office365-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PORT | No | Listen port for the plain Node entry point. Unused on Lambda and Azure Functions. | 3000 |
| O365_SCOPES | No | Space-separated wholesale override. Validated on load: /.default may not be mixed with named scopes (AADSTS70011), and offline_access is mandatory. | |
| MCP_AUDIT_FILE | No | JSONL sink for audit and security records, in addition to stderr. For self-hosted deployments; on Lambda, stderr already reaches CloudWatch. | |
| MCP_GRAPH_FILE | No | JSON-file fallback for self-hosting and development. Ignored when MCP_GRAPH_TABLE is set; not viable on Lambda. | |
| MCP_OAUTH_FILE | No | JSON-file fallback for the same state, so npm run dev can run the real browser sign-in flow without AWS. Ignored when MCP_OAUTH_TABLE is set; not viable on Lambda, where each container would see different state. | |
| MCP_USERS_FILE | No | JSON user store for self-hosting and development. Ignored when MCP_USERS_TABLE is set. | |
| MCP_AUDIT_READS | No | 1 audits read tools as well as writes. Off by default because reads dominate volume. Independently of this setting, every mutating call, every failure, and every call naming another mailbox or user is always recorded – acting on someone else's mailbox is exactly what a compliance review asks about. | |
| MCP_GRAPH_TABLE | No | DynamoDB table for sealed refresh tokens (no TTL) and cached access tokens (TTL). Deliberately separate from the OAuth table so credentials get their own IAM boundary and backup policy. | |
| MCP_OAUTH_TABLE | No | DynamoDB table for our own OAuth state – registered clients, login states, auth codes, refresh tokens. TTL on expiresAt. | |
| MCP_USERS_TABLE | No | DynamoDB table for users and policies, with keyPrefix-index and oid-index GSIs. | |
| O365_GRAPH_BASE | No | Change only for sovereign clouds, where several capabilities used here do not exist. | https://graph.microsoft.com/v1.0 |
| O365_USER_AGENT | No | Microsoft deprioritises undecorated traffic. Keep the documented shape and put your own company name in the middle field. | NONISV|SelfHosted|office365-mcp/0.1.0 |
| O365_BODY_FORMAT | No | text requests plain-text bodies, which is what a model-facing server wants – HTML bodies are dominated by tracking markup. | text |
| MCP_OUTPUT_FORMAT | No | toon emits compact tabular output that materially cuts token use on listings; json emits pretty JSON for programmatic consumers. | toon |
| MCP_SHARED_SECRET | No | Legacy single-admin bearer that bypasses the user store. Useful for smoke tests. It has no Graph connection of its own, so Graph tools return a reconnect error unless it maps to a user who has signed in. | |
| O365_IMMUTABLE_IDS | No | Sends Prefer: IdType="ImmutableId" on Outlook calls so ids survive a move. Decide once at first deployment and never flip it on a live stack. | true |
| O365_SCOPE_PROFILE | No | work includes the shared-mailbox, SharePoint-site and Teams-channel scopes, several of which need one tenant-admin consent. personal requests only user-consentable scopes. | work |
| O365_SEARCH_REGION | No | SharePoint geography (NAM, EUR, APC) for POST /search/query. Required for app-only search; set it explicitly on multi-geo tenants. | |
| O365_TOKEN_ENC_KEY | Yes | <kid>:<base64 32 bytes> – seals every stored Entra refresh token and cached access token. npm run gen:enc-key. Losing it breaks every stored connection permanently. | |
| MCP_ARTIFACT_BUCKET | No | S3 bucket for downloads. Required by every download tool – there is no base64 fallback by design. | |
| MCP_ARTIFACT_REGION | No | Overrides the region for the artifact bucket. | AWS_REGION |
| O365_APP_ONLY_SITES | No | Comma-separated site ids or URLs reachable with application credentials, enforced on every site- or drive-addressed call made with an app-only actor. An empty list means app-only never reaches SharePoint at all, and an app-only call that names no site is refused rather than allowed. Matching is case-insensitive and either exact or a prefix that ends on a / path boundary, so an entry can cover a site and everything under it without a shorter reference widening access. Pairs with a Sites.Selected registration. | |
| O365_ALLOWED_TENANTS | No | Comma-separated tenant ids accepted when running multi-tenant. Checked at sign-in and again on every request, so removing a tenant here locks out its existing connections immediately rather than at their next login. Empty with common means any tenant that consents can connect; the server warns loudly at startup. | |
| O365_APP_ONLY_ENABLED | No | Master switch for app-only mode. While false the code path is unreachable regardless of any allowlist. | false |
| O365_GRAPH_TIMEOUT_MS | No | Per-request timeout, kept well under the client's 300-second tool timeout. | 30000 |
| OAUTH_ENTRA_CLIENT_ID | Yes | Application (client) ID. The registration must use platform type Web. | |
| OAUTH_ENTRA_TENANT_ID | Yes | Tenant GUID or verified domain. Every call targets this concrete tenant – /common causes token-cache misses and needless re-auth, and is invalid for client credentials. common / organizations turn the deployment multi-tenant. | |
| OAUTH_SIGNING_KEY_KID | No | Key id in the JWKS and token headers. Change it alongside a keypair rotation. Default primary. | primary |
| O365_APP_ONLY_MAILBOXES | No | Comma-separated mailbox addresses reachable with application credentials. A wildcard is rejected outright. | |
| OAUTH_SIGNING_KEY_PUBLIC | Yes | Base64 SPKI PEM of the matching public key. Published at /.well-known/jwks.json. | |
| OAUTH_ENTRA_CLIENT_SECRET | No | Client secret. Simplest, but Entra caps its lifetime at 24 months. | |
| OAUTH_SIGNING_KEY_PRIVATE | Yes | Base64 PKCS#8 PEM of the RS256 key signing our MCP access tokens. npm run gen:oauth-key. | |
| OAUTH_CIMD_ALLOWED_CLIENTS | No | Comma-separated Client ID Metadata Document URLs accepted as client_ids (Claude Code's is https://claude.ai/oauth/claude-code-client-metadata). Empty accepts any https URL whose document validates, which is the spec default. | |
| O365_ALLOW_PERMANENT_DELETE | No | Deployment-level lock on o365_mail_delete mode permanent, on top of the per-user policy. | false |
| OAUTH_ENTRA_CLIENT_CERT_PEM | No | PKCS#8 PEM private key (literal or base64) for certificate client authentication. Preferred in production. | |
| MCP_ARTIFACT_URL_TTL_SECONDS | No | Lifetime of presigned URLs. Anyone holding one can fetch the file without authenticating, so keep it short. | 3600 |
| O365_TOKEN_ENC_KEYS_PREVIOUS | No | Comma-separated retired keys in the same form, accepted for decryption only. This is what makes rotation a rolling operation rather than a flag day. | |
| O365_MAX_CONCURRENCY_PER_MAILBOX | No | In-flight cap per (application, mailbox). Exchange allows exactly four; the value is clamped there because raising it only converts throughput into 429s. | 4 |
| OAUTH_ENTRA_CLIENT_CERT_THUMBPRINT | No | Hex SHA-1 thumbprint as shown in the portal. Entra matches the assertion to the certificate by thumbprint, so both halves are required. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues