callback)
+
+3. **Get Credentials**:
+   - Copy the **Application (client) ID** from Overview page
+   - Go to Certificates & secrets → New client secret → Copy the secret value
+
+4. **Configure Environment Variables**:
+   Create a `.env` file in your project root:
+   ```env
+   MS365_MCP_CLIENT_ID=your-azure-ad-app-client-id-here
+   MS365_MCP_CLIENT_SECRET=your-azure-ad-app-client-secret-here
+   MS365_MCP_TENANT_ID=common
+   ```
+
+With these configured, the server will use your custom Azure app instead of the built-in one.
+
 #### 3. Bring Your Own Token (BYOT)
 
 If you are running ms-365-mcp-server as part of a larger system that manages Microsoft OAuth tokens externally, you can provide an access token directly to this MCP server:

package/dist/graph-client.js

@@ -1,9 +1,16 @@
 import logger from './logger.js';
+import { refreshAccessToken } from './lib/microsoft-auth.js';
 class GraphClient {
     constructor(authManager) {
+        this.accessToken = null;
+        this.refreshToken = null;
         this.authManager = authManager;
         this.sessions = new Map();
     }
+    setOAuthTokens(accessToken, refreshToken) {
+        this.accessToken = accessToken;
+        this.refreshToken = refreshToken || null;
+    }
     async createSession(filePath) {
         try {
             if (!filePath) {
@@ -38,7 +45,166 @@ class GraphClient {
             return null;
         }
     }
+    async makeRequest(endpoint, options = {}) {
+        // Use OAuth tokens if available, otherwise fall back to authManager
+        let accessToken = options.accessToken || this.accessToken || await this.authManager.getToken();
+        let refreshToken = options.refreshToken || this.refreshToken;
+        if (!accessToken) {
+            throw new Error('No access token available');
+        }
+        try {
+            const response = await this.performRequest(endpoint, accessToken, options);
+            if (response.status === 401 && refreshToken) {
+                // Token expired, try to refresh
+                await this.refreshAccessToken(refreshToken);
+                // Update token for retry
+                accessToken = this.accessToken || accessToken;
+                if (!accessToken) {
+                    throw new Error('Failed to refresh access token');
+                }
+                // Retry the request with new token
+                return this.performRequest(endpoint, accessToken, options);
+            }
+            if (!response.ok) {
+                throw new Error(`Microsoft Graph API error: ${response.status} ${response.statusText}`);
+            }
+            return response.json();
+        }
+        catch (error) {
+            logger.error('Microsoft Graph API request failed:', error);
+            throw error;
+        }
+    }
+    async refreshAccessToken(refreshToken) {
+        const tenantId = process.env.MS365_MCP_TENANT_ID || 'common';
+        const clientId = process.env.MS365_MCP_CLIENT_ID || '084a3e9f-a9f4-43f7-89f9-d229cf97853e';
+        const clientSecret = process.env.MS365_MCP_CLIENT_SECRET;
+        if (!clientSecret) {
+            throw new Error('MS365_MCP_CLIENT_SECRET not configured');
+        }
+        const response = await refreshAccessToken(refreshToken, clientId, clientSecret, tenantId);
+        this.accessToken = response.access_token;
+        if (response.refresh_token) {
+            this.refreshToken = response.refresh_token;
+        }
+    }
+    async performRequest(endpoint, accessToken, options) {
+        let url;
+        let sessionId = null;
+        if (options.excelFile &&
+            !endpoint.startsWith('/drive') &&
+            !endpoint.startsWith('/users') &&
+            !endpoint.startsWith('/me') &&
+            !endpoint.startsWith('/teams') &&
+            !endpoint.startsWith('/chats') &&
+            !endpoint.startsWith('/planner')) {
+            sessionId = this.sessions.get(options.excelFile) || null;
+            if (!sessionId) {
+                sessionId = await this.createSessionWithToken(options.excelFile, accessToken);
+            }
+            url = `https://graph.microsoft.com/v1.0/me/drive/root:${options.excelFile}:${endpoint}`;
+        }
+        else if (endpoint.startsWith('/drive') ||
+            endpoint.startsWith('/users') ||
+            endpoint.startsWith('/me') ||
+            endpoint.startsWith('/teams') ||
+            endpoint.startsWith('/chats') ||
+            endpoint.startsWith('/planner')) {
+            url = `https://graph.microsoft.com/v1.0${endpoint}`;
+        }
+        else {
+            throw new Error('Excel operation requested without specifying a file');
+        }
+        const headers = {
+            'Authorization': `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+            ...(sessionId && { 'workbook-session-id': sessionId }),
