Claude-Read-Outlook-Attachments
M365 附件读取器 MCP 本地版
这是一个用于 Claude Desktop 的本地 stdio MCP 服务器,可通过 Microsoft Graph API 读取 Outlook 电子邮件及其附件。
状态:适用于个人单用户在 Claude Desktop 上本地使用。
为什么存在此项目
Claude 内置的 Microsoft 365 连接器可以列出电子邮件、读取邮件正文并查看日历。但它无法读取电子邮件附件中的实际内容。
这意味着当你问“我最新邮件里的 PDF 说了什么?”时,Claude 可以看到附件的元数据,但无法看到其中的文本、表格、图像或嵌套文档。
本项目填补了这一空白——完全在你的本地机器上通过 stdio 运行,无需任何公共端点或隧道。
Related MCP server: Outlook MCP Python
认可 / 分发
收录于
punkpeye/awesome-mcp-servers,这是一个由社区策划的主要 MCP 服务器注册表。被 Glama 索引,并带有 MCP 服务器评分徽章。
它能做什么
此服务器作为由 Claude Desktop 启动的本地 MCP 进程运行。它能够:
通过设备代码流 (device code flow) 对 Microsoft 365 进行身份验证
通过 Microsoft Graph 列出 Outlook 电子邮件及其附件
在本地下载并解析附件内容
将结构化文本和图像块直接返回给 Claude Desktop
支持的格式
格式 | 提取内容 |
全文内容 | |
扫描版 PDF | OCR 文本,以及可选的渲染页面图像 |
DOCX | 文本和嵌入图像 |
DOC | 文本内容 |
PPTX / PPTM / PPSX / POTX | 幻灯片文本、备注和嵌入图像 |
PPT | 尽力而为的旧版文本提取 |
XLSX / XLS / CSV | 所有工作表转换为 CSV |
JPG / JPEG / PNG / GIF / WEBP / BMP / TIFF | 作为 MCP 图像块返回以进行视觉分析 |
ZIP / RAR / 7Z | 递归解析归档内容 |
MSG | 主题、发件人、正文和嵌入附件 |
TXT / MD / JSON / XML / HTML | 原始文本 |
Outlook | 文本内容 |
MCP 工具
工具 | 描述 |
| 检查服务器是否存活 |
| 启动设备代码登录流程 |
| 检查身份验证状态 |
| 列出最近的 Outlook 电子邮件 |
| 列出特定电子邮件的附件 |
| 下载、解析并返回附件内容 |
实际应用场景
零售 / 销售运营
“拉取最近 5 封每日仪表板邮件,读取 Excel 附件,并分析过去一周所有门店的销售趋势。”
金融 / 会计
“找到我们供应商发来的主题中包含‘发票’的最新邮件,读取 PDF 附件,并提取总金额、到期日期和明细项目。”
法律 / 合同审查
“打开 legal@partner.com 发来的最新邮件,读取 Word 或 PowerPoint 附件,并总结关键条款。”
人力资源 / 招聘
“查找 recruiting@company.com 发来的带有附件的邮件,读取每份简历 PDF,并创建一个候选人对比表。”
先决条件
Windows 10/11、macOS 或 Linux
Claude Desktop
Microsoft 365 / Outlook 账户
Microsoft Entra 应用注册(见下文第 1 步)
设置
1. 创建 Microsoft Entra 应用注册
前往 Microsoft Entra 管理中心 → 应用注册 → 新注册。
名称: 任意名称,例如
m365-mcp-local支持的账户类型: 任何组织目录中的账户和个人 Microsoft 账户
然后:
从“概览”页面复制 应用程序 (客户端) ID
前往 身份验证 → 启用 允许公共客户端流 → 保存
前往 API 权限 → 添加权限 → Microsoft Graph → 委托权限 → 添加
User.Read和Mail.Read→ 授予管理员同意前往 清单 → 找到
requestedAccessTokenVersion(可能嵌套在api内部) → 设置为2→ 保存
为什么要执行第 4 步? 当你的应用支持个人 Microsoft 账户时,Microsoft Entra 要求访问令牌为 v2 版本。门户网站并不总是自动设置此项,如果令牌版本仍为
null或1,common端点将因AADSTS50059而失败。如果你跳过此步骤,在begin_auth期间会收到invalid_grant错误。
使用 v1 API 集成? 仅当你的所有 Graph/API 权限都支持 v2 令牌时(所有 Microsoft Graph 委托权限都支持),才将其设置为
2。如果你集成的自定义 API 仅接受 v1 令牌,请使用M365_TENANT_ID=consumers(仅限个人账户)或特定的租户 ID 代替common,并将requestedAccessTokenVersion保持为默认值。
2. 克隆并安装
git clone https://github.com/Zacccck/Claude-MCP-Read-Email-Attachments.git
