ms-365-mcp-server
by kvantexpert
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SILENT | No | Disable console output | |
| LOG_LEVEL | No | Set logging level (default: 'info') | info |
| READ_ONLY | No | Alternative to --read-only flag | |
| ENABLED_TOOLS | No | Filter tools using a regex pattern (alternative to --enabled-tools flag) | |
| MS365_MCP_MAX_TOP | No | Hard cap for Graph $top / top on list requests (positive integer). When the model passes a larger value, the server clamps it to n so responses stay smaller. Example: MS365_MCP_MAX_TOP=15 | |
| MS365_MCP_ORG_MODE | No | Enable organization/work mode (alternative to --org-mode flag) | |
| MS365_MCP_CLIENT_ID | No | Custom Azure app client ID (defaults to built-in app) | |
| MS365_MCP_MAX_ITEMS | No | Maximum number of items accumulated when fetchAllPages: true (positive integer, default 10000). Pagination stops and the response is truncated once this many items are collected. | 10000 |
| MS365_MCP_MAX_PAGES | No | Maximum number of pages followed when a tool is called with fetchAllPages: true (positive integer, default 100). Bounds memory and latency for large result sets. | 100 |
| MS365_MCP_TENANT_ID | No | Custom tenant ID (defaults to 'common' for multi-tenant). Personal Microsoft accounts should set this to consumers. | common |
| MS365_MCP_CLOUD_TYPE | No | Microsoft cloud environment (alternative to --cloud flag) | |
| MS365_MCP_REDACT_PII | No | Disable scrubbing of JWTs, Bearer headers, OAuth token fields, and email addresses from log messages (default: enabled). | true |
| MS365_MCP_USE_KEYTAR | No | Skipping the credential store on purpose (also accepts false, no or off) | |
| MS365_MCP_BODY_FORMAT | No | Return email bodies as HTML instead of plain text (default: text) | text |
| MS365_MCP_DISABLE_DCR | No | Disable OAuth Dynamic Client Registration (enabled by default in HTTP mode) | |
| MS365_MCP_OAUTH_TOKEN | No | Pre-existing OAuth token for Microsoft Graph API (BYOT method) | |
| MS365_MCP_EXTRA_SCOPES | No | Append additional Graph scopes to the token request | |
| MS365_MCP_KEYVAULT_URL | No | Azure Key Vault URL for secrets management | |
| MS365_MCP_CLIENT_SECRET | No | Custom Azure app client secret | |
| MS365_MCP_OUTPUT_FORMAT | No | Enable TOON output format (alternative to --toon flag) | json |
| MS365_MCP_ALLOWED_SCOPES | No | Limit exposed tools to Graph scopes covered by this allowlist | |
| MS365_MCP_ATTACHMENT_HOST | No | Interface the MS365_MCP_ATTACHMENT_PORT listener binds (alternative to --attachment-host; requires --attachment-port). | |
| MS365_MCP_ATTACHMENT_PORT | No | Serve the attachment route on its own listener on this port (alternative to --attachment-port; requires --enable-attachment-urls) | |
| MS365_MCP_ALLOW_PAGINATION | No | Disable multi-page following entirely. When set, the fetchAllPages parameter is not advertised on tools, and any request that still passes it returns only the first page (default: pagination enabled). | true |
| MS365_MCP_TOKEN_CACHE_PATH | No | Custom file path for MSAL token cache | |
| MS365_MCP_TRUST_PROXY_HOPS | No | Number of trusted reverse-proxy hops in HTTP mode (default 1). | 1 |
| MS365_MCP_EXPECTED_USERNAME | No | Require local MSAL auth to use this Microsoft account username (case-insensitive; CLI flag takes precedence) | |
| MS365_MCP_FORCE_WORK_SCOPES | No | Backwards compatibility for MS365_MCP_ORG_MODE | |
| MS365_MCP_ATTACHMENT_URL_KEY | No | required (or _KEY_FILE=/path). MS365_MCP_ATTACHMENT_URL_KEY=... | |
| MS365_MCP_AUTH_CACHE_COMMAND | No | External executable wrapper for provider-neutral auth-cache storage | |
| MS365_MCP_ATTACHMENT_URL_BASE | No | required. MS365_MCP_ATTACHMENT_URL_BASE=http://m365-mcp:3000 | |
| MS365_MCP_RATE_LIMIT_DISABLED | No | Disable per-IP rate limiting in HTTP mode (default: enabled — 30 req/min on /authorize, /token, /register; 120 req/min on /mcp) | |
| MS365_MCP_ATTACHMENT_URL_TTL_S | No | optional, default 120, max 300 | 120 |
| MS365_MCP_ATTACHMENT_URL_KEY_ID | No | optional, default 1 | 1 |
| MS365_MCP_HTTP_LOCAL_FILE_TOOLS | No | Register download-bytes-to-file over HTTP (alternative to --http-local-file-tools; same restrictions) | |
| MS365_MCP_SELECTED_ACCOUNT_PATH | No | Custom file path for selected account metadata | |
| MS365_MCP_MESSAGE_SIGNOFF_PREFIX | No | Signoff prepended to outgoing messages so recipients can tell they were agent-sent, e.g. 🤖. Default: none. | |
| MS365_MCP_MESSAGE_SIGNOFF_SUFFIX | No | Signoff appended to outgoing messages. Default: none. | |
| MS365_MCP_ATTACHMENT_URL_KEY_FILE | No | alternative to KEY | |
| MS365_MCP_EXPECTED_HOME_ACCOUNT_ID | No | Require local MSAL auth to use this exact MSAL homeAccountId (CLI flag takes precedence) | |
| MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS | No | Per-invocation timeout for MS365_MCP_AUTH_CACHE_COMMAND (default: 10000) | 10000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityActive
ResponsivenessNo issues