xtium-sharepoint-mcp

A local, read-only SharePoint connector for MCP desktop clients. It runs on the user's device, signs in as that user with the customer's own Entra public-client app, and calls Microsoft Graph directly. No XTIUM service sees tokens or file content.

This is the pilot for AIDATA-3958. The design is in ADR 0001.

Tools

Related MCP server: M365 MCP

Setup

1. Register the app (tenant admin, once)

Create an Entra app registration in the customer tenant with these settings:

• Supported account types: this organisational directory only.

• Platform: Mobile and desktop applications, with redirect URI http://localhost.

• Allow public client flows: Yes. Do not create a secret or certificate.

• API permissions: Microsoft Graph delegated User.Read, Sites.Read.All, Files.Read.All, offline_access, openid and profile. Grant admin consent if users cannot consent themselves.

Record the tenant ID and application (client) ID. Neither is a secret, but keep them out of tickets anyway; the customer owns them.

For a QA tenant, scripts/provision_test_app.py --tenant <id> --create --grant-consent does the same steps and writes the IDs to local/test_app.json (gitignored).

2. Install

uv sync

3. Add it to Claude Desktop

Preferred (pilot packaging): Claude plugin + embedded MCPB so users enter tenant/client IDs in Claude’s UI:

1. Build: .\scripts\pack_mcpb.ps1 → dist/xtium-sharepoint-0.1.0.mcpb

2. Install MCPB: Settings → Extensions → Install Extension… (or double-click / drag), or install the plugin once it is listed / sideloaded

3. Enter Entra tenant ID and application (client) ID, then finish

Directory listing uses a plugin submission (not the remote MCP connector form): docs/directory-submission.md.
Install details: docs/mcpb-install.md.

Developer fallback — edit Claude’s mcpServers JSON (MSIX path is under %LOCALAPPDATA%\Claude-Data\…\claude_desktop_config.json):

{
  "mcpServers": {
    "xtium-sharepoint": {
      "command": "C:\\path\\to\\xtium-sharepoint-mcp\\.venv\\Scripts\\xtium-sharepoint-mcp.exe",
      "args": ["serve"],
      "env": {
        "XTIUM_SP_TENANT_ID": "<tenant id>",
        "XTIUM_SP_CLIENT_ID": "<client id>"
      }
    }
  }
}

Claude Code and Cursor take the same command, args and env. Each host is verified separately; see the test packet.

4. Sign in

Ask the assistant to run sharepoint_sign_in, or run this first:

.venv\Scripts\xtium-sharepoint-mcp.exe sign-in

If the client does not refresh its tool list after sign-in, restart it.

Optional settings

Support

• Disconnect: run sharepoint_sign_out or xtium-sharepoint-mcp sign-out. To wipe everything, delete %LOCALAPPDATA%\xtium-sharepoint-mcp.

• Revoke a user: in Entra, revoke the user's sessions or remove the app's consent. The connector asks them to sign in again at the next token refresh (within about an hour).

• Correlate an error: each error and each audit line carries the Graph request-id and a client-request-id. The audit log is at %LOCALAPPDATA%\xtium-sharepoint-mcp\audit\audit-YYYY-MM-DD.jsonl and contains hashed identifiers only.

Privacy Policy

This connector is designed so XTIUM does not host SharePoint content or Microsoft tokens.

Customer Entra admins remain responsible for app consent, Conditional Access, and user revocation in their tenant.

Development

uv run pytest
uv run ruff check src tests
uv run python scripts/smoke_stdio.py                    # stdio round trip as a host would run it
uv run python scripts/smoke_stdio.py sharepoint_search '{"query":"budget"}'
.\scripts\pack_mcpb.ps1                                 # Claude Desktop / plugin MCPB