cd Claude-MCP-Read-Email-Attachments
npm install3. 配置环境变量
复制示例文件:
cp .env.example .env编辑 .env 并填入你的客户端 ID:
M365_CLIENT_ID=your-application-client-id-here
M365_TENANT_ID=common
M365_AUTO_OPEN_BROWSER=true变量参考:
变量 | 必需 | 描述 |
| ✅ 是 | 你的 Entra 应用的应用程序 (客户端) ID |
| 否 | 默认 |
| 否 | 设置为 |
| 否 | 身份验证缓存的自定义路径;如果省略则自动检测 |
4. 查找你的 Node.js 路径
在下一步中,你需要 node.exe (Windows) 或 node (macOS/Linux) 的完整路径。
# Windows
where.exe node
# macOS / Linux
which node示例输出:C:\Program Files\nodejs\node.exe
5. 打开 Claude Desktop 的配置文件
找到并打开适用于你平台的配置文件:
平台 | 路径 |
Windows (标准) |
|
Windows (商店版) |
|
macOS |
|
如果文件尚不存在,请创建它。
6. 将服务器添加到 Claude Desktop
将以下条目添加到 claude_desktop_config.json:
{
"mcpServers": {
"m365-attachment-reader-local": {
"command": "C:\\Program Files\\nodejs\\node.exe",
"args": [
"C:\\path\\to\\Claude-MCP-Read-Email-Attachments\\server.mjs"
],
"env": {
"M365_CLIENT_ID": "your-client-id",
"M365_TENANT_ID": "common",
"M365_AUTO_OPEN_BROWSER": "true"
}
}
}
}提示:
在
command中使用第 4 步中的完整绝对路径。将
args[0]替换为你机器上server.mjs的实际路径。如果你的配置中已经有其他 MCP 服务器,请将此条目合并到现有的
mcpServers对象中——不要覆盖整个文件。
7. 重启 Claude Desktop
完全退出 Claude Desktop 并重新打开。Claude Desktop 会自动启动 MCP 服务器——你无需手动运行 node server.mjs。
8. 使用 Microsoft 365 进行身份验证
在 Claude Desktop 中输入:
Please call begin_auth浏览器窗口将打开(或者你会收到一个登录 URL + 设备代码)。完成 Microsoft 登录流程,然后验证:
Please call auth_status你应该能看到你的 Microsoft 账户已列为已验证。
9. 验证其工作正常
运行快速健康检查:
Please call health_check然后尝试一个真实的请求:
Show me my recent Outlook emails with attachmentsSummarize the contents of the attachments from the latest email建议的 Claude 提示词
Please call begin_authPlease call auth_statusShow me my recent Outlook emails with attachmentsSummarize the contents of the attachments from the emailFind the latest invoice email and extract the total amount, due date, and line items from the PDF attachment故障排除
问题 | 解决方案 |
Claude 找不到 MCP 工具 | 完全重启 Claude Desktop。检查配置中的 |
日志中出现 | 几乎总是 Entra 应用上的令牌版本或账户类型不匹配。请参阅下两行。 |
| 你的应用不支持 |
保存账户类型时出现 | 打开 Entra 应用 → 清单 → 将 |
未显示设备代码 | 确保已成功调用 |
想要切换 Microsoft 账户 | 重启 Claude Desktop 并在隐私浏览器窗口中再次调用 |
调试日志位置 |
|
手动开发运行
如需在 Claude Desktop 之外进行调试,请手动启动服务器:
cd Claude-MCP-Read-Email-Attachments
node .\server.mjs注意: 不要在该终端中输入内容。这是一个
stdioMCP 进程,期望在标准输入/输出上接收 MCP 客户端指令。
Docker
包含一个用于容器化测试的 Dockerfile:
docker build -t m365-attachment-reader-mcp-local .
