@softeria/ms-365-mcp-server 0.92.0 → 0.94.0

package/dist/cli.js

@@ -35,6 +35,9 @@ program.name("ms-365-mcp-server").description("Microsoft 365 MCP Server").versio
 ).option(
   "--public-url <url>",
   "Public base URL (e.g. https://mcp.example.com) used in browser-facing OAuth redirects when running behind a reverse proxy. Server-to-server endpoints (token, register) stay on the request host."
+).option(
+  "--obo",
+  "Enable On-Behalf-Of token exchange in HTTP mode. Exchanges the incoming bearer token for a Graph API token using the OBO flow. Requires MS365_MCP_CLIENT_SECRET."
 ).addOption(
   // DEPRECATED: kept only so existing deployments that set --base-url or
   // MS365_MCP_BASE_URL do not crash at startup. Use --public-url /
@@ -99,6 +102,9 @@ function parseArgs() {
       options.enableDynamicRegistration = true;
     }
   }
+  if (process.env.MS365_MCP_OBO === "true" || process.env.MS365_MCP_OBO === "1") {
+    options.obo = true;
+  }
   if (options.cloud) {
     process.env.MS365_MCP_CLOUD_TYPE = options.cloud;
   }

package/dist/endpoints.json

@@ -235,6 +235,34 @@
     "scopes": ["MailboxSettings.ReadWrite"],
     "llmTip": "Deletes a message rule permanently. Use the Inbox folder ID (get it from list-mail-folders) for inbox rules."
   },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides",
+    "method": "get",
+    "toolName": "list-focused-inbox-overrides",
+    "scopes": ["Mail.Read"],
+    "llmTip": "Lists Focused Inbox classification overrides — explicit rules that force messages from a given sender (by SMTP address) into either the Focused or Other tab, regardless of what the Outlook ML classifier would predict. Each override has id, classifyAs ('focused' or 'other'), and senderEmailAddress {name, address}. Returns an empty collection if the user has never set an override."
+  },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides",
+    "method": "post",
+    "toolName": "create-focused-inbox-override",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "Creates a Focused Inbox override for a sender. Body: { classifyAs: 'focused', senderEmailAddress: { name: 'Display Name', address: 'sender@example.com' } }. classifyAs must be 'focused' or 'other'. If an override already exists for that SMTP address, POST updates the existing override's name and classifyAs (use this to rename a sender). Resolve the sender's address with list-users or by reading a recent mail header — do not invent SMTP addresses."
+  },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides/{inferenceClassificationOverride-id}",
+    "method": "patch",
+    "toolName": "update-focused-inbox-override",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "Updates the classifyAs field of an existing override. Body: { classifyAs: 'focused' } or { classifyAs: 'other' }. Per Graph API, PATCH cannot change senderEmailAddress — to change the SMTP address, delete and recreate the override. To rename the display name only, POST a new override with the same SMTP address (it will overwrite the name)."
+  },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides/{inferenceClassificationOverride-id}",
+    "method": "delete",
+    "toolName": "delete-focused-inbox-override",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "Deletes a Focused Inbox override. Future messages from that sender revert to the Outlook ML classifier's default behavior. Use list-focused-inbox-overrides to find the ID first."
+  },
   {
     "pathPattern": "/me/events",
     "method": "get",