+            ...options.headers,
+        };
+        return fetch(url, {
+            method: options.method || 'GET',
+            headers,
+            body: options.body,
+        });
+    }
     async graphRequest(endpoint, options = {}) {
+        try {
+            logger.info(`Calling ${endpoint} with options: ${JSON.stringify(options)}`);
+            // Use new OAuth-aware request method
+            const result = await this.makeRequest(endpoint, options);
+            return this.formatJsonResponse(result, options.rawResponse);
+        }
+        catch (error) {
+            logger.error(`Error in Graph API request: ${error}`);
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ error: error.message }) }],
+                isError: true,
+            };
+        }
+    }
+    async createSessionWithToken(filePath, accessToken) {
+        try {
+            if (!filePath) {
+                logger.error('No file path provided for Excel session');
+                return null;
+            }
+            if (this.sessions.has(filePath)) {
+                return this.sessions.get(filePath) || null;
+            }
+            logger.info(`Creating new Excel session for file: ${filePath}`);
+            const response = await fetch(`https://graph.microsoft.com/v1.0/me/drive/root:${filePath}:/workbook/createSession`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ persistChanges: true }),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                logger.error(`Failed to create session: ${response.status} - ${errorText}`);
+                return null;
+            }
+            const result = await response.json();
+            logger.info(`Session created successfully for file: ${filePath}`);
+            this.sessions.set(filePath, result.id);
+            return result.id;
+        }
+        catch (error) {
+            logger.error(`Error creating Excel session: ${error}`);
+            return null;
+        }
+    }
+    formatJsonResponse(data, rawResponse = false) {
+        if (rawResponse) {
+            return {
+                content: [{ type: 'text', text: JSON.stringify(data) }],
+            };
+        }
+        if (data === null || data === undefined) {
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ success: true }) }],
+            };
+        }
+        // Remove OData properties
+        const removeODataProps = (obj) => {
+            if (typeof obj === 'object' && obj !== null) {
+                Object.keys(obj).forEach((key) => {
+                    if (key.startsWith('@odata.')) {
+                        delete obj[key];
+                    }
+                    else if (typeof obj[key] === 'object') {
+                        removeODataProps(obj[key]);
+                    }
+                });
+            }
+        };
+        removeODataProps(data);
+        return {
+            content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],
+        };
+    }
+    async graphRequestOld(endpoint, options = {}) {
         try {
             logger.info(`Calling ${endpoint} with options: ${JSON.stringify(options)}`);
             let accessToken = await this.authManager.getToken();

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import 'dotenv/config';
 import { parseArgs } from './cli.js';
 import logger from './logger.js';
 import AuthManager from './auth.js';

package/dist/lib/microsoft-auth.js

@@ -0,0 +1,75 @@
+import logger from '../logger.js';
+/**
+ * Microsoft Bearer Token Auth Middleware validates that the request has a valid Microsoft access token
+ * The token is passed in the Authorization header as a Bearer token
+ */
+export const microsoftBearerTokenAuthMiddleware = (req, res, next) => {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        res.status(401).json({ error: 'Missing or invalid access token' });
+        return;
+    }
+    const accessToken = authHeader.substring(7);
+    // For Microsoft Graph, we don't validate the token here - we'll let the API calls fail if it's invalid
+    // and handle token refresh in the GraphClient
+    // Extract refresh token from a custom header (if provided)
+    const refreshToken = req.headers['x-microsoft-refresh-token'] || '';
+    // Store tokens in request for later use
+    req.microsoftAuth = {
+        accessToken,
+        refreshToken,
+    };
+    next();
+};
+/**
+ * Exchange authorization code for access token
+ */
+export async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, tenantId = 'common', codeVerifier) {
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        client_secret: clientSecret,
+    });
+    // Add code_verifier for PKCE flow
+    if (codeVerifier) {
+        params.append('code_verifier', codeVerifier);
+    }
