iris-mcp 0.1.0__tar.gz

iris_mcp-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+.venv/
+__pycache__/
+.token_cache.json
+audit.log
+DISABLED
+
+# transitional scaffolding, superseded by git history
+patch_iris.py
+server.py.orig

iris_mcp-0.1.0/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+## 0.1.0 — 2026-08-21
+
+First published release.
+
+- Packaged for PyPI as `iris-mcp` with an `iris-mcp` console script, and
+  registered with the MCP registry as `io.github.SuperAngryMonkey/iris`.
+- Default draft folder is now `AI Drafts`. It was previously a name meaningful
+  only to the author's own setup, which would have created an oddly-named
+  folder in a stranger's mailbox.
+- README rewritten around the actual design claim: the token carries
+  `Mail.ReadWrite` and never `Mail.Send`, so sending is absent rather than
+  merely disallowed. Setup now leads with registering your own Entra app,
+  because there is no shared app registration.
+
+### Earlier, unreleased
+
+- Split sign-in into `iris_login` / `iris_login_finish` so the device-code flow
+  returns its URL immediately instead of blocking.
+- `iris_auth_status` reads identity from the MSAL account and probes Graph
+  in-scope, rather than calling `/me`.
+- Fixed bare strings passed as `to`/`cc`/`bcc` being iterated character by
+  character. MCP clients were unaffected — the schema forces arrays — but
+  direct callers were not.
+- `iris_update_draft` and `iris_delete_draft` exercised against Graph for the
+  first time; full create/update/list/delete cycle verified.