package/dist/generated/client.js

@@ -2585,6 +2585,17 @@ const decline_calendar_event_Body = z.object({
 }).partial().passthrough();
 const forward_calendar_event_Body = z.object({ ToRecipients: z.array(microsoft_graph_recipient), Comment: z.string().nullable() }).partial().passthrough();
 const snooze_calendar_event_reminder_Body = z.object({ NewReminderTime: microsoft_graph_dateTimeTimeZone }).partial().passthrough();
+const microsoft_graph_inferenceClassificationType = z.enum(["focused", "other"]);
+const microsoft_graph_inferenceClassificationOverride = z.object({
+  id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
+  classifyAs: microsoft_graph_inferenceClassificationType.optional(),
+  senderEmailAddress: microsoft_graph_emailAddress.optional()
+}).passthrough();
+const microsoft_graph_inferenceClassificationOverrideCollectionResponse = z.object({
+  "@odata.count": z.number().int().nullable(),
+  "@odata.nextLink": z.string().nullable(),
+  value: z.array(microsoft_graph_inferenceClassificationOverride)
+}).partial().passthrough();
 const microsoft_graph_resourceReference = z.object({
   id: z.string().describe("The item's unique identifier.").nullish(),
   type: z.string().describe(
@@ -2996,7 +3007,6 @@ const microsoft_graph_followupFlag = z.object({
   flagStatus: microsoft_graph_followupFlagStatus.optional(),
   startDateTime: microsoft_graph_dateTimeTimeZone.optional()
 }).passthrough();
-const microsoft_graph_inferenceClassificationType = z.enum(["focused", "other"]);
 const microsoft_graph_internetMessageHeader = z.object({
   name: z.string().describe("Represents the key in a key-value pair.").nullish(),
   value: z.string().describe("The value in a key-value pair.").nullish()
@@ -4749,6 +4759,9 @@ const schemas = {
   decline_calendar_event_Body,
   forward_calendar_event_Body,
   snooze_calendar_event_reminder_Body,
+  microsoft_graph_inferenceClassificationType,
+  microsoft_graph_inferenceClassificationOverride,
+  microsoft_graph_inferenceClassificationOverrideCollectionResponse,
   microsoft_graph_resourceReference,
   microsoft_graph_resourceVisualization,
   microsoft_graph_entity,
@@ -4786,7 +4799,6 @@ const schemas = {
   microsoft_graph_messageRule,
   microsoft_graph_followupFlagStatus,
   microsoft_graph_followupFlag,
-  microsoft_graph_inferenceClassificationType,
   microsoft_graph_internetMessageHeader,
   microsoft_graph_message,
   microsoft_graph_mailFolder,
@@ -8453,6 +8465,105 @@ Based on this value, you can better adjust the parameters and call findMeetingTi
     ],
     response: z.void()
   },
+  {
+    method: "get",
+    path: "/me/inferenceClassification/overrides",
+    alias: "list-focused-inbox-overrides",
+    description: `Get the overrides that a user has set up to always classify messages from certain senders in specific ways. Each override corresponds to an SMTP address of a sender. Initially, a user does not have any overrides.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "$top",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Show only the first n items").optional()
+      },
+      {
+        name: "$skip",
+        type: "Query",
+        schema: z.number().int().gte(0).describe("Skip the first n items").optional()
+      },
+      {
+        name: "$search",
+        type: "Query",
+        schema: z.string().describe("Search items by search phrases").optional()
+      },
+      {
+        name: "$filter",
+        type: "Query",
+        schema: z.string().describe("Filter items by property values").optional()
+      },
+      {
+        name: "$count",
+        type: "Query",
+        schema: z.boolean().describe("Include count of items").optional()
+      },
+      {
+        name: "$orderby",
+        type: "Query",
+        schema: z.array(z.string()).describe("Order items by property values").optional()
+      },
+      {
+        name: "$select",
+        type: "Query",
+        schema: z.array(z.string()).describe("Select properties to be returned").optional()
+      },
+      {
+        name: "$expand",
+        type: "Query",
+        schema: z.array(z.string()).describe("Expand related entities").optional()
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "post",
+    path: "/me/inferenceClassification/overrides",
+    alias: "create-focused-inbox-override",
+    description: `Create an override for a sender identified by an SMTP address. Future messages from that SMTP address will be consistently classified
+as specified in the override. Note`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property`,
+        type: "Body",
+        schema: microsoft_graph_inferenceClassificationOverride
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "patch",
+    path: "/me/inferenceClassification/overrides/:inferenceClassificationOverrideId",
+    alias: "update-focused-inbox-override",
+    description: `Change the classifyAs field of an override as specified. You cannot use PATCH to change any other fields in an inferenceClassificationOverride instance. If an override exists for a sender and the sender changes his/her display name, you can use POST to force an update to the name field in the existing override. If an override exists for a sender and the sender changes his/her SMTP address, deleting the existing override and creating a new one with
+the new SMTP address is the only way to 'update' the override for this sender.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "body",
+        description: `New navigation property values`,
+        type: "Body",
+        schema: microsoft_graph_inferenceClassificationOverride
+      }
+    ],
+    response: z.void()
+  },
+  {
+    method: "delete",
+    path: "/me/inferenceClassification/overrides/:inferenceClassificationOverrideId",
+    alias: "delete-focused-inbox-override",
+    description: `Delete an override specified by its ID.`,
+    requestFormat: "json",
+    parameters: [
+      {
+        name: "If-Match",
+        type: "Header",
+        schema: z.string().describe("ETag").optional()
+      }
+    ],
+    response: z.void()
+  },
   {
     method: "get",
     path: "/me/insights/trending",

