excel-mcp-server 2.2.3__tar.gz → 2.2.5__tar.gz

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: excel-mcp-server
-Version: 2.2.3
+Version: 2.2.5
 Summary: MCP server for creating, reading and editing Excel workbooks without Microsoft Excel
 Keywords: mcp,mcp-server,model-context-protocol,excel,xlsx,xlsm,spreadsheet,openpyxl,charts,pivot-table,formulas,vba,llm,ai,claude,cursor
 Author: Haris Musa
@@ -104,7 +104,8 @@ Excel**, and runs on Windows, macOS and Linux.
 
 **Macros (opt-in)**
 - Read the VBA code in `.xlsm` files. Writing VBA is off unless you start the server with
-  `--allow-vba-write`; the server never runs macros
+  `--allow-vba-write`, which also decides whether `create_workbook` and `import_workbook` may
+  make `.xlsm`/`.xltm` files; the server never runs macros
 
 **Safe by design**
 - Optional folder confinement, a formula safety check, read-only mode, localhost-only HTTP by
@@ -323,8 +324,9 @@ next call can refer to it. Charts and images are selected by name, as listed by
 
 With `--allow-vba-write` (or `EXCEL_MCP_ALLOW_VBA_WRITE=1`) the server can set the code of
 standard, class, workbook and sheet modules in `.xlsm` and `.xltm` files, delete standard and
-class modules, and create new `.xlsm`/`.xltm` workbooks. The server only stores the code; it
-never runs it, and Excel asks before enabling macros. Digitally signed VBA projects are
+class modules, and create or import `.xlsm`/`.xltm` workbooks (without the option both are
+refused, and `import_workbook` removes macros from uploads to `.xlsx`/`.xltx`). The server only
+stores the code; it never runs it, and Excel asks before enabling macros. Digitally signed VBA projects are
 refused, since any change would invalidate the signature.
 
 > **Warning:** macro code runs with your user's rights once you enable macros in Excel. A

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/README.md

@@ -68,7 +68,8 @@ Excel**, and runs on Windows, macOS and Linux.
 
 **Macros (opt-in)**
 - Read the VBA code in `.xlsm` files. Writing VBA is off unless you start the server with
-  `--allow-vba-write`; the server never runs macros
+  `--allow-vba-write`, which also decides whether `create_workbook` and `import_workbook` may
+  make `.xlsm`/`.xltm` files; the server never runs macros
 
 **Safe by design**
 - Optional folder confinement, a formula safety check, read-only mode, localhost-only HTTP by
@@ -287,8 +288,9 @@ next call can refer to it. Charts and images are selected by name, as listed by
 
 With `--allow-vba-write` (or `EXCEL_MCP_ALLOW_VBA_WRITE=1`) the server can set the code of
 standard, class, workbook and sheet modules in `.xlsm` and `.xltm` files, delete standard and
-class modules, and create new `.xlsm`/`.xltm` workbooks. The server only stores the code; it
-never runs it, and Excel asks before enabling macros. Digitally signed VBA projects are
+class modules, and create or import `.xlsm`/`.xltm` workbooks (without the option both are
+refused, and `import_workbook` removes macros from uploads to `.xlsx`/`.xltx`). The server only
+stores the code; it never runs it, and Excel asks before enabling macros. Digitally signed VBA projects are
 refused, since any change would invalidate the signature.
 
 > **Warning:** macro code runs with your user's rights once you enable macros in Excel. A

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "excel-mcp-server"
-version = "2.2.3"
+version = "2.2.5"
 description = "MCP server for creating, reading and editing Excel workbooks without Microsoft Excel"
 readme = "README.md"
 license = "MIT"

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "excel-mcp-server"
-version = "2.2.3"
+version = "2.2.5"
 description = "MCP server for creating, reading and editing Excel workbooks without Microsoft Excel"
 readme = "README.md"
 license = "MIT"