iris_mcp-0.1.0/HANDOFF.md

@@ -0,0 +1,179 @@
+# iris — Handoff
+
+> **Read this first.** Single pickup point for the draft-only M365 mail MCP.
+> Just continue the work — no re-introduction needed.
+
+---
+
+## TL;DR — state in five lines
+1. iris is **built, registered, signed in, and working end to end.**
+2. It composes into the **Cyrano** mail folder. It **cannot send** — no Mail.Send scope.
+3. A real draft to dean@iothings.ai was created and read back on 2026-07-23. Ghost sent it.
+4. **Two bugs are live in the public repo.** `iris_login()` can never succeed.
+5. Fix those first. Everything else is polish.
+
+---
+
+## What / where
+- **iris = draft-only Microsoft 365 mail MCP.** Writes into Outlook, stops there.
+  A human reads the draft and presses Send.
+- Local: `~/Projects/iris` on Mac-studio. Public: github.com/SuperAngryMonkey/iris (MIT).
+- Registered in Claude Desktop as `iris`, alongside christian / ferryman / tupperware.
+- Named for Iris, the other messenger of the gods — sibling to [hermes], ferryman, obol, minos.
+
+## Status: WORKING
+Verified on 2026-07-23 by an actual draft appearing in the mailbox, not by the
+server starting cleanly:
+- `iris_create_draft(...)` -> created in **Cyrano** (folder auto-created on first use)
+- `iris_list_drafts()` -> read it back
+- Token carries `Mail.ReadWrite openid profile email`. **No Mail.Send.**
+
+## Entra registration — DONE, do not redo
+| item | value |
+|------|-------|
+| App name | `iris`, single tenant, 800 Pound Gorilla Inc. |
+| Client ID | `cf1473d7-9c86-4833-9d88-d9f91c120546` |
+| Tenant ID | `cc06d355-c099-4a61-8aae-61973e4eb27e` |
+| Client secret | **none, deliberately** — public client, device code |
+| Allow public client flows | Enabled |
+| Graph permissions | `Mail.ReadWrite` (Delegated) + default `User.Read` |
+
+Neither ID is a secret. The absence of a secret, and of `Mail.Send`, is the design.
+
+## Claude Desktop config — DONE
+Already patched into `claude_desktop_config.json` (backup at
+`claude_desktop_config.json.bak-iris`):
+
+    "iris": {
+      "command": "/Users/<you>/Projects/iris/.venv/bin/python",
+      "args": ["/Users/<you>/Projects/iris/server.py"],
+      "env": {
+        "IRIS_CLIENT_ID": "cf1473d7-9c86-4833-9d88-d9f91c120546",
+        "IRIS_TENANT_ID": "cc06d355-c099-4a61-8aae-61973e4eb27e",
+        "IRIS_DRAFT_FOLDER": "Cyrano"
+      }
+    }
+
+Token cache lives at `.token_cache.json` (mode 600, gitignored) and renews
+silently until it lapses — roughly 90 days idle, or on a password change or
+Conditional Access shift.
+
+---
+
+## KNOWN BUGS — start here
+
+### 1. `iris_login()` cannot work
+It calls `initiate_device_flow()` and then immediately
+`acquire_token_by_device_flow()`, which **blocks until the user authenticates**.
+The `user_code` is captured but never returned until after that call finishes —
+so the human never sees the code they are supposed to enter, and the flow times
+out after ~15 minutes.
+
+This is public. The README tells people to call `iris_login()` as setup step 4.
+Anyone who clones the repo hits a dead end at the first step.
+
+**Fix:** split into two tools sharing a module-level flow variable —
+`iris_login_start()` initiates and returns the verification URL + code
+immediately; `iris_login_finish()` performs the blocking exchange and writes
+the cache.
+
+**Workaround used to sign in the first time:** a two-step script run through
+christian that writes to the same `.token_cache.json` the server reads. See
+`docs/AS-BUILT.md`.
+
+### 2. `iris_auth_status()` returns 403
+It calls Graph `/me`, which requires `User.Read`. The token only requests
+`Mail.ReadWrite`, so Graph replies `Authorization_RequestDenied`. Sign-in is
+fine; the status tool is wrong.
+
+**Fix:** drop the `/me` call and read the username from the MSAL account object
+(`app.get_accounts()[0]["username"]`). Preferable to adding `User.Read` to
+SCOPES — keeping the grant minimal is the entire point of this project.
+
+Until fixed, use `iris_list_drafts()` as the health check.
+
+---
+
+## Tools
+| tool | what it does |
+|------|--------------|
+| `iris_login()` | **BROKEN** — see above |
+| `iris_auth_status()` | **BROKEN (403)** — see above |
+| `iris_create_draft(to, subject, body, cc, bcc, html, reply_to_message_id)` | works; writes to Cyrano, does not send |
+| `iris_list_drafts(limit)` | works |
+| `iris_update_draft(draft_id, ...)` | untested against Graph |
+| `iris_delete_draft(draft_id, confirm)` | untested; needs confirm=true |
+
+## Where drafts land
+Top-level folder named by `IRIS_DRAFT_FOLDER` (currently `Cyrano`), created on
+first use. Empty string falls back to Drafts.
+
+They are genuine drafts and Outlook sends them normally, but they **do not
+appear in the Drafts view** — look in the folder.
+
+Replies are special: Graph `createReply` always creates in Drafts, so iris moves
+the message afterwards, and **a move assigns a new message id**. The returned id
+will not match the one createReply produced.
+
+## Containment
+- **No send capability** — `Mail.ReadWrite` only. Structural, not a rule.
+- `recipients.allow` — address/domain allowlist; empty or absent permits all.
+- `audit.log` — every draft, update, delete, login.
+- Kill switch — `touch DISABLED`, or `IRIS_DISABLED=1`.
+- Confirm gate — deletion requires `confirm=true`, set only on explicit human ok.
+
+## Next actions, in order
+1. **Fix `iris_login()`** (split start/finish). Public repo, first-step blocker.
+2. **Fix `iris_auth_status()`** (MSAL account, not Graph `/me`).
+3. Update README with a Known Issues section — currently it documents a broken
+   setup path with no warning.
+4. Test `iris_update_draft` and `iris_delete_draft` against Graph. Never run.
+5. Decide the LICENSE copyright holder: it currently reads James B Smith III
+   personally, but the Entra app sits under 800 Pound Gorilla Inc.
+6. Optional: attachments, shared/delegated mailboxes, folder nesting via
+   `parentFolderId`.
+
+## Repo map
+    HANDOFF.md            <- you are here
+    README.md             public-facing; needs a Known Issues section
+    LICENSE               MIT, 2026 James B Smith III
+    server.py             the whole server, ~441 lines
+    requirements.txt      mcp, msal, requests
+    recipients.allow      allowlist, currently permissive
+    docs/AS-BUILT.md      what actually ran, and the traps hit on the way
+    patch_iris.py         one-shot folder migration, applied, gitignored
+    server.py.orig        pre-folder snapshot, gitignored
+
+## Gotchas
+- macOS system `python3` is **3.9.6** and cannot install `mcp` (needs 3.10+).
+  Use `/opt/homebrew/bin/python3.14`, same interpreter christian runs on.
+  Rebuild with `python3.14 -m venv --clear .venv` — `--clear` wipes in place and
+  avoids a recursive force-delete, which christian's gate refuses without
+  explicit human approval.
+- christian matches dangerous-command patterns against the **whole command
+  string, heredoc body included** — a document that merely quotes a destructive
+  command trips the gate even though nothing executes.
+- Entra's new permission picker: clicking a permission group's expand chevron
+  silently closes the whole panel and loses the selection. Filter, click
+  "expand all", then tick the exact child row.
+- Verify by checking a **draft actually arrived**, never by checking the server
+  started. "It loaded" is not "it works" — that is how both bugs above survived
+  to first real use.
+
+## 2026-08-14 — both launch bugs fixed, full lifecycle verified
+- Bug 1 FIXED: login split into `iris_login()` (starts device flow, stashes it
+  to `.pending_flow.json` mode 600, returns URL+code immediately) and
+  `iris_login_finish()` (bounded ~60s poll, safe to call repeatedly; stash
+  keeps original expiry). Not yet exercised against a real sign-in — current
+  token is healthy; first real test comes at next token lapse.
+- Bug 2 FIXED: `iris_auth_status()` no longer calls /me. Identity read from the
+  MSAL account object; Graph health probed with an in-scope call
+  (GET /me/mailFolders?$top=1). Returns graph_ok true/false.
+- Bug 3 (new, found during testing) FIXED: a bare string passed as to/cc/bcc
+  was iterated character-by-character. `_flatten` and `_recips` now wrap
+  strings. MCP clients were never affected (schema forces arrays); direct
+  callers were.
+- update/delete now TESTED against Graph: create → update → list → delete
+  cycle ran clean in the Cyrano folder (self-deleting test draft).
+- Still open: LICENSE holder decision (James B Smith III vs 800 Pound Gorilla
+  Inc.) — Ghost's call.

iris_mcp-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 800 Pound Gorilla Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

