MS 365-21V MCP Server
The MS 365-21V MCP Server provides AI clients with delegated access to Microsoft 365 services in the 21Vianet (China) environment via OAuth 2.1 and Streamable HTTP, covering email, calendar, files, SharePoint, Teams, and organizational data.
Authentication & Session Management
Check authentication and authorization status
Start and complete local device-code login (development only)
Clear local authentication cache
Execute previously approved sensitive operations using confirmation tokens
User & Organization Management
Get the signed-in user's profile
List, search, and get detailed profiles of organization users
Get a user's manager or list direct reports
List group memberships for a user
List, get details of, and browse members/owners of Entra/Microsoft 365 groups
Check group membership (including transitive)
List, search, and read messages (including unread and recent)
Manage folders: list, get, create, rename, delete, browse children
Send, draft, reply, forward, move, copy, and delete messages
Mark messages as read/unread
Handle attachments: list, read, add (base64 up to 3 MB), delete
Calendar
List events by time range and view calendar details
Manage calendars: list, create, rename, delete
Create, update, cancel, delete events, and respond to invitations
Query free/busy availability for users, rooms, or distribution lists
Handle recurring events and attachments (list, add, delete)
OneDrive
Get drive metadata and quota
List, search, and browse files/folders (including recent)
Download (base64 up to 10 MB) and upload small files
Create folders, rename, move, copy, delete items
Manage sharing: create links, invite people, list permissions
List and restore file version history
SharePoint
Search sites, get site details by ID or hostname/path
List, create, update, delete lists and manage columns
CRUD operations on list items, with delta sync support
Manage document libraries: browse, search, get items; create folders, upload/delete files
Download files as base64 (up to 10 MB)
Smart Aggregation
Summarize emails intelligently
Analyze calendar conflicts
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MS 365-21V MCP ServerCheck my calendar for tomorrow's meetings"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MS 365-21V MCP Server
让支持 MCP 的 AI 客户端,以你的身份使用世纪互联 Microsoft 365。
查询邮件、安排日程、检索 OneDrive 和 SharePoint,连接 Microsoft Graph 中国区;保留用户权限、操作确认和审计边界。
快速上手 · 完整部署 · 使用场景 · 工具目录 · English
一键接入(已有管理员部署)
管理员部署好服务并分配使用权限后,按对应客户端的方式添加 MCP 地址,再完成 OAuth 登录;不需要在客户端手动填写 client id / secret。
Claude Code:在项目根目录的 .mcp.json 中加入以下配置;已有 mcpServers 时合并其中的服务条目:
{
"mcpServers": {
"ms365-21v": {
"type": "http",
"url": "https://your-mcp-host.example.cn/mcp"
}
}
}把 url 换成管理员给你的地址,启动 Claude Code 后运行 /mcp,按提示登录。Claude Code 官方说明
Claude Desktop:在 Customize(自定义)→ Connectors(连接器)→ Add custom connector(添加自定义连接器) 中填写远程 MCP 地址,按提示连接并登录。不要把上面的 Claude Code JSON 直接放进 Desktop 的本地配置。远程连接由 Anthropic 云端发起,服务地址需允许其访问,不能填写你电脑的 localhost。Claude Desktop 官方说明
使用 WorkBuddy、Qoder Work、Codex 或 Dify?看客户端接入说明。自己从零部署?看快速上手。
非 Microsoft 或 21Vianet 官方产品。需要世纪互联租户和管理员授权,不适用于直接连接全球版 Microsoft 365 或个人 Outlook 账号。本文中的业务示例需要对应模块与权限,初始配置只开放个人资料查询。
Related MCP server: MS 365-21V MCP Server
先看它能帮你做什么
你对 AI 说 | 能力 | 启用条件 |
“获取我的个人资料,确认当前登录账号。” | 验证 OAuth → Graph 链路 | 快速上手的默认场景 |
“列出最近 5 封邮件,只显示主题和发件人。” | 邮件读取 | Mail 模块、 |
“检查明天的会议是否有时间冲突。” | 日程冲突分析 | Calendar + Smart 模块、对应权限与角色 |
“在我的 OneDrive 中查找项目计划。” | 文件检索 | OneDrive 模块、 |
“整理回复内容,发送前让我确认。” | 邮件写入与确认 | 额外写权限;保持 |
工具会返回数据供 AI 客户端使用,不会因为接入 MCP 而授予用户原本没有的数据权限。完整角色、scope 和工具映射见工具目录。
为什么专门做一个 21V 版本
中国区身份与数据端点:围绕 21V Entra 和 Microsoft Graph 中国区设计,而不是只替换全球版服务的域名。
客户端接入更统一:Streamable HTTP + OAuth bridge,通过一个 MCP 地址连接;服务端使用当前用户的 delegated permissions / OBO。
可控制的工具与写操作:App Roles、按模块与 scope 过滤、常用工具直达/长尾工具发现,以及确认与脱敏审计。
覆盖邮件、日历、OneDrive、SharePoint、Teams、联系人、组织用户、Microsoft Search 和智能聚合。代码中实现了工具,不等于你的租户已授权,也不等于每个全球云 API 都在 21V 可用。
快速开始
只使用别人已经部署好的服务?
不需要克隆仓库,也不需要自己创建 Entra 应用。向管理员获取 HTTPS MCP 地址及使用权限,在支持 Streamable HTTP 和 OAuth 的客户端添加它,然后登录。参见用户使用说明。
第一次部署?从“读取我的资料”开始
准备 Node.js 22+、Git,以及能配置 Entra 应用、同意权限并分配角色的管理员。先按快速上手完成单应用配置,再运行:
git clone https://github.com/mdwsk88/ms-365-21v-mcp-server.git
cd ms-365-21v-mcp-server
npm run setup向导只询问 Tenant ID、API Client ID 和服务地址。它生成最小 .env,不会覆盖已有文件,也不会要求你把 client secret 放进命令行。编辑 .env 中的 MS_CLIENT_SECRET,使用 secret 的 Value,不是 Secret ID,然后运行:
npm run doctor
npm ci
npm run build
npm run start:http本机桌面客户端连接 http://localhost:3000/mcp。远程或云端客户端需要能够访问的 HTTPS 地址;云端客户端的 localhost 不是你的电脑。
成功标准: 在客户端完成登录,调用 auth_status,再成功执行 graph_get_me。健康检查通过或能看到工具,都不等于 Graph 权限已经配置成功。
初始配置保持 OAuth、App Roles、审计和操作确认开启,只加载个人资料模块。后续按需启用邮件、日历等功能,不用一次申请全部权限。逐步启用只读邮件
已有部署请先运行 npm run doctor,不要重新生成或覆盖 .env。Docker、双应用、反向代理和生产检查见完整部署说明。
使用已发布的 Docker 镜像
配置好 Entra 和 .env 后,可以直接使用镜像,无需在本机编译:
docker compose -f docker-compose.release.yml pull
docker compose -f docker-compose.release.yml up -d默认镜像为 ghcr.io/mdwsk88/ms-365-21v-mcp-server:v0.2.0,支持 Linux amd64 / arm64。使用旧版 Compose 文件时,在 .env 中设置 MCP_IMAGE_TAG=v0.2.0 后再执行上述命令;已有该设置时以你指定的版本为准。配置文件下载、首次启动和升级回退见 Docker 镜像说明,更新记录见 Releases。
配置错了,从哪里查?