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/charts.py

@@ -78,6 +78,7 @@ def create_chart(
     options: ChartOptions,
     replace: str | None,
     name: str | None,
+    max_cells: int,
 ) -> tuple[str | None, str | None]:
     """Add a chart (or replace the chart called `replace`); return its name and cells."""
     host = None if at is None else get_sheet(workbook, sheet)
@@ -96,7 +97,17 @@ def create_chart(
                 f"{chart_type} charts read their data in columns; list rows with `series`."
             )
         return _create_modern(
-            workbook, host, anchor, chart_type, source, series, categories, options, replace, name
+            workbook,
+            host,
+            anchor,
+            chart_type,
+            source,
+            series,
+            categories,
+            options,
+            replace,
+            name,
+            max_cells,
         )
     plots = resolve_series(
         workbook,
@@ -106,6 +117,7 @@ def create_chart(
         series_in,
         series,
         categories,
+        max_cells,
     )
     check_chart(plots, chart_type, options)
     chart = build_chart(plots, chart_type, options)
@@ -146,10 +158,11 @@ def _create_modern(
     options: ChartOptions,
     replace: str | None,
     name: str | None,
+    max_cells: int,
 ) -> tuple[str, str]:
     if host is None or anchor is None:
         raise InvalidArgumentError(f"A {chart_type} chart sits on the sheet: give at, e.g. 'E2'.")
-    plots = resolve_modern(workbook, host.title, chart_type, source, series, categories)
+    plots = resolve_modern(workbook, host.title, chart_type, source, series, categories, max_cells)
     check_modern(plots, chart_type, options)
     index, name = _place(host, replace, name)
     if index is None:

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/charts_check.py

@@ -3,6 +3,7 @@
 from excel_mcp.errors import InvalidArgumentError
 from excel_mcp.operations.charts_data import Plot
 from excel_mcp.operations.charts_options import (
+    MAX_SERIES,
     ROUND_TYPES,
     Axis,
     ChartOptions,
@@ -12,7 +13,6 @@ from excel_mcp.operations.charts_options import (
 )
 from excel_mcp.operations.formatting import parse_color
 
-MAX_SERIES = 255
 _COMBINABLE = ("column", "line", "area")
 _SECONDARY = ("column", "line", "area", "scatter")
 _GROUPED = ("column", "bar", "line", "area")

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/charts_data.py

@@ -9,7 +9,7 @@ from openpyxl.chart.series import SeriesLabel
 from openpyxl.utils import absolute_coordinate, quote_sheetname
 
 from excel_mcp.errors import InvalidArgumentError
-from excel_mcp.operations.charts_options import ChartType, SeriesSpec
+from excel_mcp.operations.charts_options import MAX_SERIES, ChartType, SeriesSpec
 from excel_mcp.refs import CellRange, parse_cell, parse_range
 from excel_mcp.workspace import get_sheet
 
@@ -36,6 +36,7 @@ def resolve_series(
     series_in: SeriesIn,
     series: list[SeriesSpec],
     categories: str | None,
+    max_cells: int,
 ) -> list[Plot]:
     if (source is None) == (not series):
         raise InvalidArgumentError(
@@ -43,24 +44,34 @@ def resolve_series(
             "and not neither."
         )
     if source is not None:
-        series = _block_series(workbook, sheet, source, chart_type, series_in)
+        series = _block_series(workbook, sheet, source, chart_type, series_in, max_cells)
         categories = None
-    return [_resolve(workbook, sheet, item, categories) for item in series]
+    check_series_count(len(series))
+    return [_resolve(workbook, sheet, item, categories, max_cells) for item in series]
 
