ms365-mcp-server 1.1.23 → 2.0.0

package/bin/cli.js

@@ -64,6 +64,10 @@ let login = false;
 let logout = false;
 let verifyLogin = false;
 let serverUrl = process.env.SERVER_URL || 'http://localhost:55000';
+let clientId = process.env.OUTLOOK_CLIENT_ID || '';
+let tenantId = process.env.OUTLOOK_TENANT_ID || '';
+let clientSecret = process.env.OUTLOOK_CLIENT_SECRET || '';
+let redirectUri = process.env.OUTLOOK_REDIRECT_URI || '';
 
 // Detect if we're running under an MCP context (Claude/SIYA/ChatGPT/etc.)
 const isMcpContext = 
@@ -113,6 +117,38 @@ for (let i = 0; i < args.length; i++) {
       console.error('Error: --server-url requires a value');
       process.exit(1);
     }
+  } else if (arg === '--client-id') {
+    if (i + 1 < args.length) {
+      clientId = args[++i];
+      writeDebug(`Client ID set`);
+    } else {
+      console.error('Error: --client-id requires a value');
+      process.exit(1);
+    }
+  } else if (arg === '--tenant-id') {
+    if (i + 1 < args.length) {
+      tenantId = args[++i];
+      writeDebug(`Tenant ID set`);
+    } else {
+      console.error('Error: --tenant-id requires a value');
+      process.exit(1);
+    }
+  } else if (arg === '--client-secret') {
+    if (i + 1 < args.length) {
+      clientSecret = args[++i];
+      writeDebug(`Client secret set`);
+    } else {
+      console.error('Error: --client-secret requires a value');
+      process.exit(1);
+    }
+  } else if (arg === '--redirect-uri') {
+    if (i + 1 < args.length) {
+      redirectUri = args[++i];
+      writeDebug(`Redirect URI set to: ${redirectUri}`);
+    } else {
+      console.error('Error: --redirect-uri requires a value');
+      process.exit(1);
+    }
   } else if (arg === '--help' || arg === '-h') {
     console.log(`
 MS365 MCP Server - Microsoft 365 Integration for Claude/SIYA Desktop
@@ -120,41 +156,47 @@ MS365 MCP Server - Microsoft 365 Integration for Claude/SIYA Desktop
 Usage: npx ms365-mcp-server [options]
 
 Options:
-  --setup-auth               Set up MS365 API credentials
-  --reset-auth               Clear stored authentication tokens
-  --multi-user               Enable multi-user authentication mode
-  --login                    Login to MS365
+  --client-id ID             Azure App Client ID
+  --tenant-id ID             Azure Tenant ID (or "common")
+  --client-secret SECRET     Azure App Client Secret (optional)
+  --redirect-uri URI         OAuth redirect URI (optional)
+  --login                    Login to MS365 (opens browser for OAuth)
   --logout                   Logout from MS365
   --verify-login             Verify login to MS365
   --server-url URL           Set the server URL (default: http://localhost:55000)
+  --setup-auth               Interactive credential setup
+  --reset-auth               Clear stored authentication tokens
+  --multi-user               Enable multi-user authentication mode
   --debug                    Enable debug output
   --non-interactive, -n      Run in non-interactive mode (no prompt)
   --help, -h                 Show this help message
 
-Setup:
-  1. Run: npx ms365-mcp-server --setup-auth
-  2. Follow the instructions to set up Azure App Registration
+Quick Start:
+  1. Run: npx ms365-mcp-server --login
+  2. Complete authentication in browser
   3. Run: npx ms365-mcp-server to start the server
 
-Authentication Setup:
-  The server supports two methods for providing MS365 API credentials:
+Authentication (OAuth2 Redirect Flow):
+  The server uses OAuth2 redirect flow with a local callback server.
+  No Azure app registration required - uses built-in Microsoft credentials!
 