npm run doctor
npm run --silent doctor -- --json离线检查会提示缺失或占位凭据、错误的云端点、地址覆盖、端口格式和单/双应用凭据不匹配等常见问题。它不打印配置值、不访问网络,也不修改 Entra。检查通过不代表管理员同意、Conditional Access 或真实 OAuth/Graph 调用已经验证。
客户端兼容性
仓库此前记录 WorkBuddy、Qoder Work、Codex 和 Dify 已完成远程连接、OAuth、工具发现与调用验证;这不是本次维护对这些客户端最新版的重新认证。详细记录保留在完整部署说明。
其他客户端需要支持 Streamable HTTP、OAuth 资源元数据/授权服务器发现、浏览器回调和 Bearer token。客户端能打开登录页面,也仍可能被租户 MFA、设备合规或用户分配策略拦截。
安全边界
远程服务使用 HTTPS;生产凭据放入 Secret Manager;只授予实际需要的 Graph delegated permissions 和 App Roles。不要为解决登录问题关闭认证或直接开放全部模块。
使用中国区 Graph 不自动保证端到端数据不出境:工具结果还会发送给你选择的 AI 客户端/模型服务。上线前需审核客户端数据流、日志留存、模型供应商及组织合规要求。详见威胁模型和安全策略。
文档与参与
目标 | 入口 |
首次跑通、检查配置、逐步启用功能 | |
Docker、双应用、角色、生产部署 | |
实际使用方式与提示词 | |
工具及所需权限 | |
回调、设备策略与登录问题 | |
后续维护优先级与发布记录 |
项目解决了你的 21V 接入问题,欢迎点一个 Star,也欢迎提交脱敏的使用反馈或客户端兼容性记录。贡献前请阅读 CONTRIBUTING.md;安全漏洞不要公开提交 Issue。
License
Apache License 2.0。Microsoft、Microsoft 365、Microsoft Entra、Microsoft Graph 等名称属于各自商标权利人,参见 TRADEMARKS.md。
Available Tools
16 toolsauth_clear_local_cacheClear Local Auth CacheA
Development only. Delete locally cached tokens and pending device-code login state. Chinese intents / 中文意图: 清除本地登录, 退出本地登录, 删除缓存令牌.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden of behavioral transparency. It states the destructive action (deleting cached tokens and pending login state) and adds a 'Development only' caveat, but it does not disclose potential side effects on the current session or clarify that this is local-only, which would be useful for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loaded. The first sentence 'Development only.' immediately communicates the context, followed by a precise action statement. The Chinese intent examples add multilingual value without bloat. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description is largely complete. It covers the purpose, the environment restriction, and the exact state cleared. However, it could go slightly further by stating whether this impacts server-side auth sessions or what the expected result is, which would enhance completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the schema is trivially 100% covered. The baseline for no parameters is 4, and since there are no parameters to explain, the description does not need to add parameter semantics. It correctly avoids unnecessary detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to delete locally cached tokens and pending device-code login state. It uses a specific verb ('Delete') with a clear resource and distinguishes itself from sibling auth tools like auth_start_device_login and auth_complete_device_login.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a clear usage context: 'Development only.' This indicates when the tool should be used (development environments) but does not explicitly mention alternatives or exclusions beyond environment. The uniqueness of the action makes usage context reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
auth_complete_device_loginComplete Local Device LoginA
Development only. Poll the token endpoint after the user enters the device code, then cache the token locally. Token values are not returned. Chinese intents / 中文意图: 完成本地登录, 完成设备码登录, 保存本地令牌.
| Name | Required | Description | Default |
|---|---|---|---|
| timeoutSeconds | No | Polling timeout in seconds. Defaults to 120. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses key behaviors: polling, local caching, and that 'Token values are not returned.' It also notes 'Development only,' providing a usage constraint. However, it omits error/timeout behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core action. The addition of Chinese intents is supplementary but still compact. Every sentence serves a purpose, though the localization list could be seen as extra.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description covers the essential flow (poll, cache, no token return) and the development-only caveat. It could be more complete by explicitly referencing the preceding auth_start_device_login step, but overall it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, timeoutSeconds, is fully described in the schema. The tool description does not add further parameter semantics, but with 100% schema coverage, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb and resource: 'Poll the token endpoint after the user enters the device code, then cache the token locally.' This distinguishes it from sibling auth tools like auth_start_device_login and auth_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use: after the user enters the device code, and it restricts usage to 'Development only.' It does not explicitly name alternatives, but the sequencing with the device login flow is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
auth_start_device_loginStart Local Device LoginA
Development only. Start a 21V Entra device-code login and cache the result locally. Chinese intents / 中文意图: 本地登录, 设备代码登录, 开发调试登录.