docker run --rm -i `
-e M365_CLIENT_ID=your-client-id `
-e M365_TENANT_ID=common `
-e M365_AUTO_OPEN_BROWSER=false `
m365-attachment-reader-mcp-local容器仍然作为
stdio服务器运行。对于日常的 Claude Desktop 使用,第 6 步中的直接node方法更简单。
项目结构
Claude-MCP-Read-Email-Attachments/
├── server.mjs
├── package.json
├── manifest.json
├── server.json
├── glama.json
├── Dockerfile
├── .env.example
├── .gitignore
├── LICENSE
└── README.md限制
仅限单用户 — 一个服务器实例一次支持一个 Microsoft 账户
身份验证状态在内存中 — 重启服务器需要重新进行身份验证
你必须创建自己的 Entra 应用并提供自己的客户端 ID
超大图像可能会被缩小或跳过,以保持在 Claude Desktop 的负载限制内
旧版
.xls解析是尽力而为的,可靠性不如.xlsx不适合公共或多用户托管
许可证
MIT
Available Tools
6 toolsauth_statusMicrosoft 365 Auth StatusA
Check whether Microsoft 365 login for this local MCP process has completed.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states 'check whether login has completed' without disclosing what 'completed' means, return format, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single 10-word sentence, front-loaded with verb and resource, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Minimal for a simple tool; lacks explanation of what 'completed' means or what the output looks like. Without output schema, more detail would help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters in schema; description adds context about 'local MCP process', which is useful. Baseline 4 for 0 params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'Check whether' and the resource 'Microsoft 365 login for this local MCP process'. Distinguishes from siblings like begin_auth and health_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage after beginning auth or to check login state, but no explicit when-to-use or when-not-to-use compared to alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
begin_authBegin Microsoft 365 AuthA
Start Microsoft 365 device-code login for the local Claude Desktop MCP process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only says 'start' without explaining the device-code flow, user interaction required, or what the tool returns. This lacks transparency about the process and side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states purpose without unnecessary words. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (initiating an authentication flow), the description is insufficient. It omits expected return values, required user action (e.g., entering device code), and how to proceed after the call. An output schema or more descriptive text would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters (100% coverage by schema). For zero-parameter tools, the baseline is 4. The description adds no param-level details, but no details are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Start Microsoft 365 device-code login for the local Claude Desktop MCP process.' It uses a specific verb ('Start') and resource ('Microsoft 365 device-code login'), and distinguishes itself from siblings like 'auth_status' which likely checks authentication state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates the tool's function (initiate device-code login) but provides no explicit guidance on when to use it versus alternatives like 'auth_status'. It does not mention prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
health_checkHealth CheckA
Verify that the local Outlook attachment reader MCP server is running and report auth state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description clearly conveys two behaviors: verifying server running and reporting auth state. Adequate for a simple tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with key info, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with no parameters or output schema; description covers essential purpose and behavior, though response format is unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters, schema coverage 100%, baseline score of 4 applies; description adds no parameter info but none needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool verifies server running and reports auth state, with specific verb 'verify' and resource 'server and auth state'. Distinguishes from siblings like auth_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage as a health check before other operations, but no explicit when-not or alternatives guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_email_attachmentsList Email AttachmentsC
List attachments for a specific Outlook email.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes | ||
| mailbox | No | me |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose behavioral traits such as pagination, limits, or whether it returns metadata vs. content. The agent has no insight into side effects or safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) but lacks structure. It is too minimal, omitting critical information that could be front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations, output schema, and parameter descriptions, the single sentence is insufficient. More context about usage and return value is necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain what the messageId parameter represents or the significance of the mailbox parameter (default 'me'). Elaboration on these is needed for correct usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and resource ('attachments for a specific Outlook email'). It distinguishes from sibling tools like list_recent_messages (lists emails) and read_email_attachment (reads a single attachment).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention prerequisites (e.g., needing a messageId from list_recent_messages) or when to use read_email_attachment instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_recent_messagesList Recent Outlook MessagesB
List recent Outlook emails from Microsoft 365. By default this searches the Inbox, prefers emails with attachments, and can filter by subject or sender name/address.
