Skip to main content
Glama

Microsoft 365 Agent Integration

Project

Sanitized integration between an AI agent and Microsoft 365 services using MCP, Microsoft Graph, Microsoft Entra ID, and OAuth.

Related MCP server: Microsoft Graph MCP Server

Problem

Corporate workflows distribute information across Outlook, calendars, Teams, SharePoint, and Power Platform. Manual access creates repeated navigation, context switching, and difficulty automating tasks with a controlled permission boundary.

Solution

A small integration layer lets an agent discover and execute explicitly authorized tools while respecting the scopes and permissions configured in Microsoft Entra ID. This repository is a clean-room reference implementation: it preserves the observed architecture and safety contracts without copying private source, identifiers, credentials, or corporate payloads.

Security

No credential or corporate data is included. The public version uses placeholders, synthetic fixtures, deterministic mocks, redacted audit records, and read-only behavior by default. Remote write operations are not exposed by the public MCP runtime.

Architecture

flowchart LR
    Agent[AI Agent / Hermes]
    MCP[MCP stdio integration layer]
    Policy[Allowlist and scope policy]
    Auth[Microsoft Entra ID / OAuth2 app-only]
    Graph[Microsoft Graph wrapper]
    Outlook[Outlook mail]
    Calendar[Calendar]
    Teams[Teams channel]
    SharePoint[SharePoint]
    Power[Power Platform / Dataverse]
    Audit[Sanitized audit events]
    Fixtures[Synthetic fixtures / mock backend]

    Agent --> MCP
    MCP --> Policy
    Policy --> Fixtures
    Policy --> Auth
    Auth --> Graph
    Graph --> Outlook
    Graph --> Calendar
    Graph --> Teams
    Graph --> SharePoint
    Graph --> Power
    MCP --> Audit

The public code does not claim that one permission grants access to every service. Each service is listed independently and must be configured in the consumer's own tenant.

What the real implementation showed

The private installation evidence inspected for this portfolio contained separate custom MCP servers for:

  • Outlook/mail read;

  • Calendar read;

  • Teams channel read;

  • SharePoint read;

  • controlled mail draft and SharePoint action paths;

  • Power Platform/Dataverse with a pinned development scope.

The servers used MCP over stdio, Microsoft Graph, OAuth2 client credentials, fixed or operator-configured identities outside tool arguments, bounded pagination, host allowlisting, and sanitized audit records. The external backup contained source repositories and audit metadata, not Hermes conversation transcripts.

MCP distinction

This is not the Microsoft Enterprise MCP product. The observed integration was a set of custom MCP servers written for a specific operator workflow. Hermes supplies the MCP host/client capability; the Microsoft layer owns the tool schemas, Graph calls, identity boundary, permission policy, and redaction rules.

Public tool surface

The clean-room mock runtime publishes these bounded tools:

Tool

Service

Public behavior

calendar_agenda

Calendar

Synthetic bounded agenda with conflict detection

mail_list_inbox

Outlook

Synthetic message metadata; no mailbox selector

mail_prepare_draft

Outlook

Local preview only; never writes or sends

teams_channel_history

Teams

Synthetic history for logical aliases

teams_channel_digest

Teams

Classifies only explicit leading markers

sharepoint_list_folder

SharePoint

Synthetic metadata listing

sharepoint_read_document

SharePoint

Bounded synthetic UTF-8 document read

powerplatform_list_flows

Dataverse

Synthetic development-scope metadata

tools/list and tools/call are exercised through the included stdio contract. The mock backend is intentionally the default so a clone-and-test run never contacts Microsoft 365.