| Name | Required | Description | Default |
|---|---|---|---|
| scopes | No | Optional one-time scope override. Defaults to MS_GRAPH_SCOPES. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It explicitly discloses 'Development only' and that the result is cached locally, which are important behavioral traits. It does not detail the interactive device-code prompt or local cache format, but it provides meaningful transparency beyond a vague verb.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded: a development-only warning, the core action, and the caching result. The Chinese intent list adds value for multilingual intent matching without unnecessary filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with one optional parameter and no output schema, the description is largely complete: it states the purpose, context, and side effect. It omits the next step (e.g., use auth_complete_device_login) and what the tool returns, but the sibling list and title make this inferable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters and already describes the optional scopes override and its default. The description adds no extra parameter semantics, but the baseline of 3 applies because the schema does the heavy lifting sufficiently.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states a specific action: 'Start a 21V Entra device-code login and cache the result locally.' It names the resource (Entra device-code login), the verb (start), and the side effect (cache locally). This differentiates it from sibling tools like auth_complete_device_login and auth_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context with 'Development only' and implies when to use the tool (when initiating a local device-code login). However, it does not explicitly contrast with or point to related tools, such as auth_complete_device_login for finishing the flow, nor does it state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
auth_statusCheck Auth StatusA
Inspect MCP auth state, local token state, remote OAuth/OBO configuration, and current request user details. Token values are never returned. Chinese intents / 中文意图: 查看认证状态, 检查登录状态, 诊断授权问题.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It adds a key privacy disclosure that token values are never returned, and the verb 'Inspect' implies read-only behavior. It does not mention network side effects or rate limits, but for a zero-parameter status tool, this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with key information front-loaded in the first sentence. The Chinese intent mapping adds value without unnecessary bloat, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even without an output schema, the description conveys what information is exposed (auth state, token state, OAuth/OBO configuration, user details) and the critical privacy boundary. It is sufficient for a read-only diagnostic tool with no parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema coverage is 100%, so the baseline is 4. The description adds meaningful context about what the status inspection covers, which is sufficient given no parameters exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Inspect' and enumerates the exact resources covered (MCP auth state, local token state, remote OAuth/OBO configuration, current request user details). It clearly distinguishes this tool from sibling auth tools that start, complete, or clear login flows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use it, including '诊断授权问题' (diagnose authorization issues) and checking login status. It does not explicitly name alternatives or exclusions, but the diagnostic intent and read-only scope differentiate it from mutation-focused auth siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
calendar_list_viewList Calendar ViewARead-only
List meetings and events, including recurring instances, in a date-time range: subject, time, location, organizer, my response, attendees and cancellation state. Requires delegated Calendars.Read. Chinese intents / 中文意图: 查看今天的会议, 按时间范围查看日历, 查看明天日程, 查看本周会议, 展开重复日程.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Maximum events to return. Defaults to 50. | |
| timeZone | No | Time zone for returned times. Defaults to China Standard Time. | |
| endDateTime | Yes | Range end, ISO 8601 date or date-time. | |
| startDateTime | Yes | Range start, ISO 8601 date or date-time. Without an offset, China Standard Time is assumed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds genuinely new behavioral context beyond the annotations: the required delegated Calendars.Read permission and the fact that recurring instances are expanded into the result set. It does not discuss pagination or result limits, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in the first clause, and the auth requirement and returned-field list follow compactly. The Chinese intent list is long but serves a routing purpose. A small amount of redundancy exists between the returned-field enumeration and the schema, but overall it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description usefully enumerates the returned fields (subject, time, location, organizer, my response, attendees, cancellation state), which an agent needs to decide whether this tool answers a query. Combined with the stated permission requirement, it covers the four-parameter, two-required read tool adequately; only paging/limit behavior is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter already carries its own documentation, including defaults for top and timeZone and ISO 8601 handling for the date bounds. The description's 'date-time range' phrasing only echoes that the two required parameters form the range, adding no syntax or format detail beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (List) and resource (meetings and events) with an explicit scope (date-time range, including recurring instances) and enumerates the fields returned. It is the only calendar tool among the siblings, so there is no ambiguity to resolve, and an agent can tell immediately what the tool fetches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context for when to use the tool ('in a date-time range', including recurring instances) and reinforces it with example intents in Chinese. It does not name exclusions or alternative tools, but with a single calendar sibling set there is little to disambiguate, so this is strong-but-incomplete guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_executeExecute Approved OperationA
Continue a pending sensitive operation after the same signed-in user approved its web preview. This tool never grants approval itself. Call it only after the user says the confirmation page was approved; the token is user-bound, one-time, and short-lived. Chinese intents / 中文意图: 继续执行我刚刚在网页确认的操作, 执行已批准的敏感操作.
| Name | Required | Description | Default |
|---|---|---|---|
| confirmToken | Yes | One-time token returned by the pending operation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It reveals crucial traits: the token is user-bound, one-time, and short-lived, and the tool never grants approval. However, it does not explicitly state potential side effects (e.g., whether the operation is destructive) or error behavior, which would add further transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The English text is concise, with two sentences that efficiently communicate purpose and usage. The addition of a Chinese translation line is redundant for an AI agent but does not harm clarity; it merely adds a bit of length. Overall, it is well-structured and free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter, no output schema, and no annotations, the description is fully contextual. It explains the exact flow (pending operation, web preview approval, token constraints), the precondition, and the tool's non-approval role. There are no significant gaps that would hinder correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes confirmToken as 'One-time token returned by the pending operation,' but the description adds meaningful semantics: the token is user-bound, short-lived, and must belong to the same signed-in user who approved the preview. This goes beyond the schema's basic type/role information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Continue a pending sensitive operation after the same signed-in user approved its web preview.' This specifies the verb (continue), the object (pending sensitive operation), and the condition (after user approval), which distinguishes it from sibling tools like auth_complete_device_login that handle login flows, not operation execution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance: 'Call it only after the user says the confirmation page was approved' and 'This tool never grants approval itself.' This gives a clear when-to-use condition and a when-not-to-use (it does not approve), which is sufficient for an agent to decide when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files_get_download_urlGet File Download URLARead-only
Resolve a OneDrive or SharePoint file from a link pasted in chat or mail, or from driveId and itemId, and return a short-lived pre-authenticated download URL for the client to fetch and parse. format pdf converts Office files to PDF first. Small plain-text files also return their text inline. SharePoint files also require the mcp.sharepoint App Role. Chinese intents / 中文意图: 打开SharePoint链接, 读取文档内容, 下载文件, 获取文件下载地址, 把Word转成PDF.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | OneDrive or SharePoint sharing link or file URL. Use this or itemId. | |
| format | No | original (default) or pdf, which converts Word, Excel and PowerPoint files to PDF. | |
| itemId | No | Item ID from files_search. | |
| driveId | No | Drive ID from files_search. Omit for the user OneDrive. | |
| includeText | No | Return small plain-text files (txt, md, csv, json...) inline. Defaults to true. | |
| maxTextChars | No | Maximum inline text characters. Defaults to 20000. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint and openWorldHint; the description adds substantial beyond that: the URL is short-lived and pre-authenticated, pdf conversion applies to Office files, small plain-text files return inline, and SharePoint requires the mcp.sharepoint App Role.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and inputs are front-loaded in the first sentence with no wasted lead-in. The trailing multilingual keyword block is somewhat of a routing dump but does aid intent matching, so the cost is small.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description carries the return-value burden and does so: it specifies a short-lived pre-authenticated download URL and inline text for small files. Auth requirement for SharePoint is also covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real meaning: format=pdf converts Word/Excel/PowerPoint, and includeText behavior (small plain-text files returned inline) is explained beyond the schema's terse notation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (Resolve/return) and resources (OneDrive/SharePoint file, download URL) with clear scope. An agent can distinguish it from files_search, which locates items rather than producing a fetchable URL.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States two concrete entry paths — a pasted link or driveId+itemId — and notes the SharePoint App Role prerequisite. It stops short of explicitly naming when to prefer files_search or files_get_download_url, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files_searchSearch FilesARead-only
Find documents across OneDrive and SharePoint sites the signed-in user can open, by keywords in name or content. Filter by site, file type and modification date. Returns location, last editor, webUrl, driveId and itemId for files_get_download_url. SharePoint results also require the mcp.sharepoint App Role. Chinese intents / 中文意图: 搜索文档, 查找SharePoint文件, 查找OneDrive文件, 找某个项目的Word或PDF, 搜索网盘文件.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Maximum files to return. Defaults to 20. | |
| site | No | Limit to one SharePoint site: its URL, for example https://tenant.sharepoint.cn/sites/Project, or site ID. | |
| query | Yes | Keywords from the file name or content. | |
| scope | No | Where to search. Defaults to all. | |
| fileTypes | No | File extensions such as docx, pdf, pptx, xlsx. | |
| modifiedAfter | No | Only files modified at or after this ISO date or date-time. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover readOnlyHint=true and openWorldHint=true, so safety profile is given. Description adds valuable non-structured context: SharePoint results require the mcp.sharepoint App Role, and lists the exact returned fields. This is genuinely beyond what the schema/annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then filters, then return values, then auth requirement, then Chinese intent keywords. Efficient overall; the Chinese intent list is useful for routing but slightly bulky.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, filters, returns, and the SharePoint App Role requirement. With no output schema, the description does list key return fields, which is helpful, but omits pagination/top behavior nuance beyond the schema default and broader auth expectations. Adequate but leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and includes enum and bounds descriptions, so the schema carries parameter meaning. Description summarizes filters (site, file type, modification date) but adds no format/syntax detail beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Find documents across OneDrive and SharePoint sites') and explicitly names the coverage scope ('the signed-in user can open'). Differentiates from sibling files_get_download_url by stating the returned fields feed into it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear context for when to use (keyword search across OneDrive/SharePoint, filterable by site/type/date) and points explicitly at files_get_download_url as the follow-up. No explicit 'when not to use' or named alternative search tools, but nothing is misleading.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_execute_toolExecute Authorized ToolADestructive
Execute a tool returned by gateway_search_tools with parameters matching its inputSchema. The target tool is rechecked for App Roles, confirmation policy, audit, and Graph scope controls. Invalid parameters return the expected schema. Chinese intents / 中文意图: 执行搜索到的工具, 调用长尾工具, 执行Microsoft 365操作.