iris_mcp-0.1.0/PKG-INFO

@@ -0,0 +1,146 @@
+Metadata-Version: 2.5
+Name: iris-mcp
+Version: 0.1.0
+Summary: A Microsoft 365 mail MCP server that can draft but cannot send. The token has no Mail.Send scope.
+Project-URL: Homepage, https://github.com/SuperAngryMonkey/iris
+Project-URL: Source, https://github.com/SuperAngryMonkey/iris
+Project-URL: Issues, https://github.com/SuperAngryMonkey/iris/issues
+Author-email: "800 Pound Gorilla Inc." <james@bigassmonkey.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: email,graph,mcp,microsoft-365,model-context-protocol,msal,outlook
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Communications :: Email
+Requires-Python: >=3.10
+Requires-Dist: mcp<2,>=1.2.0
+Requires-Dist: msal>=1.28.0
+Requires-Dist: requests>=2.31.0
+Description-Content-Type: text/markdown
+
+# iris
+
+**A Microsoft 365 mail server for AI agents that cannot send email.**
+
+Not "will not". Cannot. iris requests the delegated Graph scope `Mail.ReadWrite`
+and never `Mail.Send`. The access token it holds has no capability to transmit a
+message, so no prompt, no jailbreak and no bug in this code can make one go out.
+It writes drafts into a folder in your mailbox. You open Outlook and press Send.
+
+That is the whole design. Everything else is detail.
+
+---
+
+## Why this shape
+
+The usual worry about giving an agent your mailbox is that it will send
+something you did not sanction — to the wrong person, with the wrong tone, or
+because someone talked it into doing so. The common answer is a confirmation
+prompt, which is a guardrail: code that asks permission, and code can be
+bypassed.
+
+iris removes the capability instead. Microsoft Graph will reject a send attempt
+made with this token, because the consent screen you approved never included
+that permission. The security boundary is Microsoft's, not this program's, and
+it holds even if this program is wrong.
+
+The trade is real: a human is in the loop on every message, by construction. If
+you want autonomous sending, iris is the wrong tool.
+
+## Install
+
+```bash
+uvx iris-mcp        # run without installing
+pip install iris-mcp
+```
+
+Python 3.10+.
+
+## Setup
+
+**You must register your own Entra application.** There is no shared app
+registration and no hosted service — iris talks directly from your machine to
+your tenant. This is deliberate: a shared app would mean trusting someone
+else's client ID with access to your mail.
+
+1. Entra admin centre → **App registrations** → **New registration**. Single
+   tenant is fine. No redirect URI needed.
+2. **Authentication** → Settings → enable **Allow public client flows**. Device
+   code sign-in needs this. No client secret is used anywhere.
+3. **API permissions** → Microsoft Graph → **Delegated** → add
+   **`Mail.ReadWrite`**. Add nothing else. Do not add `Mail.Send` — if it is
+   present, the guarantee above is void.
+4. Copy the **Application (client) ID** and **Directory (tenant) ID**. Neither
+   is a secret.
+
+Then add iris to your MCP client:
+
+```json
+{
+  "mcpServers": {
+    "iris": {
+      "command": "uvx",
+      "args": ["iris-mcp"],
+      "env": {
+        "IRIS_CLIENT_ID": "<application client id>",
+        "IRIS_TENANT_ID": "<directory tenant id>"
+      }
+    }
+  }
+}
+```
+
+Sign in once: call `iris_login`, open the URL, enter the code, then call
+`iris_login_finish`. The token cache is written next to the server, mode 600.
+
+## Tools
+
+| Tool | What it does |
+|---|---|
+| `iris_login` | Starts device-code sign-in, returns a URL and a code |
+| `iris_login_finish` | Completes sign-in; safe to call repeatedly while you type the code |
+| `iris_auth_status` | Who is signed in, which scopes, and whether Graph is reachable |
+| `iris_create_draft` | Writes a draft (to/cc/bcc, subject, body or HTML, optional reply-to) |
+| `iris_list_drafts` | Lists what is waiting in the draft folder |
+| `iris_update_draft` | Revises a draft in place |
+| `iris_delete_draft` | Deletes a draft; requires `confirm=true` |
+
+## Where drafts go
+
+Into a dedicated top-level mail folder, `AI Drafts` by default
+(`IRIS_DRAFT_FOLDER`). It is created on first use. Set the variable to an empty
+string to use the normal Drafts folder instead.
+
+These are real drafts and Outlook sends them normally — but because they live in
+their own folder, they do **not** appear in the Drafts view. That is the point:
+agent-written mail sits somewhere you have to go and look, rather than mixed in
+with your own half-finished messages.
+
+One wrinkle worth knowing: Graph's `createReply` always lands a reply in Drafts
+first, so iris moves it afterwards, and a move assigns a new message id.
+
+## Other controls
+
+- **Recipient allowlist** — `recipients.allow`, one address or domain per line.
+  Absent or empty means all recipients are permitted. Point `IRIS_ALLOWLIST`
+  elsewhere if you prefer.
+- **Kill switch** — create a `DISABLED` file beside the server, or set
+  `IRIS_DISABLED=1`, and every tool refuses.
+- **Audit log** — every call is appended to `audit.log` (`IRIS_AUDIT_LOG`).
+
+## Limits
+
+No attachments. No shared or delegated mailboxes — `/me` only. No folder nesting
+via `parentFolderId`. Sign-in is delegated device-code as a public client, so
+the blast radius is exactly one mailbox: yours.
+
+## License
+
+MIT — see [LICENSE](LICENSE).
+
+<!-- mcp-name: io.github.SuperAngryMonkey/iris -->