Status boundary

Capability

Status

Meaning

MCP initialize / tools/list / controlled tools/call

IMPLEMENTED_AND_VERIFIED

Tested locally against the clean-room runtime

Graph OAuth2 client-credentials wrapper

IMPLEMENTED_AND_VERIFIED

Tested with injected HTTP transports; no secret is required

Graph 401/403/429/timeout/invalid JSON handling

IMPLEMENTED_AND_VERIFIED

Tested offline

Outlook read architecture

IMPLEMENTED_NOT_RETESTED

Confirmed in private source evidence; public code uses synthetic fixtures

Calendar read architecture

IMPLEMENTED_NOT_RETESTED

Confirmed in private source evidence; remote smoke is not claimed

Teams channel read architecture

IMPLEMENTED_NOT_RETESTED

Confirmed in private source evidence; RSC is tenant-specific

SharePoint read architecture

IMPLEMENTED_NOT_RETESTED

Confirmed in private source evidence; IDs are not published

Power Platform/Dataverse

DOCUMENTED_ONLY

Private evidence exists; no corporate endpoint is included here

Delegated Microsoft OAuth

NOT_SUPPORTED

The observed Microsoft path was app-only client credentials

Remote Microsoft write operations

NOT_SUPPORTED

Deliberately excluded from the public runtime

Permission model

The public project does not grant permissions. For an optional tenant integration, request only the scopes required by the tools you actually implement. Typical private implementation categories were:

  • Microsoft Graph application access for bounded mail/calendar reads;

  • Exchange Application RBAC to restrict mailbox scope;

  • Teams Resource-Specific Consent for approved resources;

  • SharePoint site/drive allowlists;

  • a separate, pinned Power Platform development environment.

Do not replace a missing resource authorization with a tenant-wide permission. See docs/permissions.md.

Quickstart with mocks

Requirements: Python 3.11–3.13 and uv.

uv venv
uv pip install -e '.[dev]'
uv run pytest --cov
uv run python scripts/scan_secrets.py
uv run m365-mcp-stdio --mock
# Optional official MCP Python SDK transport:
uv run m365-mcp-sdk-stdio

The stdio process accepts MCP JSON-RPC requests. A minimal handshake sequence is:

{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"demo","version":"0.1.0"}}}
{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}
{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}

The repository's tests exercise the same contract without requiring a terminal session or Microsoft account.

Optional tenant integration

This repository does not ship a live tenant adapter or private IDs. A consumer with its own tenant can reuse the typed Graph client and provide its own:

MSGRAPH_TENANT_ID=<AZURE_TENANT_ID>
MSGRAPH_CLIENT_ID=<AZURE_CLIENT_ID>
MSGRAPH_CLIENT_SECRET=<CLIENT_SECRET_NOT_INCLUDED>
MSGRAPH_MAILBOX=<TEST_USER_EMAIL>

Keep values in an environment/credential manager. Do not add them to config.yaml, fixtures, logs, issues, or pull requests. A live adapter must add a service-specific allowlist and read-only tests before any remote call is enabled.

Evidence and tests

The evidence/ directory contains generated, sanitized summaries only. It must never contain message bodies, document contents, access tokens, tenant IDs, mailbox addresses, or private Graph IDs.

Local gates:

uv run python -m compileall -q src tests
uv run ruff check src tests scripts
uv run pytest --cov
uv run bandit -q -r src
uv run pip-audit
uv run python scripts/scan_secrets.py

GitHub Actions runs the same categories. The workflow badge is intentionally omitted until the public repository has a successful remote run.

Limitations

  • Synthetic fixtures prove contracts, not a live tenant's current permissions.

  • The public repository does not reproduce private mailbox, SharePoint, Teams, or Dataverse identifiers.

  • Remote permission behavior depends on Entra consent, Exchange RBAC, Teams RSC, and tenant policy.

  • Power Apps/Dataverse is not exposed as a live public connector.

  • No email, event, Teams message, SharePoint item, or Dataverse record is created by the default runtime.

License

MIT. See LICENSE.

Available Tools

8 tools
calendar_agendaA
Read-only

Read a bounded synthetic calendar agenda for the configured identity.