| Name | Required | Description | Default |
|---|---|---|---|
| toolName | Yes | Exact authorized tool name. | |
| parameters | No | Arguments matching gateway_get_tool_schema. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint, readOnlyHint=false, and openWorldHint, so the safety profile is partly covered. The description adds genuinely useful context beyond them: rechecks for App Roles, confirmation policy, audit, and Graph scope controls, plus the failure behavior ('invalid parameters return the expected schema'). It does not describe what specifically gets destroyed on a mutating call, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core verb and object in the first sentence, then layers workflow, security behavior, and error handling. The trailing Chinese intent keywords are extra bulk but serve a legitimate multilingual routing purpose, so the structure is efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description is not obligated to explain returns, and it covers purpose, prerequisites, re-validation behavior, and error signaling. For a generic gateway executor with a nested, free-form parameters object, the coverage is solid though it says nothing about execution scope limits or success semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (toolName and parameters) are already documented in the schema, giving a baseline of 3. The description reinforces the relationship between 'parameters' and the target tool's inputSchema but adds no format, syntax, or constraint detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Execute) and resource (a tool returned by gateway_search_tools), and explicitly anchors the tool within the search→schema→execute chain that distinguishes it from gateway_search_tools and gateway_get_tool_schema. An agent can immediately tell what this does and how it differs from its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the prerequisite producer (gateway_search_tools) and the parameter source ('matching its inputSchema' / gateway_get_tool_schema), so the intended workflow is clear. It stops short of explicit when-not-to-use guidance or naming confirm_execute as an alternative, so it is not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_get_tool_schemaGet Tool SchemaARead-only
Get the exact input schema and authorization metadata for a tool returned by gateway_search_tools. Chinese intents / 中文意图: 查看工具参数, 获取工具Schema, 确认工具需要哪些参数.
| Name | Required | Description | Default |
|---|---|---|---|
| toolName | Yes | Exact tool name returned by gateway_search_tools. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds genuinely useful disclosure that the response contains not just the input schema but also "authorization metadata" – important because there is no output schema to reveal the return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose in the first clause, with the prerequisite immediately following. The trailing Chinese-intent keyword line is padding for a mostly English-speaking agent, but it is brief and does not obscure the meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with annotations covering safety, the description supplies the missing pieces: the provenance of the required name and the fact that authorization metadata is returned. Only minor details (e.g., behavior when a name is unknown or not from search) are unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter is fully documented in the schema (100% coverage), which already states it must be the exact tool name returned by gateway_search_tools. The description reinforces that provenance but adds no format, casing, or validation detail beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (Get) plus a precisely named resource (exact input schema and authorization metadata) for a tool supplied by gateway_search_tools. It is clearly distinguishable from its siblings, especially gateway_search_tools (the discovery step) and gateway_execute_tool (the invocation step).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states the prerequisite clearly: the tool name must be one returned by gateway_search_tools, which tells an agent when this tool is applicable in the search -> inspect -> execute flow. It does not state exclusions (e.g., when to skip schema lookup), so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gateway_search_toolsSearch Available ToolsARead-only
Search the signed-in user's authorized Microsoft 365 tools by English or Chinese intent, for anything the directly exposed tools do not cover (sending, scheduling, OneDrive and SharePoint management, contacts, users...). Top results include their input schema. Chinese intents / 中文意图: 搜索可用工具, 查找能完成任务的工具, 发现更多Microsoft 365能力.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum matching tools to return. | |
| query | No | English or Chinese task description. | |
| category | No | Optional exact category filter, such as mail or drive. | |
| schemaCount | No | Include the input schema for this many top results, so they can be executed without gateway_get_tool_schema. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful behavior beyond that: results are limited to the user's authorized tools, top hits carry input schemas, and intent can be expressed in either language. It does not mention result limits/pagination or ranking behavior, so it stops short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The capability statement and the exclusion clause are front-loaded in a single efficient sentence. The trailing Chinese-language phrase list ('搜索可用工具, 查找能完成任务的工具...') is somewhat redundant filler, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only discovery tool with no output schema, the description adequately conveys what comes back (top-ranked tools with embedded input schemas) and the scope of the search corpus. It omits anything about result volume limits, ranking or empty-result behavior, but nothing critical for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so limit, query, category and schemaCount are already documented with defaults, bounds and purpose. The description restates the query's language flexibility and the schema-embedding behavior of results, but adds no syntax, format or filtering nuance beyond the schema, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Search the signed-in user's authorized Microsoft 365 tools') and scopes it by intent language (English or Chinese). It also carves out the boundary against the directly exposed siblings by listing the capability areas it covers that they do not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states exactly when to reach for it ('for anything the directly exposed tools do not cover') and gives concrete examples (sending, scheduling, OneDrive/SharePoint, contacts, users). It also routes the agent away from gateway_get_tool_schema by noting top results carry their input schema, so the alternative tool is explicitly made unnecessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mail_get_messageGet Mail DetailsARead-only
Read one message as plain text with recipients and attachment list. onlyNewContent drops quoted earlier mails; long bodies continue with offset. Requires delegated Mail.Read. Chinese intents / 中文意图: 查看邮件详情, 读取邮件正文, 查看邮件内容, 查看邮件附件列表.