+    const response = await fetch(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        logger.error(`Failed to exchange code for token: ${error}`);
+        throw new Error(`Failed to exchange code for token: ${error}`);
+    }
+    return response.json();
+}
+/**
+ * Refresh an access token
+ */
+export async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId = 'common') {
+    const response = await fetch(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: clientId,
+            client_secret: clientSecret,
+        })
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        logger.error(`Failed to refresh token: ${error}`);
+        throw new Error(`Failed to refresh token: ${error}`);
+    }
+    return response.json();
+}

package/dist/server.js

@@ -2,13 +2,15 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js';
-import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
 import express from 'express';
+import crypto from 'crypto';
 import logger, { enableConsoleLogging } from './logger.js';
 import { registerAuthTools } from './auth-tools.js';
 import { registerGraphTools } from './graph-tools.js';
 import GraphClient from './graph-client.js';
 import { MicrosoftOAuthProvider } from './oauth-provider.js';
+import { microsoftBearerTokenAuthMiddleware, exchangeCodeForToken, refreshAccessToken } from './lib/microsoft-auth.js';
+const registeredClients = new Map();
 class MicrosoftGraphServer {
     constructor(authManager, options = {}) {
         this.authManager = authManager;
@@ -32,6 +34,13 @@ class MicrosoftGraphServer {
             enableConsoleLogging();
         }
         logger.info('Microsoft 365 MCP Server starting...');
+        // Debug: Check if environment variables are loaded
+        logger.info('Environment Variables Check:', {
+            CLIENT_ID: process.env.MS365_MCP_CLIENT_ID ? `${process.env.MS365_MCP_CLIENT_ID.substring(0, 8)}...` : 'NOT SET',
+            CLIENT_SECRET: process.env.MS365_MCP_CLIENT_SECRET ? `${process.env.MS365_MCP_CLIENT_SECRET.substring(0, 8)}...` : 'NOT SET',
+            TENANT_ID: process.env.MS365_MCP_TENANT_ID || 'NOT SET',
+            NODE_ENV: process.env.NODE_ENV || 'NOT SET'
+        });
         if (this.options.readOnly) {
             logger.info('Server running in READ-ONLY mode. Write operations are disabled.');
         }
@@ -39,18 +48,191 @@ class MicrosoftGraphServer {
             const port = typeof this.options.http === 'string' ? parseInt(this.options.http) : 3000;
             const app = express();
             app.use(express.json());
+            app.use(express.urlencoded({ extended: true }));
+            // Add CORS headers for all routes
+            app.use((req, res, next) => {
+                res.header('Access-Control-Allow-Origin', '*');
+                res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization, mcp-protocol-version');
+                // Handle preflight requests
+                if (req.method === 'OPTIONS') {
+                    res.sendStatus(200);
+                    return;
+                }
+                next();
+            });
             const oauthProvider = new MicrosoftOAuthProvider(this.authManager);
+            // OAuth Authorization Server Discovery
+            app.get('/.well-known/oauth-authorization-server', async (req, res) => {
+                const url = new URL(`${req.protocol}://${req.get('host')}`);
+                res.json({
+                    issuer: url.origin,
+                    authorization_endpoint: `${url.origin}/authorize`,
+                    token_endpoint: `${url.origin}/token`,
+                    registration_endpoint: `${url.origin}/register`,
+                    response_types_supported: ['code'],
+                    response_modes_supported: ['query'],
+                    grant_types_supported: ['authorization_code', 'refresh_token'],
+                    token_endpoint_auth_methods_supported: ['none'],
+                    code_challenge_methods_supported: ['S256'],
+                    scopes_supported: [
+                        'User.Read', 'Files.Read', 'Mail.Read'
+                    ],
+                });
+            });
+            // OAuth Protected Resource Discovery
+            app.get('/.well-known/oauth-protected-resource', async (req, res) => {
+                const url = new URL(`${req.protocol}://${req.get('host')}`);
+                res.json({
+                    resource: `${url.origin}/mcp`,
+                    authorization_servers: [url.origin],
+                    scopes_supported: [
+                        'User.Read', 'Files.Read', 'Mail.Read'
+                    ],
+                    bearer_methods_supported: ['header'],
+                    resource_documentation: `${url.origin}`,
+                });
+            });