iris_mcp-0.1.0/README.md

@@ -0,0 +1,121 @@
+# iris
+
+**A Microsoft 365 mail server for AI agents that cannot send email.**
+
+Not "will not". Cannot. iris requests the delegated Graph scope `Mail.ReadWrite`
+and never `Mail.Send`. The access token it holds has no capability to transmit a
+message, so no prompt, no jailbreak and no bug in this code can make one go out.
+It writes drafts into a folder in your mailbox. You open Outlook and press Send.
+
+That is the whole design. Everything else is detail.
+
+---
+
+## Why this shape
+
+The usual worry about giving an agent your mailbox is that it will send
+something you did not sanction — to the wrong person, with the wrong tone, or
+because someone talked it into doing so. The common answer is a confirmation
+prompt, which is a guardrail: code that asks permission, and code can be
+bypassed.
+
+iris removes the capability instead. Microsoft Graph will reject a send attempt
+made with this token, because the consent screen you approved never included
+that permission. The security boundary is Microsoft's, not this program's, and
+it holds even if this program is wrong.
+
+The trade is real: a human is in the loop on every message, by construction. If
+you want autonomous sending, iris is the wrong tool.
+
+## Install
+
+```bash
+uvx iris-mcp        # run without installing
+pip install iris-mcp
+```
+
+Python 3.10+.
+
+## Setup
+
+**You must register your own Entra application.** There is no shared app
+registration and no hosted service — iris talks directly from your machine to
+your tenant. This is deliberate: a shared app would mean trusting someone
+else's client ID with access to your mail.
+
+1. Entra admin centre → **App registrations** → **New registration**. Single
+   tenant is fine. No redirect URI needed.
+2. **Authentication** → Settings → enable **Allow public client flows**. Device
+   code sign-in needs this. No client secret is used anywhere.
+3. **API permissions** → Microsoft Graph → **Delegated** → add
+   **`Mail.ReadWrite`**. Add nothing else. Do not add `Mail.Send` — if it is
+   present, the guarantee above is void.
+4. Copy the **Application (client) ID** and **Directory (tenant) ID**. Neither
+   is a secret.
+
+Then add iris to your MCP client:
+
+```json
+{
+  "mcpServers": {
+    "iris": {
+      "command": "uvx",
+      "args": ["iris-mcp"],
+      "env": {
+        "IRIS_CLIENT_ID": "<application client id>",
+        "IRIS_TENANT_ID": "<directory tenant id>"
+      }
+    }
+  }
+}
+```
+
+Sign in once: call `iris_login`, open the URL, enter the code, then call
+`iris_login_finish`. The token cache is written next to the server, mode 600.
+
+## Tools
+
+| Tool | What it does |
+|---|---|
+| `iris_login` | Starts device-code sign-in, returns a URL and a code |
+| `iris_login_finish` | Completes sign-in; safe to call repeatedly while you type the code |
+| `iris_auth_status` | Who is signed in, which scopes, and whether Graph is reachable |
+| `iris_create_draft` | Writes a draft (to/cc/bcc, subject, body or HTML, optional reply-to) |
+| `iris_list_drafts` | Lists what is waiting in the draft folder |
+| `iris_update_draft` | Revises a draft in place |
+| `iris_delete_draft` | Deletes a draft; requires `confirm=true` |
+
+## Where drafts go
+
+Into a dedicated top-level mail folder, `AI Drafts` by default
+(`IRIS_DRAFT_FOLDER`). It is created on first use. Set the variable to an empty
+string to use the normal Drafts folder instead.
+
+These are real drafts and Outlook sends them normally — but because they live in
+their own folder, they do **not** appear in the Drafts view. That is the point:
+agent-written mail sits somewhere you have to go and look, rather than mixed in
+with your own half-finished messages.
+
+One wrinkle worth knowing: Graph's `createReply` always lands a reply in Drafts
+first, so iris moves it afterwards, and a move assigns a new message id.
+
+## Other controls
+
+- **Recipient allowlist** — `recipients.allow`, one address or domain per line.
+  Absent or empty means all recipients are permitted. Point `IRIS_ALLOWLIST`
+  elsewhere if you prefer.
+- **Kill switch** — create a `DISABLED` file beside the server, or set
+  `IRIS_DISABLED=1`, and every tool refuses.
+- **Audit log** — every call is appended to `audit.log` (`IRIS_AUDIT_LOG`).
+
+## Limits
+
+No attachments. No shared or delegated mailboxes — `/me` only. No folder nesting
+via `parentFolderId`. Sign-in is delegated device-code as a public client, so
+the blast radius is exactly one mailbox: yours.
+
+## License
+
+MIT — see [LICENSE](LICENSE).
+
+<!-- mcp-name: io.github.SuperAngryMonkey/iris -->

iris_mcp-0.1.0/docs/AS-BUILT.md

@@ -0,0 +1,75 @@
+# iris — as-built
+
+What actually ran on 2026-07-23, in order, including what went wrong.
+
+## 1. Scaffold
+Authored `server.py` locally, syntax-checked, shipped to `~/Projects/iris` via a
+christian heredoc, verified by sha256 match on both sides (393 lines at that
+point). Modeled on christian's skeleton: single server.py, requirements.txt,
+allowlist file, audit log, DISABLED kill switch, confirm gate.
+
+## 2. Venv — first attempt failed
+`python3 -m venv` picked up macOS system Python **3.9.6**. `pip install mcp`
+failed with "Could not find a version that satisfies the requirement mcp>=1.2.0
+(from versions: none)" — mcp needs 3.10+. Rebuilt against
+`/opt/homebrew/bin/python3.14`. Result: mcp 1.28.1, msal 1.37.0, requests 2.34.2.
+
+Note: the rebuild initially used a recursive force-delete, which christian's
+dangerous-pattern gate correctly refused. Used `venv --clear` instead — same
+effect, no gate, no human approval needed for a routine operation.
+
+## 3. Drafts folder
+Ghost asked for drafts to land in a dedicated folder. Applied as an
+all-or-nothing patch script (10 anchored replacements, tested against a local
+byte-identical copy first, then applied on the Mac and confirmed identical by
+sha256). Folder name went in as "Cirano", corrected to **Cyrano** before any
+Graph call — so no stray folder was ever created in the mailbox.
+
+## 4. Publish
+git init, MIT license, README, pushed to github.com/SuperAngryMonkey/iris.
+Pre-publish audit: scanned the committed tree for emails, IPs, tailnet names and
+local usernames. Found and genericized `/Users/jamessmith/...` paths in
+HANDOFF.md, and replaced real domains in `recipients.allow` with example ones —
+one of them was a third party's and had no business being in a public repo.
+
+## 5. Entra registration
+Done through the browser. App `iris`, single tenant. Allow public client flows
+-> Enabled (this lives under **Authentication (Preview) -> Settings** in the new
+portal, not the classic Add-a-platform flow). Delegated `Mail.ReadWrite` added.
+
+**Trap:** the first permission attempt was lost because clicking the Mail
+group's expand chevron silently closed the entire Request-API-permissions panel.
+The working path is: filter -> "expand all" -> tick the exact child row.
+`Mail.ReadWrite` is "Read and write access to user mail";
+`Mail.ReadWrite.Shared` is "user and shared mail" and is the wrong one.
+
+## 6. Desktop config
+Patched `claude_desktop_config.json` by loading and re-dumping JSON rather than
+editing text, so malforming it was not possible. Backup at
+`claude_desktop_config.json.bak-iris`. Re-parsed after writing to prove validity.
+mcpServers went from [christian, ferryman, tupperware] to
+[christian, ferryman, iris, tupperware].
+
+## 7. Sign-in — revealed bug #1
+`iris_login()` blocks before surfacing the device code, so it can never be
+completed. Worked around with two christian-run scripts against the same
+`.token_cache.json` the server reads:
+
+1. `initiate_device_flow()`, persist the flow to `.device_flow.json`, print the
+   verification URL and user code, return immediately.
+2. Human approves in a browser. Then `acquire_token_by_device_flow(flow)`,
+   write the cache at mode 600, delete the stashed flow.
+
+Result: signed in as james@bigassmonkey.com, scopes
+`Mail.ReadWrite openid profile email`. No Mail.Send.
+
+## 8. First real use — revealed bug #2 and proved the thing works
+`iris_auth_status()` returned Graph 403 `Authorization_RequestDenied` — it calls
+`/me`, which needs `User.Read`, and the token only carries `Mail.ReadWrite`.
+
+`iris_create_draft(...)` then succeeded: draft to dean@iothings.ai created in a
+newly auto-created **Cyrano** folder, and `iris_list_drafts()` read it back
+(created 2026-07-23T18:00:29Z). Ghost opened it in Outlook and sent it.
+
+That is the first and only meaningful verification: a draft that arrived, not a
+server that started.