| Name | Required | Description | Default |
|---|---|---|---|
| offset | No | Body character offset, from body.nextOffset of a previous call. | |
| maxChars | No | Maximum body characters. Defaults to 20000. | |
| messageId | Yes | Message ID from a mail list or search result. | |
| bodyFormat | No | Body format. Defaults to text. | |
| onlyNewContent | No | Return only the content new in this message, without the quoted thread. Defaults to false. | |
| includeAttachments | No | Include the attachment list. Defaults to true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, but the description adds genuinely useful behavior beyond them: the delegated Mail.Read requirement, plain-text output with recipients and attachment list, onlyNewContent stripping the quoted thread, and offset-based continuation for long bodies. Only the return shape/pagination envelope is left unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two information-dense sentences front-loaded with the core action, followed by the permission and localized intent keywords. The Chinese intent list is repetition for intent matching rather than new content, which keeps it just short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter read tool with no output schema and 100% schema coverage, the description covers the action, output form, permission requirement, attachment inclusion, and long-body continuation. An agent has enough to call it correctly, with only pagination/return envelope details unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning for the chained offset pattern ('long bodies continue with offset') and clarifies onlyNewContent's effect ('drops quoted earlier mails'). bodyFormat and includeAttachments rely on the schema, but the description still earns above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read one message') with the returned shape (plain text, recipients, attachment list). This clearly distinguishes it from mail_list_messages and mail_search_messages, which the agent can tell apart without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: 'Read one message' plus the offset-continuation note communicates the retrieve-by-id workflow, and the permission requirement gives a prerequisite. However, it never explicitly says when to prefer this over mail_list_messages or mail_search_messages, leaving the routing inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mail_list_messagesList My MailARead-only
List mail newest first with sender, recipients, preview, read and flag state. Filter by folder (inbox by default, or all), time window, unread, flagged, importance or sender address. Use mail_search_messages for keywords. Requires delegated Mail.Read. Chinese intents / 中文意图: 查看我的邮件, 看最近邮件, 查看未读邮件, 查看标旗邮件, 某段时间的邮件, 列出收件箱邮件.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Messages to return, from 1 to 50. Defaults to 20. | |
| from | No | Only messages from this sender email address. | |
| since | No | Received at or after this ISO date-time (China Standard Time if no offset). | |
| until | No | Received before this ISO date-time. | |
| cursor | No | nextCursor from the previous call. | |
| folder | No | inbox (default), all, sentitems, drafts, deleteditems, archive, junkemail, or a folder ID. | |
| importance | No | Only this importance. | |
| unreadOnly | No | Only unread messages. | |
| flaggedOnly | No | Only flagged (follow-up) messages. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, but the description adds real context beyond them: the delegated Mail.Read auth scope and the default ordering (newest first). It also hints at return shape (sender, recipients, preview, read/flag state), though it does not mention pagination behavior implied by the cursor parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads what it does and what it returns, then the filters, then the alternative, and finally the auth requirement. The Chinese intent list is long but serves a concrete routing purpose for non-English queries; the rest is waste-free.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still conveys the return fields, the default folder, ordering, auth scope, filter taxonomy, and the sibling alternative. Nothing an agent needs in order to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all nine parameters with enums, defaults, and formats. The description groups the filter dimensions and restates the inbox default, which mirrors rather than extends the schema, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (mail), plus ordering (newest first) and the returned fields (sender, recipients, preview, read and flag state). It explicitly names the sibling it is not (mail_search_messages for keywords), so an agent can distinguish it without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Enumerates the filter contexts (folder, time window, unread, flagged, importance, sender) that select this tool and routes keyword-based retrieval to mail_search_messages explicitly. The condition that governs the alternative is stated, not left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mail_search_messagesSearch My MailARead-only
Search mail by keywords with KQL, for example "budget", "from:Zhang Wei", "subject:review", "hasAttachments:true". Searches all folders unless folder is set. Requires delegated Mail.Read. Chinese intents / 中文意图: 搜索邮件, 按关键词查邮件, 查找某人发的邮件, 查找某封邮件.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Messages to return, from 1 to 50. Defaults to 20. | |
| query | Yes | Keywords or KQL such as from:, to:, subject:, body:, hasAttachments:. | |
| cursor | No | nextCursor from the previous call. | |
| folder | No | Limit to a folder such as inbox; defaults to all folders. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the read-only and open-world profile; the description adds genuinely new behavioral context – the delegated Mail.Read permission requirement and default all-folders scope. It stops short of describing pagination or result ordering, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core search behavior and syntax up front, with permission and scope details following. The Chinese intent list adds length but serves a real matching purpose, so it stays reasonably tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with no output schema and full schema coverage, the description supplies the key extras – auth requirement and folder scope. Missing only return-value hints (nextCursor usage) which the cursor parameter largely implies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so query, folder, top and cursor are already documented with their KQL syntax and limits. The description's examples restate schema content and the folder-default note duplicates the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Search) and resource (mail) plus concrete KQL examples like from:Zhang Wei and hasAttachments:true. The keyword-search framing clearly separates it from sibling mail_list_messages and mail_get_message without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear trigger context via KQL examples and Chinese intent phrases (搜索邮件, 查找某人发的邮件) that map user phrasing to this tool. It notes the all-folders default unless folder is set, but does not name an alternative or a when-not-to-use condition (e.g. fetch a single known message).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teams_list_chat_messagesList Teams Chat MessagesARead-only
Read messages in a Teams chat as plain text, oldest first within a page, with sender, @mentions and shared files. Supports a since/until window and nextCursor for older messages. Requires delegated Chat.Read. Chinese intents / 中文意图: 查看Teams聊天消息, 读取聊天记录, 查看群聊消息, 看某段时间的聊天.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Messages to fetch per page, from 1 to 50. Defaults to 20. | |
| since | No | Only messages sent at or after this ISO date-time (China Standard Time if no offset). | |
| until | No | Only messages sent before this ISO date-time. | |
| chatId | Yes | Chat ID from teams_list_chats. | |
| cursor | No | nextCursor from the previous call, with the same other arguments. | |
| format | No | Message body format. Defaults to text. | |
| includeSystemMessages | No | Include system events such as members added or meeting started. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds real value beyond them: the per-page ordering, the auth requirement, the fact that system messages are excluded by default, and what each message contains. Return format and pagination interplay are not fully spelled out, keeping it below 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and scope in the first sentence, then pagination and auth. The Chinese intent list is useful for retrieval but adds length; overall still tight and free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter read tool with no output schema, the description covers ordering, page size default, content returned, paging via nextCursor, and the required permission. Auth and system-message defaults are highlighted, so an agent has enough to invoke it correctly, though it does not describe error or empty-result behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so top, since, until, cursor, format and includeSystemMessages are already documented in the schema. The description restates the since/until window and nextCursor without adding syntax or format detail beyond what the schema provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read messages in a Teams chat') plus the returned shape (plain text, sender, @mentions, shared files) and ordering (oldest first within a page). This clearly distinguishes it from sibling list/search tools like mail_list_messages and teams_list_chats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the since/until window and that nextCursor pages to older messages, and names the required permission (delegated Chat.Read). It gives clear operational context but does not explicitly contrast itself with alternatives such as mail_search_messages for keyword lookups.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teams_list_chatsList My Teams ChatsARead-only