 
-def _resolve(workbook: Workbook, sheet: str, spec: SeriesSpec, categories: str | None) -> Plot:
-    values, points = one_line(workbook, sheet, spec.values, "values")
+def _resolve(
+    workbook: Workbook, sheet: str, spec: SeriesSpec, categories: str | None, max_cells: int
+) -> Plot:
+    values, points = one_line(workbook, sheet, spec.values, "values", max_cells)
     labels = spec.categories or categories
     return Plot(
         spec=spec,
         values=values,
-        categories=one_line(workbook, sheet, labels, "categories")[0] if labels else None,
-        sizes=one_line(workbook, sheet, spec.sizes, "sizes")[0] if spec.sizes else None,
+        categories=one_line(workbook, sheet, labels, "categories", max_cells)[0]
+        if labels
+        else None,
+        sizes=one_line(workbook, sheet, spec.sizes, "sizes", max_cells)[0] if spec.sizes else None,
         name=series_name(workbook, spec.name),
         points=points,
     )
 
 
+def check_series_count(count: int) -> None:
+    if count > MAX_SERIES:
+        raise InvalidArgumentError(f"A chart has at most {MAX_SERIES} series, got {count}.")
+
+
 def split_sheet(workbook: Workbook, default: str, text: str) -> tuple[str, str]:
     """Split 'Data!B2:B9' (or 'My Sheet'!B2:B9) into the worksheet's title and the cells."""
     qualifier, mark, cells = text.rpartition("!")
@@ -74,10 +85,12 @@ def qualified(sheet: str, area: CellRange) -> str:
     return f"{quote_sheetname(sheet)}!{absolute_coordinate(str(area))}"
 
 
-def one_line(workbook: Workbook, default: str, text: str, what: str) -> tuple[str, int]:
+def one_line(
+    workbook: Workbook, default: str, text: str, what: str, max_cells: int
+) -> tuple[str, int]:
     """A one-row or one-column range as an absolute formula, and its number of cells."""
     sheet, cells = split_sheet(workbook, default, text)
-    area = parse_range(cells)
+    area = parse_range(cells).within(max_cells)
     if area.rows > 1 and area.cols > 1:
         raise InvalidArgumentError(
             f"Series {what} must be one row or one column, got {text!r}. List one series per "
@@ -99,11 +112,16 @@ def series_name(workbook: Workbook, text: str | None) -> SeriesLabel | None:
 
 
 def _block_series(
-    workbook: Workbook, default: str, source: str, chart_type: ChartType, series_in: SeriesIn
+    workbook: Workbook,
+    default: str,
+    source: str,
+    chart_type: ChartType,
+    series_in: SeriesIn,
+    max_cells: int,
 ) -> list[SeriesSpec]:
     """Series for a block with a header line and a label line, by columns or by rows."""
     sheet, cells = split_sheet(workbook, default, source)
-    area = parse_range(cells)
+    area = parse_range(cells).within(max_cells)
     if area.rows < 2 or area.cols < 2:
         raise InvalidArgumentError(
             "source needs a header row and a label column plus at least one series, "
@@ -112,6 +130,7 @@ def _block_series(
     by_columns = series_in == "columns"
     lines = area.cols if by_columns else area.rows
     points = (area.rows if by_columns else area.cols) - 1
+    check_series_count(lines - 1)
 
     def segment(line: int, start: int, stop: int) -> str:
         """Cells `start` to `stop` along line number `line`, the label line being 0."""

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/charts_modern.py

@@ -5,9 +5,10 @@ from openpyxl.worksheet.worksheet import Worksheet
 from pydantic import BaseModel
 
 from excel_mcp.errors import InvalidArgumentError
-from excel_mcp.operations.charts_check import MAX_SERIES, check_labels, require
+from excel_mcp.operations.charts_check import check_labels, require
 from excel_mcp.operations.charts_data import (
     Plot,
+    check_series_count,
     one_line,
     qualified,
     series_name,
@@ -51,6 +52,7 @@ def resolve_modern(
     source: str | None,
     series: list[SeriesSpec],
     categories: str | None,
+    max_cells: int,
 ) -> list[Plot]:
     if (source is None) == (not series):
         raise InvalidArgumentError(
@@ -58,33 +60,41 @@ def resolve_modern(
             "and not neither."
         )
     if source is not None:
-        series, categories = _block(workbook, sheet, chart_type, source), None
-    plots = [_plot(workbook, sheet, chart_type, spec, categories) for spec in series]
+        series, categories = _block(workbook, sheet, chart_type, source, max_cells), None
+    check_series_count(len(series))
+    plots = [_plot(workbook, sheet, chart_type, spec, categories, max_cells) for spec in series]
     if chart_type not in _MANY and len(plots) != 1:
         raise InvalidArgumentError(f"A {chart_type} chart plots one series, got {len(plots)}.")
     return plots
 