iris_mcp-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "iris-mcp"
+version = "0.1.0"
+description = "A Microsoft 365 mail MCP server that can draft but cannot send. The token has no Mail.Send scope."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [{ name = "800 Pound Gorilla Inc.", email = "james@bigassmonkey.com" }]
+keywords = ["mcp", "model-context-protocol", "microsoft-365", "outlook", "email", "msal", "graph"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Communications :: Email",
+]
+dependencies = ["mcp>=1.2.0,<2", "msal>=1.28.0", "requests>=2.31.0"]
+
+[project.urls]
+Homepage = "https://github.com/SuperAngryMonkey/iris"
+Source = "https://github.com/SuperAngryMonkey/iris"
+Issues = "https://github.com/SuperAngryMonkey/iris/issues"
+
+[project.scripts]
+iris-mcp = "server:main"
+
+[tool.hatch.build.targets.wheel]
+only-include = ["server.py"]
+sources = ["."]

iris_mcp-0.1.0/recipients.allow

@@ -0,0 +1,5 @@
+# iris recipient allowlist - one address or domain per line.
+# If this file is empty or absent, ALL recipients are permitted.
+# Uncomment and edit to restrict.
+#example.com
+#someone@example.org

iris_mcp-0.1.0/requirements.txt

@@ -0,0 +1,3 @@
+mcp>=1.2.0,<2
+msal>=1.28.0
+requests>=2.31.0

iris_mcp-0.1.0/server.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
+  "name": "io.github.SuperAngryMonkey/iris",
+  "description": "Microsoft 365 mail MCP that can draft but cannot send: the token carries Mail.ReadWrite and never Mail.Send.",
+  "status": "active",
+  "repository": {
+    "url": "https://github.com/SuperAngryMonkey/iris",
+    "source": "github"
+  },
+  "version": "0.1.0",
+  "packages": [
+    {
+      "registryType": "pypi",
+      "registryBaseUrl": "https://pypi.org",
+      "identifier": "iris-mcp",
+      "version": "0.1.0",
+      "transport": { "type": "stdio" },
+      "environmentVariables": [
+        {
+          "name": "IRIS_CLIENT_ID",
+          "description": "Application (client) ID of YOUR OWN Entra app registration. There is no shared app; you register one.",
+          "isRequired": true,
+          "isSecret": false
+        },
+        {
+          "name": "IRIS_TENANT_ID",
+          "description": "Directory (tenant) ID. Defaults to 'organizations'.",
+          "isRequired": false,
+          "isSecret": false
+        },
+        {
+          "name": "IRIS_DRAFT_FOLDER",
+          "description": "Mail folder drafts are written to, created on first use. Defaults to 'AI Drafts'. Empty string uses Drafts.",
+          "isRequired": false,
+          "isSecret": false
+        },
+        {
+          "name": "IRIS_ALLOWLIST",
+          "description": "Path to a recipient allowlist file. If absent or empty, all recipients are permitted.",
+          "isRequired": false,
+          "isSecret": false
+        }
+      ]
+    }
+  ]
+}