-  1. Environment Variables (Recommended):
-     - MS365_CLIENT_ID: Your Azure app client ID
-     - MS365_CLIENT_SECRET: Your Azure app client secret
-     - MS365_TENANT_ID: Your Azure tenant ID (or "common")
-     - MS365_REDIRECT_URI: OAuth redirect URI (optional)
-     - SERVER_URL: Server URL for attachments (optional)
+  1. Run --login to open browser for authentication
+  2. Sign in with your Microsoft account
+  3. Authorization redirects back to local server (port 44005)
+  4. Tokens saved to ~/.outlook-mcp/
 
-  2. Credentials File:
-     - Run --setup-auth for interactive setup
-     - Saves credentials to ~/.ms365-mcp/credentials.json
+Environment Variables (Optional - for custom Azure app):
+  - OUTLOOK_CLIENT_ID: Your Azure app client ID
+  - OUTLOOK_TENANT_ID: Your Azure tenant ID (or "common")
+  - OUTLOOK_CLIENT_SECRET: Your Azure app client secret (optional)
+  - OUTLOOK_REDIRECT_URI: OAuth redirect URI (optional)
+  - SERVER_URL: Server URL for attachments (optional)
 
-Azure App Registration:
+Custom Azure App Registration (Optional):
   1. Go to https://portal.azure.com
   2. Navigate to Azure Active Directory > App registrations
   3. Click "New registration"
-  4. Set redirect URI to: http://localhost:44001/oauth2callback
+  4. Set redirect URI to: http://localhost:44005/oauth2callback
   5. Grant required API permissions for Microsoft Graph:
      - Mail.ReadWrite
      - Mail.Send
@@ -162,14 +204,12 @@ Azure App Registration:
      - Contacts.Read
      - User.Read
 
-  Note: Device code flow (--login) doesn't require Azure app registration!
-
 Examples:
-  npx ms365-mcp-server --setup-auth    # Set up authentication
+  npx ms365-mcp-server --login         # Login (opens browser)
   npx ms365-mcp-server                 # Start the server
+  npx ms365-mcp-server --verify-login  # Check auth status
+  npx ms365-mcp-server --logout        # Clear auth tokens
   npx ms365-mcp-server --multi-user    # Start in multi-user mode
-  npx ms365-mcp-server --reset-auth    # Clear auth tokens
-  npx ms365-mcp-server --server-url https://your-domain.com  # Set custom server URL
 `);
     process.exit(0);
   }
@@ -219,15 +259,25 @@ function startServerWithPath(serverPath) {
   
   writeDebug(`Server arguments: ${serverArgs.join(' ')}`);
   
+  // Build environment with credentials
+  const serverEnv = {
+    ...process.env,
+    NODE_PATH: process.env.NODE_PATH || '',
+    SERVER_URL: serverUrl
+  };
+
+  // Add credentials to environment if provided via CLI
+  if (clientId) serverEnv.OUTLOOK_CLIENT_ID = clientId;
+  if (tenantId) serverEnv.OUTLOOK_TENANT_ID = tenantId;
+  if (clientSecret) serverEnv.OUTLOOK_CLIENT_SECRET = clientSecret;
+  if (redirectUri) serverEnv.OUTLOOK_REDIRECT_URI = redirectUri;
+
+  writeDebug(`Starting server with credentials: clientId=${clientId ? 'set' : 'not set'}, tenantId=${tenantId ? 'set' : 'not set'}, clientSecret=${clientSecret ? 'set' : 'not set'}`);
+
   // Start the server process
   const serverProcess = spawn(process.execPath, [serverPath, ...serverArgs], {
     stdio: 'inherit',
-    env: {
-      ...process.env,
-      // Ensure environment variables are passed through
-      NODE_PATH: process.env.NODE_PATH || '',
-      SERVER_URL: serverUrl
-    }
+    env: serverEnv
   });
   