| Name | Required | Description | Default |
|---|---|---|---|
| mailbox | No | me | |
| folder | No | inbox | |
| top | No | ||
| onlyWithAttachments | No | ||
| subjectContains | No | ||
| fromContains | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, description carries full burden. It discloses default search location and preference for attachments, but omits auth needs, rate limits, pagination, and behavior of 'recent'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no redundant words. Clear structure, though 'prefers' is slightly ambiguous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers core functionality but lacks details on return format, error handling, and auth. Given 6 params and no output schema, more context is warranted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, description adds meaning for most parameters (onlyWithAttachments, subjectContains, fromContains, folder, mailbox) but omits 'top' and uses vague 'prefers'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists recent Outlook emails, specifies scope (Inbox default), and mentions filtering by subject and sender. Distinct from sibling attachment tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use versus alternatives like list_email_attachments or read_email_attachment. Does not state prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_email_attachmentRead Email AttachmentA
Download an Outlook attachment directly from Microsoft Graph and parse it locally. Supports PDF, OCR-scanned PDF, Word, PowerPoint, Excel, images, archives, MSG, and plain text. Large image previews are automatically downscaled to fit MCP payload limits.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes | ||
| attachmentId | Yes | ||
| mailbox | No | me |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses supported file formats and automatic downscaling of large image previews, which are important behavioral traits. However, it omits details like auth requirements or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no extraneous words. The first sentence states the core purpose, the second adds key details (formats, size handling). Very efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, so the agent must infer the return format. The description does not explain what the tool returns (e.g., binary data, base64, parsed text) or how the IDs are used. Incomplete for a tool with no annotations and no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has three parameters with no descriptions. The description does not explain what messageId, attachmentId, or mailbox represent or how to obtain them, leaving the agent without guidance despite the schema having 0% coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (download and parse) and resource (Outlook attachment). It differentiates from sibling tools like list_email_attachments and list_recent_messages by specifying it downloads and parses a single attachment's content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for reading attachment content after listing attachments, but does not explicitly state when to use or when not to, nor does it mention alternatives or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
auth_status - First observed
begin_auth - First observed
health_check - First observed
list_email_attachments - First observed
list_recent_messages - First observed
read_email_attachment
TDQS
Scored across 6 tools
Tools are mostly distinct: auth_status and begin_auth handle authentication, health_check monitors server, list_recent_messages finds emails, list_email_attachments shows attachments for a specific email, and read_email_attachment downloads/parses attachments. However, list_recent_messages and list_email_attachments could be confused if descriptions are glossed over, as both relate to emails and attachments.
Naming patterns are mixed: some tools start with verbs (begin_auth, list_recent_messages, list_email_attachments, read_email_attachment) while others are nouns (auth_status, health_check). The verb+noun pattern is not consistently applied, reducing predictability.
With 6 tools, the server is well-scoped for its purpose. It covers authentication (begin_auth, auth_status), server health (health_check), email discovery (list_recent_messages), attachment listing (list_email_attachments), and attachment reading (read_email_attachment). No extraneous tools.
The tool surface covers the core workflow: authenticate, find emails with attachments, list attachments, and read them. Minor gaps include lack of tools for getting email metadata beyond attachments or searching other folders, but these are acceptable for an attachment-focused server.
Maintenance
Related MCP Connectors
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
A MCP server for Outlook email that lets you search, read, and draft emails and replies.
Related MCP Servers
- AlicenseAqualityDmaintenanceMCP server for Claude to access Outlook data via Microsoft Graph API20621MIT
- FlicenseNot gradedqualityDmaintenanceA Python-based MCP server for Microsoft Outlook integration using Microsoft Graph API, enabling email reading/sending, calendar management, and contact operations through Claude Desktop.1-
- AlicenseNot gradedqualityDmaintenanceMCP server that enables Claude to manage Outlook emails, including reading, sending, organizing, drafting, and bulk operations via Microsoft Graph API.151MIT
- AlicenseAqualityCmaintenanceA local MCP server that connects Claude Desktop to a personal Hotmail/Outlook.com mailbox via Microsoft Graph API, enabling email management, rule handling, and composing messages.25MIT