iris_mcp-0.1.0/server.py

@@ -0,0 +1,492 @@
+#!/usr/bin/env python3
+"""
+iris — a draft-only Microsoft 365 mail MCP.
+
+The other messenger of the gods. Composes mail into your Outlook Drafts
+folder and stops there. A human opens Outlook, reads it, and presses Send.
+
+Containment (heimdall doctrine applied to mail):
+  - NO SEND CAPABILITY  the app requests Mail.ReadWrite ONLY, never Mail.Send.
+                        This is structural: the token cannot send mail, so no
+                        bug, loop, or bad instruction can put mail in flight.
+  - DELEGATED AUTH      public client + device code. No client secret on disk,
+                        no admin consent, blast radius = this mailbox only.
+  - RECIPIENT ALLOWLIST if recipients.allow is present and non-empty, drafts to
+                        anything outside it are refused.
+  - AUDIT LOG           every draft written appended to audit.log.
+  - KILL SWITCH         a DISABLED file (or IRIS_DISABLED=1) blocks everything.
+  - CONFIRM GATE        deleting a draft requires confirm=true, which the
+                        assistant must only set after explicit human ok.
+
+Setup (one time, in Entra ID):
+  1. Register an application. Single tenant is fine.
+  2. Authentication -> Add platform -> Mobile and desktop -> check the
+     "https://login.microsoftonline.com/common/oauth2/nativeclient" redirect,
+     and set "Allow public client flows" = Yes.
+  3. API permissions -> Microsoft Graph -> Delegated -> Mail.ReadWrite.
+     Do NOT add Mail.Send. That omission is the safety property.
+  4. Export IRIS_CLIENT_ID and IRIS_TENANT_ID, then call iris_login().
+"""
+import json
+import os
+import re
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+import msal
+import requests
+from mcp.server.fastmcp import FastMCP
+
+HERE = Path(__file__).resolve().parent
+ALLOWLIST_FILE = Path(os.environ.get("IRIS_ALLOWLIST", HERE / "recipients.allow"))
+AUDIT_LOG = Path(os.environ.get("IRIS_AUDIT_LOG", HERE / "audit.log"))
+CACHE_FILE = Path(os.environ.get("IRIS_TOKEN_CACHE", HERE / ".token_cache.json"))
+FLOW_FILE = Path(os.environ.get("IRIS_FLOW_FILE", HERE / ".pending_flow.json"))
+DISABLED_FILE = HERE / "DISABLED"
+# Drafts are staged here instead of the Drafts folder. Blank = use Drafts.
+DRAFT_FOLDER = os.environ.get("IRIS_DRAFT_FOLDER", "AI Drafts")
+
+CLIENT_ID = os.environ.get("IRIS_CLIENT_ID", "")
+TENANT_ID = os.environ.get("IRIS_TENANT_ID", "organizations")
+AUTHORITY = f"https://login.microsoftonline.com/{TENANT_ID}"
+
+# Mail.ReadWrite ONLY. Adding Mail.Send here would defeat the entire design.
+SCOPES = ["Mail.ReadWrite"]
+
+GRAPH = "https://graph.microsoft.com/v1.0"
+HTTP_TIMEOUT = 30
+MAX_BODY = 500_000
+
+EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
+
+mcp = FastMCP("iris")
+
+
+# ----------------------------------------------------------------- plumbing
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+def _disabled() -> bool:
+    return DISABLED_FILE.exists() or os.environ.get("IRIS_DISABLED") == "1"
+
+
+def _audit(action: str, detail: str) -> None:
+    try:
+        with AUDIT_LOG.open("a", encoding="utf-8") as fh:
+            fh.write(f"{_now()}\t{action}\t{detail}\n")
+    except OSError:
+        pass
+
+
+def _load_allowlist() -> list[str]:
+    if not ALLOWLIST_FILE.exists():
+        return []
+    entries = []
+    for line in ALLOWLIST_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip().lower()
+        if line:
+            entries.append(line)
+    return entries
+
+
+def _check_recipients(addrs: list[str]) -> str | None:
+    """Return an error string if any address is outside the allowlist."""
+    allow = _load_allowlist()
+    if not allow:
+        return None
+    bad = []
+    for a in addrs:
+        a = a.strip().lower()
+        domain = a.rsplit("@", 1)[-1]
+        if a not in allow and domain not in allow and f"@{domain}" not in allow:
+            bad.append(a)
+    if bad:
+        return (
+            f"recipients not in {ALLOWLIST_FILE.name}: {', '.join(bad)}. "
+            "Add them to the allowlist or clear the file to allow all."
+        )
+    return None
+
+
+def _cache() -> msal.SerializableTokenCache:
+    cache = msal.SerializableTokenCache()
+    if CACHE_FILE.exists():
+        cache.deserialize(CACHE_FILE.read_text(encoding="utf-8"))
+    return cache
+
+
+def _save_cache(cache: msal.SerializableTokenCache) -> None:
+    if cache.has_state_changed:
+        CACHE_FILE.write_text(cache.serialize(), encoding="utf-8")
+        try:
+            CACHE_FILE.chmod(0o600)
+        except OSError:
+            pass
+
+
+def _app(cache: msal.SerializableTokenCache) -> msal.PublicClientApplication:
+    return msal.PublicClientApplication(
+        CLIENT_ID, authority=AUTHORITY, token_cache=cache
+    )
+
+
+def _token() -> tuple[str | None, str | None]:
+    """Return (access_token, error)."""
+    if not CLIENT_ID:
+        return None, "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    cache = _cache()
+    app = _app(cache)
+    accounts = app.get_accounts()
+    if not accounts:
+        return None, "not signed in — run iris_login() first"
+    result = app.acquire_token_silent(SCOPES, account=accounts[0])
+    _save_cache(cache)
+    if not result or "access_token" not in result:
+        return None, "token expired or revoked — run iris_login() again"
+    return result["access_token"], None
+
+
+def _graph(method: str, path: str, token: str, **kw) -> tuple[dict, int]:
+    url = path if path.startswith("http") else f"{GRAPH}{path}"
+    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
+    headers.update(kw.pop("headers", {}))
+    resp = requests.request(method, url, headers=headers, timeout=HTTP_TIMEOUT, **kw)
+    try:
+        body = resp.json() if resp.content else {}
+    except ValueError:
+        body = {"raw": resp.text[:2000]}
+    return body, resp.status_code
+
+
+def _recips(addrs: list[str] | str | None) -> list[dict]:
+    if isinstance(addrs, str):  # tolerate a bare address where a list is expected
+        addrs = [addrs]
+    return [{"emailAddress": {"address": a.strip()}} for a in (addrs or []) if a.strip()]
+
+