 
 def _plot(
-    workbook: Workbook, sheet: str, chart_type: str, spec: SeriesSpec, categories: str | None
+    workbook: Workbook,
+    sheet: str,
+    chart_type: str,
+    spec: SeriesSpec,
+    categories: str | None,
+    max_cells: int,
 ) -> Plot:
-    values, points = one_line(workbook, sheet, spec.values, "values")
+    values, points = one_line(workbook, sheet, spec.values, "values", max_cells)
     labels = spec.categories or categories
     if labels is None:
         found = None
     elif chart_type in _HIERARCHIES:
         title, cells = split_sheet(workbook, sheet, labels)
-        found = qualified(title, parse_range(cells))
+        found = qualified(title, parse_range(cells).within(max_cells))
     else:
-        found = one_line(workbook, sheet, labels, "categories")[0]
+        found = one_line(workbook, sheet, labels, "categories", max_cells)[0]
     return Plot(spec, values, found, None, series_name(workbook, spec.name), points)
 
 
-def _block(workbook: Workbook, default: str, chart_type: str, source: str) -> list[SeriesSpec]:
+def _block(
+    workbook: Workbook, default: str, chart_type: str, source: str, max_cells: int
+) -> list[SeriesSpec]:
     """Series for a block with a header row, read as Excel reads it: leading text columns are
     labels (one, or the levels of a treemap or sunburst), the number columns are the series."""
     sheet, cells = split_sheet(workbook, default, source)
-    area = parse_range(cells)
+    area = parse_range(cells).within(max_cells)
     if area.rows < 2:
         raise InvalidArgumentError("source needs a header row and at least one row of data.")
     labels = _text_columns(workbook[sheet], area)
@@ -120,8 +130,6 @@ def _text_columns(sheet: Worksheet, area: CellRange) -> int:
 
 
 def check_modern(plots: list[Plot], chart_type: ChartType, options: ChartOptions) -> None:
-    if len(plots) > MAX_SERIES:
-        raise InvalidArgumentError(f"A chart has at most {MAX_SERIES} series, got {len(plots)}.")
     _check_options(options, chart_type)
     for number, plot in enumerate(plots, start=1):
         try:

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/charts_options.py

@@ -10,6 +10,7 @@ ChartType = Literal[
     "column", "bar", "line", "area", "pie", "doughnut", "radar", "scatter", "bubble",
     "waterfall", "histogram", "pareto", "box_whisker", "treemap", "sunburst", "funnel",
 ]  # fmt: skip
+MAX_SERIES = 255
 SeriesType = Literal["column", "line", "area"]
 Grouping = Literal["standard", "stacked", "percent_stacked"]
 LegendPosition = Literal["right", "left", "top", "bottom", "none"]

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/layout.py

@@ -16,7 +16,7 @@ from excel_mcp.operations.formatting import parse_color
 from excel_mcp.operations.print_setup import PrintSetup, apply_print_setup
 from excel_mcp.operations.protection import Protection, apply_protection
 from excel_mcp.operations.sheet_view import ViewOptions, apply_view, move_sheet
-from excel_mcp.operations.spans import parse_span, to_spans
+from excel_mcp.operations.spans import MAX_ROW_SPAN, parse_span, to_spans
 from excel_mcp.package.lines import Axis
 from excel_mcp.refs import MAX_ROW, parse_cell
 