package/dist/obo-client.js

@@ -0,0 +1,42 @@
+import { ConfidentialClientApplication } from "@azure/msal-node";
+import logger from "./logger.js";
+import { getCloudEndpoints } from "./cloud-config.js";
+class OboClient {
+  constructor(secrets) {
+    if (!secrets.clientSecret) {
+      throw new Error(
+        "On-Behalf-Of flow requires MS365_MCP_CLIENT_SECRET to be set (confidential client)."
+      );
+    }
+    const cloudEndpoints = getCloudEndpoints(secrets.cloudType);
+    this.cca = new ConfidentialClientApplication({
+      auth: {
+        clientId: secrets.clientId,
+        clientSecret: secrets.clientSecret,
+        authority: `${cloudEndpoints.authority}/${secrets.tenantId || "common"}`
+      }
+    });
+    const graphBase = cloudEndpoints.graphApi.replace(/\/$/, "");
+    this.graphScopes = [`${graphBase}/.default`];
+  }
+  async exchangeToken(userAssertion) {
+    try {
+      const result = await this.cca.acquireTokenOnBehalfOf({
+        oboAssertion: userAssertion,
+        scopes: this.graphScopes
+      });
+      if (!result?.accessToken) {
+        throw new Error("OBO token exchange returned no access token");
+      }
+      logger.info("OBO token exchange successful");
+      return result.accessToken;
+    } catch (error) {
+      logger.error(`OBO token exchange failed: ${error.message}`);
+      throw error;
+    }
+  }
+}
+var obo_client_default = OboClient;
+export {
+  obo_client_default as default
+};