List one-on-one, group and meeting Teams chats, most recently active first, with member names and the last message. Use since to keep only chats with new messages, and query to find a chat by person or topic. Requires delegated Chat.Read. Chinese intents / 中文意图: 查看Teams聊天, 找和某人的聊天, 最近有新消息的聊天, 查看群聊和私聊, 列出Teams会话.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Maximum chats to return, from 1 to 50. Defaults to 20. | |
| query | No | Match a member name, member email or chat topic. Space-separated words must all match. | |
| since | No | Only chats whose last message is at or after this ISO date-time. Without an offset, China Standard Time is assumed. | |
| cursor | No | nextCursor from the previous call, with the same other arguments. | |
| chatType | No | Only this chat type. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint and openWorldHint already declared, the description adds real context: the required delegated Chat.Read scope, the sort order, and the fact that each result carries member names and a last-message preview. Pagination behavior itself is left to the schema's cursor field rather than explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the operation and ordering, then parameter guidance, then a short prerequisite. The Chinese intent list is longer than strictly necessary but serves genuine multilingual intent matching. No wasted sentences aside from that block.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with no output schema, the description supplies what the schema cannot: the shape of each returned item (member names, last message), the ordering, auth requirements, and filter intent. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds interpretive value beyond the schema text: 'since' is framed as 'keep only chats with new messages' rather than only an ISO timestamp bound, and 'query' as finding a chat by person or topic. 'top' and 'cursor' are left to the schema, which documents them adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List ... Teams chats'), names the covered chat kinds (one-on-one, group, meeting), and specifies ordering ('most recently active first') plus returned fields (member names, last message). That scope cleanly separates it from teams_list_chat_messages, which lists messages inside a chat.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes parameter choice: 'Use since to keep only chats with new messages, and query to find a chat by person or topic.' It also surfaces the delegated Chat.Read prerequisite. It never names the sibling teams_list_chat_messages as the alternative for reading message contents, so there is a gap at the boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
153 tool updates
v0.2.0- Removed
calendar_add_file_attachment - Removed
calendar_cancel_event - Removed
calendar_create_calendar - Removed
calendar_create_event - Removed
calendar_delete_attachment - Removed
calendar_delete_calendar - Removed
calendar_delete_event - Removed
calendar_get_event - Removed
calendar_get_schedule - Removed
calendar_list_attachments - Removed
calendar_list_calendars - Removed
calendar_list_event_instances - Removed
calendar_list_events - Changed
calendar_list_view4 fields changed- changed
Input schema / properties / endDateTime / descriptionPrevious value: -"Range end in ISO 8601 format."New value: +"Range end, ISO 8601 date or date-time." - changed
Input schema / properties / startDateTime / descriptionPrevious value: -"Range start in ISO 8601 format."New value: +"Range start, ISO 8601 date or date-time. Without an offset, China Standard Time is assumed." - changed
Input schema / properties / timeZone / descriptionPrevious value: -"Response time zone. Defaults to China Standard Time."New value: +"Time zone for returned times. Defaults to China Standard Time." - changed
Input schema / properties / top / descriptionPrevious value: -"Number of events to return."New value: +"Maximum events to return. Defaults to 50."
- Removed
calendar_respond_to_event - Removed
calendar_update_calendar - Removed
calendar_update_event - Removed
contacts_create - Removed
contacts_create_folder - Removed
contacts_delete - Removed
contacts_delete_folder - Removed
contacts_get - Removed
contacts_list - Removed
contacts_list_folder_contacts - Removed
contacts_list_folders - Removed
contacts_search - Removed
contacts_update - Removed
contacts_update_folder - Removed
drive_copy_item - Removed
drive_create_folder - Removed
drive_create_share_link - Removed
drive_delete_item - Removed
drive_download_file - Removed
drive_get_drive - Removed
drive_get_item - Removed
drive_invite_item - Removed
drive_list_children - Removed
drive_list_permissions - Removed
drive_list_recent - Removed
drive_list_root - Removed
drive_list_versions - Removed
drive_move_item - Removed
drive_rename_item - Removed
drive_restore_version - Removed
drive_search_items - Removed
drive_upload_small_file - Added
files_get_download_url - Added
files_search - Added
gateway_execute_tool - Added
gateway_get_tool_schema - Added
gateway_search_tools - Removed
graph_get_me - Removed
groups_check_my_memberships - Removed
groups_get - Removed
groups_list - Removed
groups_list_members - Removed
groups_list_owners - Removed
mail_add_file_attachment - Removed
mail_copy_message - Removed
mail_create_draft - Removed
mail_create_folder - Removed
mail_delete_attachment - Removed
mail_delete_folder - Removed
mail_delete_message - Removed
mail_forward - Removed
mail_get_attachment - Removed
mail_get_folder - Changed
mail_get_message5 fields changed- added
Input schema / properties / bodyFormatAdded value: +{ + "description": "Body format. Defaults to text.", + "enum": [ + "text", + "html" + ], + "type": "string" +} - added
Input schema / properties / includeAttachmentsAdded value: +{ + "description": "Include the attachment list. Defaults to true.", + "type": "boolean" +} - added
Input schema / properties / maxCharsAdded value: +{ + "description": "Maximum body characters. Defaults to 20000.", + "maximum": 100000, + "minimum": 200, + "type": "integer" +} - added
Input schema / properties / offsetAdded value: +{ + "description": "Body character offset, from body.nextOffset of a previous call.", + "maximum": 9007199254740991, + "minimum": 0, + "type": "integer" +} - added
Input schema / properties / onlyNewContentAdded value: +{ + "description": "Return only the content new in this message, without the quoted thread. Defaults to false.", + "type": "boolean" +}
- Removed
mail_list_attachments - Removed
mail_list_child_folders - Removed
mail_list_folder_messages - Removed
mail_list_folders - Changed
mail_list_messages9 fields changed- added
Input schema / properties / cursorAdded value: +{ + "description": "nextCursor from the previous call.", + "maxLength": 4000, + "type": "string" +} - added
Input schema / properties / flaggedOnlyAdded value: +{ + "description": "Only flagged (follow-up) messages.", + "type": "boolean" +} - added
Input schema / properties / folderAdded value: +{ + "description": "inbox (default), all, sentitems, drafts, deleteditems, archive, junkemail, or a folder ID.", + "maxLength": 300, + "minLength": 1, + "type": "string" +} - added
Input schema / properties / fromAdded value: +{ + "description": "Only messages from this sender email address.", + "maxLength": 320, + "type": "string" +} - added
Input schema / properties / importanceAdded value: +{ + "description": "Only this importance.", + "enum": [ + "low", + "normal", + "high" + ], + "type": "string" +} - added
Input schema / properties / sinceAdded value: +{ + "description": "Received at or after this ISO date-time (China Standard Time if no offset).", + "maxLength": 40, + "type": "string" +} - changed
Input schema / properties / top / descriptionPrevious value: -"Number of messages to return, from 1 to 50."New value: +"Messages to return, from 1 to 50. Defaults to 20." - changed
Input schema / properties / unreadOnly / descriptionPrevious value: -"Whether to return unread messages only."New value: +"Only unread messages." - added
Input schema / properties / untilAdded value: +{ + "description": "Received before this ISO date-time.", + "maxLength": 40, + "type": "string" +}
- Removed
mail_move_message - Removed
mail_reply - Changed
mail_search_messages4 fields changed- added
Input schema / properties / cursorAdded value: +{ + "description": "nextCursor from the previous call.", + "maxLength": 4000, + "type": "string" +} - added
Input schema / properties / folderAdded value: +{ + "description": "Limit to a folder such as inbox; defaults to all folders.", + "maxLength": 300, + "minLength": 1, + "type": "string" +} - changed
Input schema / properties / query / descriptionPrevious value: -"Search query, such as sender, subject, or body keywords."New value: +"Keywords or KQL such as from:, to:, subject:, body:, hasAttachments:." - changed
Input schema / properties / top / descriptionPrevious value: -"Number of messages to return, from 1 to 50."New value: +"Messages to return, from 1 to 50. Defaults to 20."