@@ -88,6 +88,7 @@ def apply_layout(
         apply_auto_filter(sheet, layout.auto_filter, formula_values, max_cells)
     if layout.tab_color is not None:
         sheet.sheet_properties.tabColor = parse_color(layout.tab_color)
+    check_row_spans(layout.rows or [])
     for action in layout.rows or []:
         change_lines(sheet, "rows", action)
     for action in layout.columns or []:
@@ -102,6 +103,16 @@ def apply_layout(
         apply_view(sheet, layout.view)
 
 
+def check_row_spans(actions: list[LineAction]) -> None:
+    """Every row of a span gets an object, so the spans of one call share the span limit."""
+    total = 0
+    for action in actions:
+        first, last = parse_span(action.span, "rows")
+        total += last - first + 1
+    if total > MAX_ROW_SPAN:
+        raise InvalidArgumentError(f"One call can change at most {MAX_ROW_SPAN:,} rows.")
+
+
 def split_column_dimensions(sheet: Worksheet) -> None:
     """Give every column of a multi-column definition its own, as openpyxl expects.
 

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/sheet_shapes.py

@@ -4,6 +4,7 @@ connectors, groups and form controls."""
 import re
 import uuid
 from collections.abc import Callable
+from html import unescape
 from xml.sax.saxutils import escape, quoteattr
 
 from openpyxl.workbook import Workbook
@@ -15,7 +16,7 @@ from excel_mcp.package import PackageState, Part, SheetPackage, state_of
 from excel_mcp.package.consistency import THREADED_COMMENTS
 from excel_mcp.package.extensions import CONDITIONAL_FORMATS, SPARKLINES
 from excel_mcp.package.model import cloned
-from excel_mcp.package.scan import relationship_ids, unescape
+from excel_mcp.package.scan import relationship_ids
 
 # Charts of Excel 2016 and slicers are copied with the parts they need, by their own code.
 _COPIED_ELSEWHERE = (

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/slicer_manage.py

@@ -2,7 +2,6 @@
 
 import re
 import uuid
-from xml.sax.saxutils import quoteattr
 
 from openpyxl.pivot.table import TableDefinition
 from openpyxl.workbook import Workbook
@@ -29,7 +28,9 @@ from excel_mcp.operations.slicer_index import (
 from excel_mcp.operations.slicer_place import add_cache, add_entry, next_shape_id
 from excel_mcp.package import state_of
 from excel_mcp.package.anchors import Corner
+from excel_mcp.package.scan import attributes
 from excel_mcp.text import quoted
+from excel_mcp.xml_text import attribute
 
 
 class SlicerInfo(BaseModel):
@@ -112,10 +113,12 @@ def placed_range(workbook: Workbook, sheet: Worksheet, name: str) -> str | None:
 
 
 def _anchor_of(anchors: list[str], name: str) -> str | None:
-    wanted = f'name="{name}"'
-    return next(
-        (a for a in anchors if re.search(rf"<\w+:(?:slicer|timeslicer)\b[^>]*{wanted}", a)), None
-    )
+    return next((a for a in anchors if _shape_name(a) == name), None)
+
+
+def _shape_name(anchor: str) -> str | None:
+    tag = re.search(r"<\w+:(?:slicer|timeslicer)\b[^>]*>", anchor)
+    return attributes(tag[0]).get("name") if tag else None
 
 
 def delete_slicer(
@@ -141,7 +144,11 @@ def remove_entry(workbook: Workbook, entry: Entry) -> None:
     """Take a slicer or timeline out of its sheet; its cache goes when nothing uses it."""
     package = state_of(workbook).sheet(entry.sheet)
     text = entry.part.data.decode("utf-8")
-    text = re.sub(rf'<(?:slicer|timeline)\b[^>]*\bname="{re.escape(entry.name)}"[^>]*/>', "", text)
+    text = re.sub(
+        r"<(?:slicer|timeline)\b[^>]*/>",
+        lambda tag: "" if attributes(tag[0]).get("name") == entry.name else tag[0],
+        text,
+    )
     entry.part.data = text.encode("utf-8")
     if not xml.read_entries(text):
         package.links.remove(entry.link)
@@ -200,6 +207,7 @@ __all__ = ["Corner", "SlicerInfo", "delete_slicer", "list_slicers", "sheet_of"]
 # -- copying a sheet ---------------------------------------------------------------------------
 