package/dist/server.js

@@ -19,6 +19,7 @@ import { getSecrets } from "./secrets.js";
 import { getCloudEndpoints } from "./cloud-config.js";
 import { requestContext } from "./request-context.js";
 import crypto from "node:crypto";
+import OboClient from "./obo-client.js";
 function parseHttpOption(httpOption) {
   if (typeof httpOption === "boolean") {
     return { host: void 0, port: 3e3 };
@@ -45,6 +46,7 @@ class MicrosoftGraphServer {
     this.graphClient = null;
     this.server = null;
     this.secrets = null;
+    this.oboClient = null;
   }
   createMcpServer() {
     const server = new McpServer(
@@ -103,6 +105,18 @@ class MicrosoftGraphServer {
     } catch (err) {
       logger.warn(`Failed to detect multi-account mode: ${err.message}`);
     }
+    if (this.options.obo) {
+      if (!this.options.http) {
+        throw new Error("--obo requires --http (On-Behalf-Of flow only works in HTTP mode).");
+      }
+      if (!this.secrets.clientSecret) {
+        throw new Error(
+          "--obo requires MS365_MCP_CLIENT_SECRET to be set (confidential client required for On-Behalf-Of flow)."
+        );
+      }
+      this.oboClient = new OboClient(this.secrets);
+      logger.info("On-Behalf-Of (OBO) flow enabled");
+    }
     const outputFormat = this.options.toon ? "toon" : "json";
     this.graphClient = new GraphClient(this.authManager, this.secrets, outputFormat);
     if (!this.options.http) {
@@ -174,7 +188,7 @@ class MicrosoftGraphServer {
         const protocol = req.secure ? "https" : "http";
         const requestOrigin = `${protocol}://${req.get("host")}`;
         const browserBase = publicBase ?? requestOrigin;
-        const scopes = buildScopesFromEndpoints(this.options.orgMode, this.options.enabledTools);
+        const scopes = this.options.obo ? [`api://${this.secrets.clientId}/access_as_user`] : buildScopesFromEndpoints(this.options.orgMode, this.options.enabledTools);
         res.json({
           resource: `${requestOrigin}/mcp`,
           authorization_servers: [browserBase],
@@ -398,7 +412,11 @@ class MicrosoftGraphServer {
           };
           try {
             if (req.microsoftAuth) {
-              await requestContext.run({ accessToken: req.microsoftAuth.accessToken }, handler);
+              let accessToken = req.microsoftAuth.accessToken;
+              if (this.oboClient) {
+                accessToken = await this.oboClient.exchangeToken(accessToken);
+              }
+              await requestContext.run({ accessToken }, handler);
             } else {
               await handler();
             }
@@ -436,7 +454,11 @@ class MicrosoftGraphServer {
           };
           try {
             if (req.microsoftAuth) {
-              await requestContext.run({ accessToken: req.microsoftAuth.accessToken }, handler);
+              let accessToken = req.microsoftAuth.accessToken;
+              if (this.oboClient) {
+                accessToken = await this.oboClient.exchangeToken(accessToken);
+              }
+              await requestContext.run({ accessToken }, handler);
             } else {
               await handler();
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.92.0",
+  "version": "0.94.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -235,6 +235,34 @@
     "scopes": ["MailboxSettings.ReadWrite"],
     "llmTip": "Deletes a message rule permanently. Use the Inbox folder ID (get it from list-mail-folders) for inbox rules."
   },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides",
+    "method": "get",
+    "toolName": "list-focused-inbox-overrides",
+    "scopes": ["Mail.Read"],
+    "llmTip": "Lists Focused Inbox classification overrides — explicit rules that force messages from a given sender (by SMTP address) into either the Focused or Other tab, regardless of what the Outlook ML classifier would predict. Each override has id, classifyAs ('focused' or 'other'), and senderEmailAddress {name, address}. Returns an empty collection if the user has never set an override."
+  },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides",
+    "method": "post",
+    "toolName": "create-focused-inbox-override",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "Creates a Focused Inbox override for a sender. Body: { classifyAs: 'focused', senderEmailAddress: { name: 'Display Name', address: 'sender@example.com' } }. classifyAs must be 'focused' or 'other'. If an override already exists for that SMTP address, POST updates the existing override's name and classifyAs (use this to rename a sender). Resolve the sender's address with list-users or by reading a recent mail header — do not invent SMTP addresses."
+  },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides/{inferenceClassificationOverride-id}",
+    "method": "patch",
+    "toolName": "update-focused-inbox-override",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "Updates the classifyAs field of an existing override. Body: { classifyAs: 'focused' } or { classifyAs: 'other' }. Per Graph API, PATCH cannot change senderEmailAddress — to change the SMTP address, delete and recreate the override. To rename the display name only, POST a new override with the same SMTP address (it will overwrite the name)."
+  },
+  {
+    "pathPattern": "/me/inferenceClassification/overrides/{inferenceClassificationOverride-id}",
+    "method": "delete",
+    "toolName": "delete-focused-inbox-override",
+    "scopes": ["Mail.ReadWrite"],
+    "llmTip": "Deletes a Focused Inbox override. Future messages from that sender revert to the Outlook ML classifier's default behavior. Use list-focused-inbox-overrides to find the ID first."
+  },
   {
     "pathPattern": "/me/events",
     "method": "get",