- Removed
mail_send - Removed
mail_send_draft - Removed
mail_set_read_state - Removed
mail_update_folder - Removed
search_calendar - Removed
search_files - Removed
search_mail - Removed
search_sharepoint - Removed
search_teams - Removed
sharepoint_copy_drive_item - Removed
sharepoint_create_column - Removed
sharepoint_create_drive_folder - Removed
sharepoint_create_list - Removed
sharepoint_create_list_item - Removed
sharepoint_create_share_link - Removed
sharepoint_delete_column - Removed
sharepoint_delete_drive_item - Removed
sharepoint_delete_list - Removed
sharepoint_delete_list_item - Removed
sharepoint_download_file - Removed
sharepoint_get_drive_item - Removed
sharepoint_get_list_item - Removed
sharepoint_get_site - Removed
sharepoint_get_site_by_path - Removed
sharepoint_invite_drive_item - Removed
sharepoint_list_columns - Removed
sharepoint_list_drive_items - Removed
sharepoint_list_drive_permissions - Removed
sharepoint_list_drive_versions - Removed
sharepoint_list_drives - Removed
sharepoint_list_item_delta - Removed
sharepoint_list_list_items - Removed
sharepoint_list_lists - Removed
sharepoint_move_drive_item - Removed
sharepoint_rename_drive_item - Removed
sharepoint_restore_drive_version - Removed
sharepoint_search_drive_items - Removed
sharepoint_search_sites - Removed
sharepoint_update_column - Removed
sharepoint_update_list - Removed
sharepoint_update_list_item - Removed
sharepoint_upload_small_file - Removed
smart_calendar_conflicts - Removed
smart_mail_digest - Removed
smart_teams_unread - Removed
teams_add_channel_member - Removed
teams_add_chat_member - Removed
teams_add_team_member - Removed
teams_create_channel - Removed
teams_create_chat - Removed
teams_delete_channel - Removed
teams_delete_channel_message - Removed
teams_delete_chat_message - Removed
teams_get_channel - Removed
teams_get_team - Removed
teams_list_channel_members - Removed
teams_list_channel_message_replies - Removed
teams_list_channel_messages - Removed
teams_list_channels - Removed
teams_list_chat_members - Changed
teams_list_chat_messages6 fields changed- added
Input schema / properties / cursorAdded value: +{ + "description": "nextCursor from the previous call, with the same other arguments.", + "maxLength": 4000, + "type": "string" +} - added
Input schema / properties / formatAdded value: +{ + "description": "Message body format. Defaults to text.", + "enum": [ + "text", + "html" + ], + "type": "string" +} - added
Input schema / properties / includeSystemMessagesAdded value: +{ + "description": "Include system events such as members added or meeting started. Defaults to false.", + "type": "boolean" +} - added
Input schema / properties / sinceAdded value: +{ + "description": "Only messages sent at or after this ISO date-time (China Standard Time if no offset).", + "maxLength": 40, + "type": "string" +} - changed
Input schema / properties / top / descriptionPrevious value: -"Number of messages to return, from 1 to 50."New value: +"Messages to fetch per page, from 1 to 50. Defaults to 20." - added
Input schema / properties / untilAdded value: +{ + "description": "Only messages sent before this ISO date-time.", + "maxLength": 40, + "type": "string" +}
- Changed
teams_list_chats5 fields changed- added
Input schema / properties / chatTypeAdded value: +{ + "description": "Only this chat type.", + "enum": [ + "oneOnOne", + "group", + "meeting" + ], + "type": "string" +} - added
Input schema / properties / cursorAdded value: +{ + "description": "nextCursor from the previous call, with the same other arguments.", + "maxLength": 4000, + "type": "string" +} - added
Input schema / properties / queryAdded value: +{ + "description": "Match a member name, member email or chat topic. Space-separated words must all match.", + "maxLength": 100, + "type": "string" +} - added
Input schema / properties / sinceAdded value: +{ + "description": "Only chats whose last message is at or after this ISO date-time. Without an offset, China Standard Time is assumed.", + "maxLength": 40, + "type": "string" +} - changed
Input schema / properties / top / descriptionPrevious value: -"Number of chats to return, from 1 to 50."New value: +"Maximum chats to return, from 1 to 50. Defaults to 20."