 _SHAPE_ID = re.compile(r'(<xdr:cNvPr\b[^>]*?\bid=")\d+(")')
+_SHAPE_NAME = re.compile(r'(<xdr:cNvPr\b[^>]*?\bname=)"[^"]*"')
 _GUID = re.compile(r'(<a16:creationId\b[^>]*?\bid=")[^"]*(")')
 _UID = re.compile(r'(\b\w+:uid=")[^"]*(")')
 
@@ -236,7 +244,7 @@ def copy_slicers(
 def _join_cache(workbook: Workbook, name: str, pivots: list[tuple[int, str]], tab: int) -> None:
     link = caches(workbook)[name][0]
     text = link.target.data.decode("utf-8")  # pyright: ignore[reportAttributeAccessIssue]
-    added = "".join(f'<pivotTable tabId="{tab}" name="{p}"/>' for _, p in pivots)
+    added = "".join(f'<pivotTable tabId="{tab}" name={attribute(p)}/>' for _, p in pivots)
     link.target.data = text.replace("</pivotTables>", added + "</pivotTables>").encode("utf-8")  # pyright: ignore[reportAttributeAccessIssue]
 
 
@@ -259,7 +267,7 @@ def _copy_cache(
         number += 1
     new = f"{stem}{number}"
     text = link.target.data.decode("utf-8")  # pyright: ignore[reportAttributeAccessIssue]
-    text = text.replace(f'name="{name}"', f'name="{new}"', 1)
+    text = re.sub(r'\bname="[^"]*"', lambda _: f"name={attribute(new)}", text, count=1)
     text = _UID.sub(lambda m: m[1] + _new_guid() + m[2], text, count=1)
     if tab_id is not None:
         text = re.sub(r'(<pivotTable\b[^>]*?\btabId=")\d+', rf"\g<1>{tab_id}", text)
@@ -281,11 +289,11 @@ def _copy_entry(workbook: Workbook, entry: Entry, target: Worksheet, cache: str,
         "name": name,
         "cache": cache,
     }
-    tag = entry.kind + "".join(f" {k}={quoteattr(v)}" for k, v in values.items()) + "/>"
+    tag = entry.kind + "".join(f" {k}={attribute(v)}" for k, v in values.items()) + "/>"
     package = state_of(workbook).sheet(entry.sheet)
     shape = _anchor_of(package.anchors, entry.name)
     assert shape is not None
-    shape = shape.replace(f'name="{entry.name}"', f'name="{name}"')
+    shape = _SHAPE_NAME.sub(lambda m: f"{m[1]}{attribute(name)}", shape, count=1)
     shape = _SHAPE_ID.sub(
         rf"\g<1>{next_shape_id(state_of(workbook).sheet(target))}\g<2>", shape, count=1
     )

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/slicer_place.py

@@ -7,6 +7,7 @@ from openpyxl.workbook import Workbook
 from openpyxl.workbook.defined_name import DefinedName
 from openpyxl.worksheet.worksheet import Worksheet
 
+from excel_mcp.errors import WorkbookError
 from excel_mcp.operations import slicer_xml as xml
 from excel_mcp.package import Link, Part, SheetPackage, state_of
 from excel_mcp.package.anchors import Geometry
@@ -17,6 +18,7 @@ from excel_mcp.package.scan import (
     root_scope,
     used_prefixes,
 )
+from excel_mcp.xml_text import attribute
 
