SharePoint MCP Server

FastMCP server exposing SharePoint file operations to Microsoft Copilot Studio. Publishes files and returns organisation-scoped hyperlinks; file bytes are never returned to the agent.

Tools

Related MCP server: SharePoint MCP Server

Setup

1. Register an Entra app — see the "Entra app registration" section of mode you need no admin involvement.

2. Fill in .env (see below). If you only have the tenant/client IDs and don't know the site, leave SP_HOSTNAME/SP_SITE_PATH blank for now.

3. .venv/bin/python scripts/list_sites.py — signs you in and prints SP_HOSTNAME plus an SP_SITE_PATH for every site you can reach; paste the pair for your site into .env.

4. .venv/bin/python scripts/find_drive_id.py — prints SP_DRIVE_ID; paste it into .env.

5. Create the AgentFiles folder in the document library.

6. .venv/bin/python scripts/smoke.py — live round trip.

7. .venv/bin/python My_Sharepoint_Test.py, then ngrok http 8000.

8. In Copilot Studio: Tools → Add a tool → New tool → Model Context Protocol, URL https://<ngrok>.ngrok-free.app/mcp, authentication None.

Configuration

Switching to app-only auth

When IT provides a client secret, admin consent for Sites.Selected, and a per-site write grant (POST /sites/{site-id}/permissions — admin consent alone grants nothing): set SP_CLIENT_SECRET and SP_AUTH_MODE=app, then restart. No code changes.

Design notes

• Links, not bytes. createLink with scope: "organization" is used everywhere. A driveItem's raw webUrl only opens for people who already have permission to it, so it is never returned.

• Containment. Every path is confined to SP_ROOT_FOLDER. Traversal and absolute paths are rejected before any network call.

• Uploads default to conflictBehavior=rename. Graph's own default is silent overwrite.

• Azure ACS is dead (retired 2 April 2026). Tutorials using ClientCredential(client_id, client_secret) with Office365-REST-Python-Client no longer work. This server uses Entra ID against Microsoft Graph, which is unaffected.

Testing

.venv/bin/pytest              # 78 offline tests, no SharePoint needed
.venv/bin/python scripts/smoke.py   # live round trip