+            // Dynamic Client Registration endpoint
+            app.post('/register', async (req, res) => {
+                const body = req.body;
+                // Generate a client ID
+                const clientId = crypto.randomUUID();
+                // Store the client registration
+                registeredClients.set(clientId, {
+                    client_id: clientId,
+                    client_name: body.client_name || 'MCP Client',
+                    redirect_uris: body.redirect_uris || [],
+                    grant_types: body.grant_types || ['authorization_code', 'refresh_token'],
+                    response_types: body.response_types || ['code'],
+                    scope: body.scope,
+                    token_endpoint_auth_method: 'none',
+                    created_at: Date.now()
+                });
+                // Return the client registration response
+                res.status(201).json({
+                    client_id: clientId,
+                    client_name: body.client_name || 'MCP Client',
+                    redirect_uris: body.redirect_uris || [],
+                    grant_types: body.grant_types || ['authorization_code', 'refresh_token'],
+                    response_types: body.response_types || ['code'],
+                    scope: body.scope,
+                    token_endpoint_auth_method: 'none'
+                });
+            });
+            // Authorization endpoint - redirects to Microsoft
+            app.get('/authorize', async (req, res) => {
+                const url = new URL(req.url, `${req.protocol}://${req.get('host')}`);
+                const tenantId = process.env.MS365_MCP_TENANT_ID || 'common';
+                const clientId = process.env.MS365_MCP_CLIENT_ID || '084a3e9f-a9f4-43f7-89f9-d229cf97853e';
+                const microsoftAuthUrl = new URL(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`);
+                // Only forward parameters that Microsoft OAuth 2.0 v2.0 supports
+                const allowedParams = [
+                    'response_type', 'redirect_uri', 'scope', 'state', 'response_mode',
+                    'code_challenge', 'code_challenge_method', 'prompt', 'login_hint', 'domain_hint'
+                ];
+                allowedParams.forEach(param => {
+                    const value = url.searchParams.get(param);
+                    if (value) {
+                        microsoftAuthUrl.searchParams.set(param, value);
+                    }
+                });
+                // Use our Microsoft app's client_id
+                microsoftAuthUrl.searchParams.set('client_id', clientId);
+                // Ensure we have the minimal required scopes if none provided
+                if (!microsoftAuthUrl.searchParams.get('scope')) {
+                    microsoftAuthUrl.searchParams.set('scope', 'User.Read Files.Read Mail.Read');
+                }
+                // Redirect to Microsoft's authorization page
+                res.redirect(microsoftAuthUrl.toString());
+            });
+            // Token exchange endpoint
+            app.post('/token', async (req, res) => {
+                try {
+                    // Comprehensive debugging
+                    logger.info('Token endpoint called', {
+                        method: req.method,
+                        url: req.url,
+                        headers: req.headers,
+                        bodyType: typeof req.body,
+                        body: req.body,
+                        rawBody: JSON.stringify(req.body),
+                        contentType: req.get('Content-Type')
+                    });
+                    const body = req.body;
+                    // Add debugging and validation
+                    if (!body) {
+                        logger.error('Token endpoint: Request body is undefined');
+                        res.status(400).json({
+                            error: 'invalid_request',
+                            error_description: 'Request body is required'
+                        });
+                        return;
+                    }
+                    if (!body.grant_type) {
+                        logger.error('Token endpoint: grant_type is missing', { body });
+                        res.status(400).json({
+                            error: 'invalid_request',
+                            error_description: 'grant_type parameter is required'
+                        });
+                        return;
+                    }
+                    if (body.grant_type === 'authorization_code') {
+                        const tenantId = process.env.MS365_MCP_TENANT_ID || 'common';
+                        const clientId = process.env.MS365_MCP_CLIENT_ID || '084a3e9f-a9f4-43f7-89f9-d229cf97853e';
+                        const clientSecret = process.env.MS365_MCP_CLIENT_SECRET;