 _XDR = "http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing"
 _A = "http://schemas.openxmlformats.org/drawingml/2006/main"
@@ -119,7 +121,8 @@ def _list_in(extensions: dict[str, str], uri: str, element: str) -> None:
     assert reference is not None
     existing = extensions[uri]
     closing = re.search(r"</(?:\w+:)(?:slicerCaches|timelineCacheRefs)>", existing)
-    assert closing is not None
+    if closing is None:
+        raise WorkbookError("The workbook's list of slicer or timeline caches is malformed.")
     extensions[uri] = existing[: closing.start()] + reference[0] + existing[closing.start() :]
 
 
@@ -152,12 +155,13 @@ def anchor(
     end_col, col_off = _end(geometry, False, column, left + size[0], left)
     end_row, row_off = _end(geometry, True, row, top + size[1], top)
     timeline = kind == "timeline"
+    shape_name = attribute(name)
     requires = "tsle" if timeline else "sle15" if kind == "table" else "a14"
     declared = {"tsle": _TSLE, "sle15": _SLE15, "a14": _A14}[requires]
     graphic = (
-        f'<tsle:timeslicer xmlns:tsle="{_TSLE}" name="{name}"/>'
+        f'<tsle:timeslicer xmlns:tsle="{_TSLE}" name={shape_name}/>'
         if timeline
-        else f'<sle:slicer xmlns:sle="{_SLE}" name="{name}"/>'
+        else f'<sle:slicer xmlns:sle="{_SLE}" name={shape_name}/>'
     )
     uri = _TSLE if timeline else _SLE
     guid = "{" + str(uuid.uuid4()).upper() + "}"
@@ -171,7 +175,7 @@ def anchor(
         f'<mc:AlternateContent xmlns:mc="{xml.MC}">'
         f'<mc:Choice xmlns:{requires}="{declared}" Requires="{requires}">'
         f'<xdr:graphicFrame macro=""><xdr:nvGraphicFramePr>'
-        f'<xdr:cNvPr id="{shape_id}" name="{name}"><a:extLst>'
+        f'<xdr:cNvPr id="{shape_id}" name={shape_name}><a:extLst>'
         f'<a:ext uri="{{FF2B5EF4-FFF2-40B4-BE49-F238E27FC236}}">'
         f'<a16:creationId xmlns:a16="{_A16}" id="{guid}"/></a:ext></a:extLst></xdr:cNvPr>'
         f"<xdr:cNvGraphicFramePr/></xdr:nvGraphicFramePr>"

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/slicer_xml.py

@@ -3,10 +3,10 @@
 import datetime as dt
 import re
 from dataclasses import dataclass
-from xml.sax.saxutils import quoteattr
 
 from excel_mcp.package.opc import XML_DECLARATION
 from excel_mcp.package.scan import attributes
+from excel_mcp.xml_text import attribute
 
 X14 = "http://schemas.microsoft.com/office/spreadsheetml/2009/9/main"
 X15 = "http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"
@@ -47,7 +47,7 @@ class CacheOptions:
 
 
 def _attrs(**values: object) -> str:
-    return "".join(f" {k}={quoteattr(str(v))}" for k, v in values.items() if v is not None)
+    return "".join(f" {k}={attribute(str(v))}" for k, v in values.items() if v is not None)
 
 
 def _date(moment: dt.date | dt.datetime) -> str:

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/slicers.py

@@ -31,6 +31,7 @@ from excel_mcp.package import state_of
 from excel_mcp.refs import parse_cell
 
 EMU_PER_CM = 360_000
+MAX_TEXT_LENGTH = 255
 _SLICER_SIZE = (1_828_800, 2_667_000)
 _TIMELINE_SIZE = (3_333_750, 1_371_600)
 
