powerautomate-mcp 0.7.2 → 0.7.5

package/README.md

@@ -20,13 +20,16 @@ An MCP (Model Context Protocol) server that connects Claude to Microsoft Power A
 - Microsoft 365 work account with Power Automate access
 - **Linux only**: libsecret for secure token storage
   ```bash
-  # Ubuntu/Debian
-  sudo apt-get install libsecret-1-dev gnome-keyring
+  # Ubuntu/Debian runtime
+  sudo apt-get install libsecret-1-0 gnome-keyring
 
-  # Fedora/RHEL
-  sudo dnf install libsecret-devel gnome-keyring
+  # Fedora/RHEL runtime
+  sudo dnf install libsecret gnome-keyring
   ```
 
+  If setup fails with `libsecret-1.so.0: cannot open shared object file`, the
+  runtime package above is missing.
+
 ### Installation
 
 ```bash
@@ -215,7 +218,7 @@ npm run build
 
 This server implements defense-in-depth security:
 
-- **Secure Token Storage**: DPAPI (Windows), Keychain (macOS), libsecret (Linux) — no plaintext fallback
+- **Secure Token Storage**: DPAPI (Windows), Keychain (macOS), libsecret on Linux when available, with a 0o600 file-cache fallback when it is not
 - **Input Validation**: GUID validation on all IDs, OData injection protection (ASCII-only), path traversal blocking (including URL-encoded), SharePoint hostname allowlist
 - **SSRF Prevention**: Domain allowlists on Dataverse URLs, resource links, and token resources
 - **Injection Prevention**: Power Automate expression injection blocking (`@{`/`}@`), OData filter sanitization, command injection prevention (`execFile` over `exec`)

package/dist/index.js

@@ -13,7 +13,6 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { PublicClientApplication, LogLevel } from '@azure/msal-node';
 import { execFile } from 'child_process';
-import { PersistenceCreator, DataProtectionScope, PersistenceCachePlugin } from '@azure/msal-node-extensions';
 import { request } from 'undici';
 import Database from 'better-sqlite3';
 import { fileURLToPath } from 'url';
@@ -725,6 +724,23 @@ function validateEnvironmentId(envId) {
   }
   return envId;
 }
+var msalNodeExtensionsPromise = null;
+async function loadMsalNodeExtensions() {
+  if (!msalNodeExtensionsPromise) {
+    msalNodeExtensionsPromise = import('@azure/msal-node-extensions').then((mod) => {
+      const moduleWithOptionalDefault = mod;
+      const resolved = moduleWithOptionalDefault.default ?? moduleWithOptionalDefault;
+      if (!resolved || !("PersistenceCreator" in resolved)) {
+        throw new Error("msal-node-extensions did not expose the expected exports");
+      }
+      return resolved;
+    });
+  }
+  return msalNodeExtensionsPromise;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 var NativeFileCachePlugin = class {
   cachePath;
   constructor(cachePath) {
@@ -765,6 +781,11 @@ async function createPersistentCachePlugin(cachePath) {
   logger.debug({ cacheLocation, platform: platform }, "Creating persistent token cache");
   if (platform === "win32" || platform === "darwin") {
     try {
+      const {
+        DataProtectionScope,
+        PersistenceCreator,
+        PersistenceCachePlugin
+      } = await loadMsalNodeExtensions();
       const persistence = await PersistenceCreator.createPersistence({
         cachePath: cacheLocation,
         dataProtectionScope: platform === "win32" ? DataProtectionScope.CurrentUser : void 0,
@@ -777,11 +798,15 @@ async function createPersistentCachePlugin(cachePath) {
     } catch (err) {
       logger.error({ err, cacheLocation }, "Failed to create persistent cache");
       throw new Error(
-        `Failed to initialize token cache at ${cacheLocation}: ${err instanceof Error ? err.message : String(err)}`
+        `Failed to initialize token cache at ${cacheLocation}: ${formatError(err)}`
       );
     }
   }
   try {
+    const {
+      PersistenceCreator,
+      PersistenceCachePlugin
+    } = await loadMsalNodeExtensions();
     const persistence = await PersistenceCreator.createPersistence({
       cachePath: cacheLocation,
       serviceName: "powerautomate-mcp",
@@ -793,7 +818,7 @@ async function createPersistentCachePlugin(cachePath) {
     return new PersistenceCachePlugin(persistence);
   } catch (libsecretError) {
     logger.warn(
-      { err: libsecretError instanceof Error ? libsecretError.message : String(libsecretError) },
+      { err: formatError(libsecretError) },