   // Handle server process events

package/dist/index.js

@@ -14,7 +14,7 @@ import { CallToolRequestSchema, ListResourcesRequestSchema, ListToolsRequestSche
 import { logger } from './utils/api.js';
 import { MS365Operations } from './utils/ms365-operations.js';
 import { multiUserMS365Auth } from './utils/multi-user-auth.js';
-import { enhancedMS365Auth } from './utils/ms365-auth-enhanced.js';
+import { outlookAuth } from './utils/outlook-auth.js';
 import { IntelligenceEngine } from './utils/intelligence-engine.js';
 import { ProactiveIntelligence } from './utils/proactive-intelligence.js';
 import { DocumentWorkflow } from './utils/document-workflow.js';
@@ -83,7 +83,7 @@ function parseArgs() {
 }
 const server = new Server({
     name: "ms365-mcp-server",
-    version: "1.1.19"
+    version: "1.0.0"
 }, {
     capabilities: {
         resources: {
@@ -872,25 +872,20 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
     const authTools = [
         {
             name: "authenticate",
-            description: "UNIFIED AUTHENTICATION: Handle all Microsoft 365 authentication needs. Supports device code flow, status checking, and logout. RECOMMENDED for all auth operations.",
+            description: "UNIFIED AUTHENTICATION: Handle all Microsoft 365 authentication needs via OAuth2 redirect flow. Supports login (opens browser), status checking, and logout.",
             inputSchema: {
                 type: "object",
                 properties: {
                     action: {
                         type: "string",
-                        enum: ["login", "status", "logout", "device_code", "check_pending"],
-                        description: "Auth action: login (device code auth), status (check auth status), logout (clear tokens), device_code (get device code only), check_pending (check pending auth)",
+                        enum: ["login", "status", "logout"],
+                        description: "Auth action: login (OAuth redirect auth - opens browser), status (check auth status), logout (clear tokens)",
                         default: "login"
                     },
                     force: {
                         type: "boolean",
                         description: "Force new authentication even if already authenticated (for login action)",
                         default: false
-                    },
-                    accountKey: {
-                        type: "string",
-                        description: "Account key for logout action (default: current user)",
-                        default: "default-user"
                     }
                 }
             }
@@ -945,69 +940,62 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     case "login":
                         try {
                             // Check if already authenticated
-                            if (await enhancedMS365Auth.isAuthenticated() && !args?.force) {
+                            if (await outlookAuth.isAuthenticated() && !processedArgs?.force) {
+                                const user = await outlookAuth.getCurrentUser();
                                 return {
                                     content: [
                                         {
                                             type: "text",
-                                            text: `✅ Already authenticated with Microsoft 365! Use force: true to re-authenticate.`
+                                            text: `✅ Already authenticated with Microsoft 365!\n\n👤 User: ${user || 'authenticated-user'}\n\n💡 Use force: true to re-authenticate.`
                                         }
                                     ]
                                 };
                             }
-                            // First, try to complete any existing pending authentication
-                            const existingResult = await enhancedMS365Auth.completeDeviceCodeAuth();
-                            if (existingResult) {
-                                const currentUser = await enhancedMS365Auth.getCurrentUser();
-                                return {
-                                    content: [
-                                        {
-                                            type: "text",
-                                            text: `✅ Device code authentication completed successfully!\n\n👤 User: ${currentUser || 'authenticated-user'}\n🔐 Status: Valid\n\n🚀 You can now use all Microsoft 365 email features!`
-                                        }
-                                    ]
-                                };
-                            }
-                            // Check if there's already a pending device code
-                            let deviceCodeInfo = await enhancedMS365Auth.getPendingDeviceCodeInfo();
-                            if (!deviceCodeInfo || args?.force) {
-                                // No pending code or force new one, start fresh
-                                deviceCodeInfo = await enhancedMS365Auth.startDeviceCodeAuth();
-                            }
-                            // Return device code information immediately (MCP pattern)
+                            // Start OAuth redirect flow
+                            const authResult = await outlookAuth.authenticate();
+                            const currentUser = await outlookAuth.getCurrentUser();
                             return {
                                 content: [
                                     {
                                         type: "text",
-                                        text: `🔐 Microsoft 365 Device Code Authentication\n\n📱 Visit: ${deviceCodeInfo.verificationUri}\n🔑 Enter this code: ${deviceCodeInfo.userCode}\n\n⏳ After completing authentication in your browser, call this tool again to finish the process.\n\n💡 This code will expire in 15 minutes.`
+                                        text: `✅ Authentication successful!\n\n👤 User: ${currentUser || 'authenticated-user'}\n🔐 Status: Valid\n\n🚀 You can now use all Microsoft 365 email features!`