+def _flatten(*groups) -> list[str]:
+    out = []
+    for g in groups:
+        if isinstance(g, str):  # tolerate a bare address where a list is expected
+            g = [g]
+        for a in (g or []):
+            if a and a.strip():
+                out.append(a.strip())
+    return out
+
+
+def _ensure_folder(token: str) -> tuple[str | None, str | None]:
+    """Find or create the staging mail folder. Returns (folder_id, error)."""
+    if not DRAFT_FOLDER:
+        return "drafts", None
+    body, code = _graph(
+        "GET", "/me/mailFolders?$top=100&$select=id,displayName", token
+    )
+    if code != 200:
+        return None, f"folder lookup failed {code}: {json.dumps(body)[:300]}"
+    want = DRAFT_FOLDER.strip().lower()
+    for f in body.get("value", []):
+        if (f.get("displayName") or "").strip().lower() == want:
+            return f.get("id"), None
+    made, code = _graph(
+        "POST", "/me/mailFolders", token, json={"displayName": DRAFT_FOLDER}
+    )
+    if code not in (200, 201):
+        return None, f"folder creation failed {code}: {json.dumps(made)[:300]}"
+    _audit("folder", f"created {DRAFT_FOLDER} id={made.get('id')}")
+    return made.get("id"), None
+
+
+# -------------------------------------------------------------------- tools
+
+@mcp.tool()
+def iris_login() -> str:
+    """Start a device-code sign-in for the mailbox. Returns a URL and a code
+    for the human to enter in a browser; then call iris_login_finish() to
+    complete. Only needed once, or after the refresh token lapses."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not CLIENT_ID:
+        return "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    cache = _cache()
+    app = _app(cache)
+    flow = app.initiate_device_flow(scopes=SCOPES)
+    if "user_code" not in flow:
+        return f"failed to start device flow: {json.dumps(flow)[:500]}"
+    FLOW_FILE.write_text(json.dumps(flow))
+    FLOW_FILE.chmod(0o600)
+    msg = flow.get("message", "")
+    return f"{msg}\n\nAfter entering the code, call iris_login_finish() to complete sign-in."
+
+
+@mcp.tool()
+def iris_login_finish() -> str:
+    """Complete a device-code sign-in started with iris_login(). Call after
+    entering the code in the browser. Waits up to ~60s; if the code has not
+    been entered yet, it says so and can simply be called again."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not CLIENT_ID:
+        return "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    if not FLOW_FILE.exists():
+        return "no pending sign-in — call iris_login() first"
+    try:
+        flow = json.loads(FLOW_FILE.read_text())
+    except ValueError:
+        FLOW_FILE.unlink(missing_ok=True)
+        return "pending sign-in state was unreadable — call iris_login() again"
+    if time.time() > flow.get("expires_at", 0):
+        FLOW_FILE.unlink(missing_ok=True)
+        return "the device code expired — call iris_login() to get a new one"
+    # Bound the blocking poll to ~60s per call; the stashed flow keeps its
+    # original expiry, so calling again later still works.
+    flow["expires_at"] = min(flow.get("expires_at", 0), int(time.time()) + 60)
+    cache = _cache()
+    app = _app(cache)
+    result = app.acquire_token_by_device_flow(flow)
+    _save_cache(cache)
+    if "access_token" in result:
+        FLOW_FILE.unlink(missing_ok=True)
+        who = result.get("id_token_claims", {}).get("preferred_username", "unknown")
+        _audit("login", who)
+        return f"signed in as {who} (scopes: {' '.join(SCOPES)} — no send capability)"
+    if result.get("error") == "authorization_pending":
+        return "code not entered yet — finish it in the browser, then call iris_login_finish() again"
+    FLOW_FILE.unlink(missing_ok=True)
+    return f"sign-in failed: {result.get('error_description', json.dumps(result))[:500]}"
+
+
+@mcp.tool()
+def iris_auth_status() -> str:
+    """Report whether iris is signed in, as whom, and with what scopes."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not CLIENT_ID:
+        return "IRIS_CLIENT_ID is not set. See the setup notes in server.py."
+    cache = _cache()
+    app = _app(cache)
+    accounts = app.get_accounts()
+    if not accounts:
+        return "not signed in — run iris_login() first"
+    result = app.acquire_token_silent(SCOPES, account=accounts[0])
+    _save_cache(cache)
+    if not result or "access_token" not in result:
+        return "token expired or revoked — run iris_login() again"
+    # Cheap Graph probe within the granted scope. Deliberately NOT /me:
+    # reading the profile needs User.Read, which iris does not request.
+    _, code = _graph("GET", "/me/mailFolders?$top=1&$select=id", result["access_token"])
+    allow = _load_allowlist()
+    return json.dumps({
+        "signed_in_as": accounts[0].get("username"),
+        "scopes": SCOPES,
+        "graph_ok": code == 200,
+        "can_send": False,
+        "draft_folder": DRAFT_FOLDER or "Drafts",
+        "recipient_allowlist": allow or "(empty — all recipients permitted)",
+    }, indent=2)
+
+
+@mcp.tool()
+def iris_create_draft(
+    to: list[str],
+    subject: str,
+    body: str,
+    cc: list[str] | None = None,
+    bcc: list[str] | None = None,
+    html: bool = False,
+    reply_to_message_id: str | None = None,
+) -> str:
+    """Compose a message into the staging mail folder (IRIS_DRAFT_FOLDER,
+    default "AI Drafts"; created on first use). It is NOT sent — a human opens
+    Outlook and presses Send. Set reply_to_message_id to draft a threaded
+    reply to an existing message."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not to:
+        return "at least one 'to' recipient is required"
+    if len(body) > MAX_BODY:
+        return f"body too large ({len(body)} chars, max {MAX_BODY})"
+
+    everyone = _flatten(to, cc, bcc)
+    malformed = [a for a in everyone if not EMAIL_RE.match(a)]
+    if malformed:
+        return f"malformed addresses: {', '.join(malformed)}"
+    problem = _check_recipients(everyone)
+    if problem:
+        return problem
+
+    token, err = _token()
+    if err:
+        return err
+
+    content_type = "HTML" if html else "Text"