       "libsecret unavailable \u2014 using native file cache fallback (0o600 permissions)"
     );
     logger.info({ cacheLocation }, "Persistent token cache initialized (native file)");
@@ -1041,6 +1066,19 @@ async function createWamAuthProvider(config, silentOnly = false) {
       const result = await acquireToken(SCOPES.FLOW);
       return result.accessToken;
     },
+    async tryGetTokenForResourceSilent(resource) {
+      try {
+        validateHttpsUrl(resource, "Token resource");
+        const url = new URL(resource);
+        if (!isAllowedTokenDomain(url.hostname)) return null;
+        if (!currentAccount) return null;
+        const scopes = [`${resource}/.default`];
+        const result = await pca.acquireTokenSilent({ scopes, account: currentAccount });
+        return result.accessToken;
+      } catch {
+        return null;
+      }
+    },
     async getTokenForResource(resource) {
       validateHttpsUrl(resource, "Token resource");
       const url = new URL(resource);
@@ -14857,6 +14895,26 @@ async function createDeviceCodeAuthProvider(config, silentOnly = false) {
       const result = await acquireToken(scopes);
       return result.accessToken;
     },
+    async tryGetTokenForResourceSilent(resource) {
+      try {
+        validateHttpsUrl(resource, "Token resource");
+        const url = new URL(resource);
+        if (!isAllowedTokenDomain(url.hostname)) {
+          return null;
+        }
+        if (!currentAccount) {
+          return null;
+        }
+        const scopes = [`${resource}/.default`];
+        const result = await pca.acquireTokenSilent({
+          scopes,
+          account: currentAccount
+        });
+        return result.accessToken;
+      } catch {
+        return null;
+      }
+    },
     async logout() {
       if (currentAccount) {
         const cache = pca.getTokenCache();
@@ -14952,18 +15010,21 @@ var REQUIRED_RESOURCE_ACCESS = [
     ]
   },
   {
-    resourceAppId: "00000007-0000-0000-c000-000000000000",
+    resourceAppId: "475226c6-020e-4fb2-8a90-7a972cbfc1d4",
     resourceAccess: [
-      { id: "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4", type: "Scope" }
+      { id: "a4c50e78-6978-4ce3-b1c0-965c1f9b1128", type: "Scope" }
     ]
   },
   {
-    // Business Application Platform (BAP) API — required for environment
-    // discovery and Power Platform admin operations
     resourceAppId: "0e0bf3cc-3078-4fd4-9ef3-cb6dc0245b10",
     resourceAccess: [
       { id: "4ae1bf56-f562-4747-b7bc-2fa0874ed46f", type: "Scope" }
-      // user_impersonation
+    ]
+  },
+  {
+    resourceAppId: "00000007-0000-0000-c000-000000000000",
+    resourceAccess: [
+      { id: "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4", type: "Scope" }
     ]
   }
 ];
@@ -15098,6 +15159,7 @@ var c = {
 var icons = {
   check: `${c.green}\u2713${c.reset}`,
   cross: `${c.red}\u2717${c.reset}`,
+  info: `${c.blue}i${c.reset}`,
   arrow: `${c.cyan}\u2192${c.reset}`,
   bullet: `${c.dim}\u2022${c.reset}`,
   star: `${c.yellow}\u2605${c.reset}`
@@ -15266,15 +15328,15 @@ async function runSetupWizard() {
         print(`  ${icons.check} ${c.green}Signed in${c.reset}`);
       }
       const additionalResources = [
-        "https://api.bap.microsoft.com",
-        "https://service.powerapps.com"
+        { url: "https://service.powerapps.com", label: "PowerApps (connections)" },
+        { url: "https://api.bap.microsoft.com", label: "Admin API (environments)" }
       ];
-      for (const resource of additionalResources) {
-        try {
-          await authProvider.getTokenForResource(resource);
-          print(`  ${icons.check} ${c.dim}Authorized ${resource.replace("https://", "")}${c.reset}`);
-        } catch {
-          print(`  ${c.dim}${icons.warn} Could not authorize ${resource.replace("https://", "")} (admin tools may be limited)${c.reset}`);
+      for (const { url, label } of additionalResources) {
+        const token = authProvider.tryGetTokenForResourceSilent ? await authProvider.tryGetTokenForResourceSilent(url) : null;
+        if (token) {
+          print(`  ${icons.check} ${c.dim}${label}: authorized${c.reset}`);
+        } else {
+          print(`  ${c.dim}${icons.info || "-"} ${label}: will be authorized via admin consent (Step 3)${c.reset}`);
         }
       }
     } catch (error) {