+                        if (!clientSecret) {
+                            logger.error('Token endpoint: MS365_MCP_CLIENT_SECRET is not configured');
+                            res.status(500).json({
+                                error: 'server_error',
+                                error_description: 'Server configuration error'
+                            });
+                            return;
+                        }
+                        const result = await exchangeCodeForToken(body.code, body.redirect_uri, clientId, clientSecret, tenantId, body.code_verifier);
+                        res.json(result);
+                    }
+                    else if (body.grant_type === 'refresh_token') {
+                        const tenantId = process.env.MS365_MCP_TENANT_ID || 'common';
+                        const clientId = process.env.MS365_MCP_CLIENT_ID || '084a3e9f-a9f4-43f7-89f9-d229cf97853e';
+                        const clientSecret = process.env.MS365_MCP_CLIENT_SECRET;
+                        if (!clientSecret) {
+                            logger.error('Token endpoint: MS365_MCP_CLIENT_SECRET is not configured');
+                            res.status(500).json({
+                                error: 'server_error',
+                                error_description: 'Server configuration error'
+                            });
+                            return;
+                        }
+                        const result = await refreshAccessToken(body.refresh_token, clientId, clientSecret, tenantId);
+                        res.json(result);
+                    }
+                    else {
+                        res.status(400).json({
+                            error: 'unsupported_grant_type',
+                            error_description: `Grant type '${body.grant_type}' is not supported`
+                        });
+                    }
+                }
+                catch (error) {
+                    logger.error('Token endpoint error:', error);
+                    res.status(500).json({
+                        error: 'server_error',
+                        error_description: 'Internal server error during token exchange'
+                    });
+                }
+            });
             app.use(mcpAuthRouter({
                 provider: oauthProvider,
                 issuerUrl: new URL(`http://localhost:${port}`),
             }));
-            app.post('/mcp', async (req, res, next) => {
-                if (req.headers.authorization?.startsWith('Bearer ')) {
-                    return requireBearerAuth({ provider: oauthProvider })(req, res, next);
-                }
-                next();
-            }, async (req, res) => {
+            // Microsoft Graph MCP endpoints with bearer token auth
+            app.post('/mcp', microsoftBearerTokenAuthMiddleware, async (req, res) => {
                 try {
+                    // Set OAuth tokens in the GraphClient if available
+                    if (req.microsoftAuth) {
+                        this.graphClient.setOAuthTokens(req.microsoftAuth.accessToken, req.microsoftAuth.refreshToken);
+                    }
                     const transport = new StreamableHTTPServerTransport({
                         sessionIdGenerator: undefined, // Stateless mode
                     });
@@ -74,10 +256,15 @@ class MicrosoftGraphServer {
                     }
                 }
             });
+            // Health check endpoint
+            app.get('/', (req, res) => {
+                res.send('Microsoft 365 MCP Server is running');
+            });
             app.listen(port, () => {
                 logger.info(`Server listening on HTTP port ${port}`);
                 logger.info(`  - MCP endpoint: http://localhost:${port}/mcp`);
                 logger.info(`  - OAuth endpoints: http://localhost:${port}/auth/*`);
+                logger.info(`  - OAuth discovery: http://localhost:${port}/.well-known/oauth-authorization-server`);
             });
         }
         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.9.13",
+  "version": "0.10.1",
   "description": "Microsoft 365 MCP Server",
   "type": "module",
   "main": "dist/index.js",
@@ -12,6 +12,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "dev": "tsx src/index.ts",
+    "dev:http": "tsx --watch src/index.ts --http 3000 -v",
     "format": "prettier --write \"**/*.{ts,mts,js,mjs,json,md}\"",
     "release": "ts-node --esm bin/release.mts",
     "inspect": "npx @modelcontextprotocol/inspector tsx src/index.ts",
@@ -32,6 +33,7 @@
     "@azure/msal-node": "^2.1.0",
     "@modelcontextprotocol/sdk": "^1.8.0",
     "commander": "^11.1.0",
+    "dotenv": "^17.0.1",
     "express": "^5.1.0",
     "js-yaml": "^4.1.0",
     "keytar": "^7.9.0",