- Removed
teams_list_joined_teams - Removed
teams_list_team_members - Removed
teams_remove_channel_member - Removed
teams_remove_chat_member - Removed
teams_remove_team_member - Removed
teams_reply_channel_message - Removed
teams_send_channel_message - Removed
teams_send_chat_message - Removed
teams_update_channel - Removed
users_get_manager - Removed
users_get_profile - Removed
users_list - Removed
users_list_direct_reports - Removed
users_list_memberships - Removed
users_search
153 tool updates
v0.1.0- First observed
auth_clear_local_cache - First observed
auth_complete_device_login - First observed
auth_start_device_login - First observed
auth_status - First observed
calendar_add_file_attachment - First observed
calendar_cancel_event - First observed
calendar_create_calendar - First observed
calendar_create_event - First observed
calendar_delete_attachment - First observed
calendar_delete_calendar - First observed
calendar_delete_event - First observed
calendar_get_event - First observed
calendar_get_schedule - First observed
calendar_list_attachments - First observed
calendar_list_calendars - First observed
calendar_list_event_instances - First observed
calendar_list_events - First observed
calendar_list_view - First observed
calendar_respond_to_event - First observed
calendar_update_calendar - First observed
calendar_update_event - First observed
confirm_execute - First observed
contacts_create - First observed
contacts_create_folder - First observed
contacts_delete - First observed
contacts_delete_folder - First observed
contacts_get - First observed
contacts_list - First observed
contacts_list_folder_contacts - First observed
contacts_list_folders - First observed
contacts_search - First observed
contacts_update - First observed
contacts_update_folder - First observed
drive_copy_item - First observed
drive_create_folder - First observed
drive_create_share_link - First observed
drive_delete_item - First observed
drive_download_file - First observed
drive_get_drive - First observed
drive_get_item - First observed
drive_invite_item - First observed
drive_list_children - First observed
drive_list_permissions - First observed
drive_list_recent - First observed
drive_list_root - First observed
drive_list_versions - First observed
drive_move_item - First observed
drive_rename_item - First observed
drive_restore_version - First observed
drive_search_items - First observed
drive_upload_small_file - First observed
graph_get_me - First observed
groups_check_my_memberships - First observed
groups_get - First observed
groups_list - First observed
groups_list_members - First observed
groups_list_owners - First observed
mail_add_file_attachment - First observed
mail_copy_message - First observed
mail_create_draft - First observed
mail_create_folder - First observed
mail_delete_attachment - First observed
mail_delete_folder - First observed
mail_delete_message - First observed
mail_forward - First observed
mail_get_attachment - First observed
mail_get_folder - First observed
mail_get_message - First observed
mail_list_attachments - First observed
mail_list_child_folders - First observed
mail_list_folder_messages - First observed
mail_list_folders - First observed
mail_list_messages - First observed
mail_move_message - First observed
mail_reply - First observed
mail_search_messages - First observed
mail_send - First observed
mail_send_draft - First observed
mail_set_read_state - First observed
mail_update_folder - First observed
search_calendar - First observed
search_files - First observed
search_mail - First observed
search_sharepoint - First observed
search_teams - First observed
sharepoint_copy_drive_item - First observed
sharepoint_create_column - First observed
sharepoint_create_drive_folder - First observed
sharepoint_create_list - First observed
sharepoint_create_list_item - First observed
sharepoint_create_share_link - First observed
sharepoint_delete_column - First observed
sharepoint_delete_drive_item - First observed
sharepoint_delete_list - First observed
sharepoint_delete_list_item - First observed
sharepoint_download_file - First observed
sharepoint_get_drive_item - First observed
sharepoint_get_list_item - First observed
sharepoint_get_site - First observed
sharepoint_get_site_by_path - First observed
sharepoint_invite_drive_item - First observed
sharepoint_list_columns - First observed
sharepoint_list_drive_items - First observed
sharepoint_list_drive_permissions - First observed
sharepoint_list_drive_versions - First observed
sharepoint_list_drives - First observed
sharepoint_list_item_delta - First observed
sharepoint_list_list_items - First observed
sharepoint_list_lists - First observed
sharepoint_move_drive_item - First observed
sharepoint_rename_drive_item - First observed
sharepoint_restore_drive_version - First observed
sharepoint_search_drive_items - First observed
sharepoint_search_sites - First observed
sharepoint_update_column - First observed
sharepoint_update_list - First observed
sharepoint_update_list_item - First observed
sharepoint_upload_small_file - First observed
smart_calendar_conflicts - First observed
smart_mail_digest - First observed
smart_teams_unread - First observed
teams_add_channel_member - First observed
teams_add_chat_member - First observed
teams_add_team_member - First observed
teams_create_channel - First observed
teams_create_chat - First observed
teams_delete_channel - First observed
teams_delete_channel_message - First observed
teams_delete_chat_message - First observed
teams_get_channel - First observed
teams_get_team - First observed
teams_list_channel_members - First observed
teams_list_channel_message_replies - First observed
teams_list_channel_messages - First observed
teams_list_channels - First observed
teams_list_chat_members - First observed
teams_list_chat_messages - First observed
teams_list_chats - First observed
teams_list_joined_teams - First observed
teams_list_team_members - First observed
teams_remove_channel_member - First observed
teams_remove_chat_member - First observed
teams_remove_team_member - First observed
teams_reply_channel_message - First observed
teams_send_channel_message - First observed
teams_send_chat_message - First observed
teams_update_channel - First observed
users_get_manager - First observed
users_get_profile - First observed
users_list - First observed
users_list_direct_reports - First observed
users_list_memberships - First observed
users_search
TDQS
Scored across 16 tools
Most tools target distinct resources and actions (mail_list/search/get, teams_list_chats vs teams_list_chat_messages, auth_* lifecycle). The only mild overlap is gateway_search_tools already returning schemas while gateway_get_tool_schema exists for explicit schema retrieval, and gateway_execute_tool vs confirm_execute for executing operations, but descriptions clarify the boundaries.
Names follow a predictable domain_verb_noun snake_case pattern (mail_list_messages, calendar_list_view, files_get_download_url, gateway_search_tools). Minor deviations like auth_status (noun-only) and confirm_execute (no domain prefix) are readable and don't break the overall convention.
16 tools is slightly above the ideal 3-15 range but well justified by the breadth of Microsoft 365 domains covered (auth, mail, calendar, files, teams, gateway). The gateway pattern lets a small curated set extend to a long tail without bloating the direct surface.
Core read workflows are fully covered per domain (mail list/search/get, calendar list view, files search/download, teams chats/messages) plus a complete auth lifecycle. Write operations (send mail, create calendar events, upload files) are not directly exposed but are discoverable and executable through gateway_search_tools/gateway_execute_tool, so only minor gaps remain.
Maintenance
Related MCP Connectors
Permissioned access to Outlook, OneDrive and Teams via the user's own Microsoft account
Official Microsoft MCP Server to query Microsoft Entra data using natural language
Manage Microsoft 365 email, calendar, contacts and inbox rules via the Graph API with OAuth 2.0.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
Related MCP Servers
- FlicenseNot gradedqualityAmaintenanceEnables MCP-compatible AI clients to access 21Vianet Microsoft 365 mail, calendar, OneDrive, SharePoint, Teams, contacts, and other Microsoft Graph China resources as the signed-in user, with delegated permissions, operation confirmation, and audit controls.-
- FlicenseNot gradedqualityAmaintenanceEnables MCP-capable AI clients to access 21Vianet-operated Microsoft 365 resources — mail, calendar, OneDrive, SharePoint, Teams, contacts, org users and search — through the China-region Microsoft Graph using per-user OAuth delegated permissions. It supports client connectivity over Streamable HTTP with an OAuth bridge, plus module/scope filtering, write-operation confirmation and desensitized auditing.-
- FlicenseNot gradedqualityAmaintenanceEnables MCP-capable AI clients to access and manage a user's 21Vianet Microsoft 365 mail, calendar, OneDrive, SharePoint, Teams, contacts, org users, and search through Microsoft Graph China, while respecting delegated permissions, confirmations, and audit boundaries.-
- AlicenseNot gradedqualityAmaintenanceEnables MCP-capable AI clients to access and act on a user's 21Vianet Microsoft 365 resources—mail, calendar, OneDrive, SharePoint, Teams, contacts, and search—via Microsoft Graph China while preserving delegated permissions, confirmations, and audit boundaries.MIT