@@ -71,6 +72,8 @@ def add_slicer(
 ) -> tuple[str, bool]:
     """Add the slicer or timeline to ``sheet``; returns its name, and whether the figures of
     PivotTables it limits were left for Excel to recalculate when it opens the file."""
+    if request.caption:
+        _check_text(request.caption, "caption")
     owner, target = find_source(workbook, request.source.sheet, request.source.name)
     if isinstance(target, Table):
         if request.timeline or request.connect:
@@ -235,6 +238,7 @@ def _names(workbook: Workbook, request: SlicerRequest, stem: str) -> tuple[str,
     """The slicer's name and its cache's, unique in the workbook as Excel makes them."""
     taken = {entry.name.casefold() for entry in entries(workbook)}
     if request.name is not None:
+        _check_text(request.name, "name")
         if request.name.casefold() in taken:
             raise InvalidArgumentError(f"A slicer or timeline named {request.name!r} exists.")
         name = request.name
@@ -243,7 +247,8 @@ def _names(workbook: Workbook, request: SlicerRequest, stem: str) -> tuple[str,
         while name.casefold() in taken:
             number += 1
             name = f"{request.field} {number}"
-    stem += re.sub(r"\W", "_", request.field).rstrip("_")
+    # Excel keeps letters, digits and . \ ? in a cache name, and a defined name is at most 255.
+    stem += re.sub(r"[^\w.\\?]", "_", request.field).rstrip("_")[: MAX_TEXT_LENGTH - 20]
     used = {n.casefold() for n in workbook.defined_names} | {c.casefold() for c in caches(workbook)}
     cache, number = stem, 0
     while cache.casefold() in used:
@@ -252,6 +257,12 @@ def _names(workbook: Workbook, request: SlicerRequest, stem: str) -> tuple[str,
     return name, cache
 
 
+def _check_text(text: str, what: str) -> None:
+    """Excel takes any slicer name, caption and cache name of 1 to 255 characters."""
+    if not text.strip() or len(text) > MAX_TEXT_LENGTH:
+        raise InvalidArgumentError(f"A slicer's {what} must be 1 to {MAX_TEXT_LENGTH} characters.")
+
+
 def _check_style(style: str | None, kind: str) -> None:
     wanted = "TimeSlicerStyle" if kind == "timeline" else "SlicerStyle"
     if style is not None and not re.fullmatch(wanted + r"(Light|Dark|Other)\d", style):

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/sparklines.py

@@ -17,7 +17,7 @@ from excel_mcp.operations.sparkline_style import SparklineInfo, SparklineStyle,
 from excel_mcp.operations.sparkline_xml import build_group, read_groups
 from excel_mcp.operations.x14_xml import X14, XM, sheet_prefix
 from excel_mcp.package import state_of
-from excel_mcp.package.extensions import SPARKLINES, edit_sparklines
+from excel_mcp.package.extensions import SPARKLINES, edit_sparklines, sparkline_location
 from excel_mcp.refs import CellRange, cell_name, parse_range
 from excel_mcp.workspace import get_sheet
 
@@ -117,9 +117,7 @@ def _delete(extensions: dict[str, str], doomed: Callable[[str], bool]) -> int:
 
     def handle(item: str) -> list[str]:
         nonlocal removed
-        location = _LOCATION.search(item)
-        assert location is not None
-        if doomed(location[1]):
+        if doomed(sparkline_location(item)):
             removed += 1
             return []
         return [item]

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/operations/vba_write.py

@@ -30,8 +30,6 @@ def write_module(
         raise InvalidArgumentError(
             "Code lines cannot start with 'Attribute': the server writes module attributes itself."
         )
-    if "\0" in code:
-        raise InvalidArgumentError("The code contains a NUL character.")
     project = _project(workbook)
     existing = project.find(name)
     if existing is None and not _MODULE_NAME.fullmatch(name):

{excel_mcp_server-2.2.3 → excel_mcp_server-2.2.5}/src/excel_mcp/package/capture_sheet.py

@@ -1,6 +1,7 @@
 """Reading from the original file what openpyxl is going to drop from a worksheet."""
 
 import re
+from html import unescape
 from typing import Literal
 from xml.etree import ElementTree
 
@@ -21,7 +22,6 @@ from excel_mcp.package.scan import (
     relationship_ids,
     scan,
     scan_fragment,
-    unescape,
     with_namespaces,
 )
 from excel_mcp.package.shape_names import anchored_name, restore_names