+
+    if reply_to_message_id:
+        draft, code = _graph("POST", f"/me/messages/{reply_to_message_id}/createReply", token)
+        if code not in (200, 201):
+            return f"createReply failed {code}: {json.dumps(draft)[:400]}"
+        draft_id = draft.get("id")
+        patch = {
+            "body": {"contentType": content_type, "content": body},
+            "toRecipients": _recips(to),
+        }
+        if subject:
+            patch["subject"] = subject
+        if cc:
+            patch["ccRecipients"] = _recips(cc)
+        if bcc:
+            patch["bccRecipients"] = _recips(bcc)
+        out, code = _graph("PATCH", f"/me/messages/{draft_id}", token, json=patch)
+        if code != 200:
+            return f"draft created but patch failed {code}: {json.dumps(out)[:400]}"
+        # createReply lands it in Drafts; relocate to the staging folder.
+        # NOTE: a move returns a NEW message id, so rebind out.
+        folder_id, ferr = _ensure_folder(token)
+        if ferr:
+            return ferr
+        if folder_id != "drafts":
+            moved, code = _graph(
+                "POST", f"/me/messages/{draft_id}/move", token,
+                json={"destinationId": folder_id},
+            )
+            if code not in (200, 201):
+                return f"drafted but move failed {code}: {json.dumps(moved)[:400]}"
+            out = moved
+    else:
+        payload = {
+            "subject": subject,
+            "body": {"contentType": content_type, "content": body},
+            "toRecipients": _recips(to),
+        }
+        if cc:
+            payload["ccRecipients"] = _recips(cc)
+        if bcc:
+            payload["bccRecipients"] = _recips(bcc)
+        folder_id, ferr = _ensure_folder(token)
+        if ferr:
+            return ferr
+        out, code = _graph(
+            "POST", f"/me/mailFolders/{folder_id}/messages", token, json=payload
+        )
+        if code not in (200, 201):
+            return f"draft creation failed {code}: {json.dumps(out)[:400]}"
+
+    _audit("draft", f"to={','.join(to)} subject={subject!r} id={out.get('id')}")
+    return json.dumps({
+        "status": "draft created — NOT sent",
+        "folder": DRAFT_FOLDER or "Drafts",
+        "id": out.get("id"),
+        "subject": out.get("subject"),
+        "to": [r["emailAddress"]["address"] for r in out.get("toRecipients", [])],
+        "webLink": out.get("webLink"),
+        "next": f"open the {DRAFT_FOLDER or 'Drafts'} folder in Outlook, read it, press Send",
+    }, indent=2)
+
+
+@mcp.tool()
+def iris_list_drafts(limit: int = 10) -> str:
+    """List recent messages sitting in the staging mail folder."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    limit = max(1, min(int(limit), 50))
+    token, err = _token()
+    if err:
+        return err
+    folder_id, ferr = _ensure_folder(token)
+    if ferr:
+        return ferr
+    q = (f"/me/mailFolders/{folder_id}/messages?$top={limit}"
+         "&$select=id,subject,toRecipients,createdDateTime,webLink"
+         "&$orderby=createdDateTime desc")
+    body, code = _graph("GET", q, token)
+    if code != 200:
+        return f"graph error {code}: {json.dumps(body)[:400]}"
+    items = [{
+        "id": m.get("id"),
+        "subject": m.get("subject"),
+        "to": [r["emailAddress"]["address"] for r in m.get("toRecipients", [])],
+        "created": m.get("createdDateTime"),
+        "webLink": m.get("webLink"),
+    } for m in body.get("value", [])]
+    return json.dumps(items, indent=2)
+
+
+@mcp.tool()
+def iris_update_draft(
+    draft_id: str,
+    subject: str | None = None,
+    body: str | None = None,
+    to: list[str] | None = None,
+    cc: list[str] | None = None,
+    bcc: list[str] | None = None,
+    html: bool = False,
+) -> str:
+    """Revise an existing draft in place. Only the fields you pass are changed."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    patch: dict = {}
+    if subject is not None:
+        patch["subject"] = subject
+    if body is not None:
+        if len(body) > MAX_BODY:
+            return f"body too large ({len(body)} chars, max {MAX_BODY})"
+        patch["body"] = {"contentType": "HTML" if html else "Text", "content": body}
+    for field, val in (("toRecipients", to), ("ccRecipients", cc), ("bccRecipients", bcc)):
+        if val is not None:
+            patch[field] = _recips(val)
+    if not patch:
+        return "nothing to update — pass at least one field"
+
+    everyone = _flatten(to, cc, bcc)
+    if everyone:
+        malformed = [a for a in everyone if not EMAIL_RE.match(a)]
+        if malformed:
+            return f"malformed addresses: {', '.join(malformed)}"
+        problem = _check_recipients(everyone)
+        if problem:
+            return problem
+
+    token, err = _token()
+    if err:
+        return err
+    out, code = _graph("PATCH", f"/me/messages/{draft_id}", token, json=patch)
+    if code != 200:
+        return f"update failed {code}: {json.dumps(out)[:400]}"
+    _audit("update", f"id={draft_id} fields={','.join(patch)}")
+    return json.dumps({
+        "status": "draft updated — still NOT sent",
+        "id": out.get("id"),
+        "subject": out.get("subject"),
+        "webLink": out.get("webLink"),
+    }, indent=2)
+
+
+@mcp.tool()
+def iris_delete_draft(draft_id: str, confirm: bool = False) -> str:
+    """Delete a draft. Destructive, so confirm=true is required — set it only
+    after the human has explicitly approved deleting this specific draft."""
+    if _disabled():
+        return "iris is DISABLED (kill switch engaged)"
+    if not confirm:
+        return ("refusing to delete without confirm=true. Ask the human first, "
+                "then retry with confirm=true.")
+    token, err = _token()
+    if err:
+        return err
+    out, code = _graph("DELETE", f"/me/messages/{draft_id}", token)
+    if code not in (200, 204):
+        return f"delete failed {code}: {json.dumps(out)[:400]}"
+    _audit("delete", f"id={draft_id}")
+    return f"draft {draft_id} deleted"
+
+
+def main() -> None:
+    """Console-script entry point."""
+    mcp.run()
+
+
+if __name__ == "__main__":
+    main()