                                     }
                                 ]
                             };
                         }
                         catch (error) {
+                            // Check if this is an auth required error with URL (MCP context)
+                            if (error.code === 'AUTH_REQUIRED' && error.authUrl) {
+                                return {
+                                    content: [
+                                        {
+                                            type: "text",
+                                            text: `🔐 Microsoft 365 Authentication Required\n\n📱 Please authenticate using the CLI:\n\nms365-mcp-server --login\n\nOr visit this URL:\n${error.authUrl}`
+                                        }
+                                    ]
+                                };
+                            }
                             return {
                                 content: [
                                     {
                                         type: "text",
-                                        text: `❌ Authentication failed: ${error.message}\n\n💡 Try again or use CLI: node dist/index.js --login`
+                                        text: `❌ Authentication failed: ${error.message}\n\n💡 Try using CLI: ms365-mcp-server --login`
                                     }
                                 ]
                             };
                         }
                     case "status":
-                        const isAuthenticated = await enhancedMS365Auth.isAuthenticated();
-                        const currentUser = await enhancedMS365Auth.getCurrentUser();
-                        const storageInfo = enhancedMS365Auth.getStorageInfo();
-                        const tokenInfo = await enhancedMS365Auth.getTokenExpirationInfo();
-                        let statusText = `📊 Microsoft 365 Authentication Status\n\n🔐 Authentication: ${isAuthenticated ? '✅ Valid' : '❌ Not authenticated'}\n👤 Current User: ${currentUser || 'None'}\n`;
-                        if (isAuthenticated) {
-                            statusText += `\n⏰ Token expires in: ${tokenInfo.expiresInMinutes} minutes`;
-                            if (tokenInfo.needsRefresh) {
-                                statusText += `\n⚠️ Token will be refreshed automatically on next operation`;
-                            }
+                        const authStatus = await outlookAuth.getAuthenticationStatus();
+                        let statusText = `📊 Microsoft 365 Authentication Status\n\n`;
+                        statusText += `🔐 Authentication: ${authStatus.authenticated ? '✅ Valid' : '❌ Not authenticated'}\n`;
+                        statusText += `👤 Current User: ${authStatus.username || 'None'}\n`;
+                        if (authStatus.authenticated) {
+                            statusText += `\n⏰ Token expires: ${authStatus.expiresAt}`;
+                            statusText += `\n⏱️ Expires in: ${authStatus.expiresIn} minutes`;
                         }
                         else {
                             statusText += `\n💡 Use "authenticate" with action: login to sign in`;
+                            statusText += `\n   Or run: ms365-mcp-server --login`;
                         }
                         return {
                             content: [
@@ -1018,9 +1006,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                             ]
                         };
                     case "logout":
-                        const accountKey = args?.accountKey;
-                        const wasAuthenticated = await enhancedMS365Auth.isAuthenticated();
-                        await enhancedMS365Auth.resetAuth();
+                        const wasAuthenticated = await outlookAuth.isAuthenticated();
+                        await outlookAuth.logout();
                         return {
                             content: [
                                 {
@@ -1031,38 +1018,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                                 }
                             ]
                         };
-                    case "device_code":
-                        const deviceCodeInfo = await enhancedMS365Auth.getDeviceCodeInfo();
-                        return {
-                            content: [
-                                {
-                                    type: "text",
-                                    text: `🔐 Microsoft 365 Device Code Authentication\n\n📱 Visit: ${deviceCodeInfo.verificationUri}\n🔑 Enter code: ${deviceCodeInfo.userCode}\n\n⏳ This code will expire in 15 minutes.`
-                                }
-                            ]
-                        };
-                    case "check_pending":
-                        const pendingDeviceCodeState = await enhancedMS365Auth.getPendingDeviceCodeInfo();
-                        if (pendingDeviceCodeState) {
-                            return {
-                                content: [
-                                    {
-                                        type: "text",
-                                        text: `⏳ Pending Device Code Authentication\n\n📱 Visit: ${pendingDeviceCodeState.verificationUri}\n🔑 Enter this code: ${pendingDeviceCodeState.userCode}\n\n💡 Use "authenticate" with action: login to finish authentication after entering the code.`
-                                    }
-                                ]
-                            };
-                        }
-                        return {
-                            content: [
-                                {
-                                    type: "text",
-                                    text: "ℹ️ No pending device code authentication found. Use 'authenticate' with action: login to start a new authentication process."
-                                }
-                            ]
-                        };
                     default:
-                        throw new Error(`Unknown authentication action: ${action}`);
+                        throw new Error(`Unknown authentication action: ${action}. Valid actions: login, status, logout`);
                 }
             // ============ UNIFIED EMAIL MANAGEMENT TOOL ============
             case "manage_email":
@@ -1077,7 +1034,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 const emailAction = processedArgs?.action;
@@ -1505,7 +1462,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 const contactAction = args?.action || 'list';
@@ -1548,7 +1505,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 // Validate and normalize email input
@@ -1611,7 +1568,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 if (!processedArgs?.messageId) {
@@ -1684,7 +1641,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 let folders;
@@ -1765,7 +1722,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 const batchAction = args?.action;
@@ -1866,7 +1823,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 const aiAction = args?.action;
@@ -2099,7 +2056,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 const testAction = args?.action;
@@ -2267,7 +2224,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     ms365Ops.setGraphClient(graphClient);
                 }
                 else {
-                    const graphClient = await enhancedMS365Auth.getGraphClient();
+                    const graphClient = await outlookAuth.getGraphClient();
                     ms365Ops.setGraphClient(graphClient);
                 }
                 const pipelineAction = args?.action;
@@ -2709,7 +2666,7 @@ async function main() {
     ms365Config = parseArgs();
     if (ms365Config.setupAuth) {
         try {
-            await enhancedMS365Auth.setupCredentials();
+            await outlookAuth.setupCredentials();
             process.exit(0);
         }
         catch (error) {
@@ -2719,7 +2676,7 @@ async function main() {
     }
     if (ms365Config.resetAuth) {
         try {
-            await enhancedMS365Auth.resetAuth();
+            await outlookAuth.resetAuth();
             console.log('✅ Authentication data cleared successfully');
             process.exit(0);
         }
@@ -2730,8 +2687,8 @@ async function main() {
     }
     if (ms365Config.login) {
         try {
-            console.log('🔐 Starting Microsoft 365 authentication...\n');
-            await enhancedMS365Auth.authenticateWithDeviceCode();
+            console.log('🔐 Starting Microsoft 365 OAuth authentication...\n');
+            await outlookAuth.authenticate();
             console.log('✅ Login successful! You can now use MS365 MCP server.\n');
             process.exit(0);
         }
@@ -2742,7 +2699,7 @@ async function main() {
     }
     if (ms365Config.logout) {
         try {
-            await enhancedMS365Auth.resetAuth();
+            await outlookAuth.logout();
             console.log('✅ Logged out successfully');
             process.exit(0);
         }
@@ -2753,15 +2710,16 @@ async function main() {
     }
     if (ms365Config.verifyLogin) {
         try {
-            const isAuthenticated = await enhancedMS365Auth.isAuthenticated();
-            const currentUser = await enhancedMS365Auth.getCurrentUser();
-            const storageInfo = enhancedMS365Auth.getStorageInfo();
+            const authStatus = await outlookAuth.getAuthenticationStatus();
             console.log('\n📊 MS365 Authentication Status\n');
-            console.log(`Authentication: ${isAuthenticated ? '✅ Valid' : '❌ Not authenticated'}`);
-            console.log(`Current User: ${currentUser || 'None'}`);
-            console.log(`Storage method: ${storageInfo.method}`);
-            console.log(`Storage location: ${storageInfo.location}\n`);
-            process.exit(isAuthenticated ? 0 : 1);
+            console.log(`Authentication: ${authStatus.authenticated ? '✅ Valid' : '❌ Not authenticated'}`);
+            console.log(`Current User: ${authStatus.username || 'None'}`);
+            if (authStatus.authenticated) {
+                console.log(`Token expires: ${authStatus.expiresAt}`);
+                console.log(`Expires in: ${authStatus.expiresIn} minutes`);
+            }
+            console.log(`Storage: ~/.ms365-mcp/\n`);
+            process.exit(authStatus.authenticated ? 0 : 1);
         }
         catch (error) {
             console.error('❌ Verification failed:', error);
@@ -2773,8 +2731,7 @@ async function main() {
         logger.log('Multi-user mode enabled');
     }
     // Display storage information
-    const storageInfo = enhancedMS365Auth.getStorageInfo();
-    logger.log(`Credential storage: ${storageInfo.method} at ${storageInfo.location}`);
+    logger.log('Credential storage: ~/.ms365-mcp/');
     const transport = new StdioServerTransport();
     await server.connect(transport);
     logger.log('MS365 MCP Server running on stdio');

package/dist/utils/ms365-operations.js

@@ -50,15 +50,10 @@ export class MS365Operations {
      */
     async getGraphClient() {
         if (!this.graphClient) {
-            // Import the enhanced auth module dynamically to avoid circular imports
-            const { enhancedMS365Auth } = await import('./ms365-auth-enhanced.js');
-            // Proactive token check - refresh if expiring within 5 minutes
-            const tokenInfo = await enhancedMS365Auth.getTokenExpirationInfo();
-            if (tokenInfo.expiresInMinutes < 5) {
-                logger.log(`Token expires in ${tokenInfo.expiresInMinutes} minutes, refreshing proactively...`);
-                await enhancedMS365Auth.refreshTokenIfNeeded();
-            }
-            this.graphClient = await enhancedMS365Auth.getGraphClient();
+            // Import the outlook auth module dynamically to avoid circular imports
+            const { outlookAuth } = await import('./outlook-auth.js');
+            // Get graph client (handles token refresh automatically)
+            this.graphClient = await outlookAuth.getGraphClient();
         }
         return this.graphClient;
     }