ParametersJSON Schema
NameRequiredDescriptionDefault
timezoneNoIANA timezone for offset-free input
end_datetimeYesISO-8601 end timestamp
start_datetimeYesISO-8601 start timestamp

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable context by stating the data is 'synthetic' and 'bounded', which informs the agent that results are simulated and limited to the given range. This goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that immediately states the action and scope. Every word contributes meaning—'read', 'bounded', 'synthetic', 'calendar agenda', 'configured identity'—with no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with annotations covering safety, the description is mostly complete. It lacks a note on the return format, but given the synthetic nature and the parameters, an agent can reasonably infer what to expect. The absence of an output schema means a brief mention of what the agenda contains could improve it, but it is not critically missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (start_datetime, end_datetime, timezone all have descriptions). The tool description adds no additional parameter information beyond saying 'bounded', which is already implied by the start/end fields. The description neither compensates for any gaps nor enhances the schema details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies a precise verb (read), a clear resource (calendar agenda), and adds qualifiers (bounded, synthetic, configured identity) that make the tool's function unambiguous. It clearly distinguishes itself from the sibling tools, which all target different domains (mail, teams, sharepoint, powerplatform).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While there is no explicit when/when-not guidance, the description clearly conveys that this is a read-only operation for fetching a calendar agenda within a range. Since no sibling tools are calendar-related, the usage context is clear from the name and description, though a note on when to use it (e.g., 'use to retrieve agenda items') would be slightly stronger.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mail_list_inboxB
Read-only

Read synthetic inbox metadata for the configured identity.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only and non-destructive behavior, and the description does not contradict them. It adds the useful context that the inbox is 'synthetic' and tied to a 'configured identity', but it does not disclose limit/pagination behavior or what fields the metadata contains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short sentence with no fluff, and the key verb and resource are front-loaded. Every word contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one optional parameter and strong annotations, the description is mostly sufficient. However, with no output schema, it should clarify what 'inbox metadata' actually contains and how the limit parameter shapes the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter `limit` has clear constraints in the schema, but schema_description_coverage is 0% and the description never mentions the parameter. Since the coverage is low, the description should have compensated by explaining how the limit affects the returned inbox metadata; it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Read'), a resource ('synthetic inbox metadata'), and a scope ('for the configured identity'). It is clearly distinct from the sibling mail_prepare_draft, which is a compose/write action. It falls short of 5 because 'metadata' is somewhat ambiguous about whether it returns message summaries, counts, or other fields.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus alternatives, nor any mention of prerequisites such as identity configuration. The intended use must be inferred from the name and the generic read description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mail_prepare_draftA
Read-only

Prepare a local draft preview; this tool never writes or sends mail.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNo
toYes
bodyYes
subjectYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and non-destructive. The description adds meaningful behavioral context beyond that by specifying the draft is 'local' and that it 'never writes or sends mail', which clarifies the exact side-effect profile. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tight sentence that front-loads the core purpose and immediately follows with the most important safety boundary. Every word earns its place; there is no redundancy or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, read-only local preview tool, the description covers purpose and safety well. However, it does not mention what the tool returns or what an agent should expect after calling it, and there is no output schema to fill that gap. Parameter semantics are also left entirely to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not explain any of the parameters: to, subject, body, or cc. The parameter names and types are visible in the schema, but the description adds no meaning beyond them. With low schema coverage, the description needed to compensate and did not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Prepare a local draft preview'. It also explicitly states a critical boundary: 'this tool never writes or sends mail', which clearly distinguishes it from any mail-sending or server-side draft tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: when a local, side-effect-free draft preview is needed. However, it does not explicitly state when not to use it or name alternatives, such as mail_list_inbox for reading mail or a hypothetical send tool. The usage context is clear but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

powerplatform_list_flowsA
Read-only

List synthetic flow metadata from a pinned development scope.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description's 'List' aligns with that. The description adds useful context by saying the data is synthetic and scoped to a pinned development scope, but it does not disclose return shape, pagination, or behavior when no flows exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler, no restatement of the tool name, and no wasted words. Every phrase contributes either the action, the resource, or the scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless listing tool, this is nearly complete: it names the resource and scope, and the annotations cover safety behavior. The main gap is that 'pinned development scope' is unexplained jargon, and there is no output schema to clarify the returned metadata structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero properties, so there are no parameters to document and schema coverage is effectively complete. Since there are no parameters, the description cannot add parameter-level meaning, but none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a concrete verb ('List') and identifies the resource ('synthetic flow metadata') and scope ('pinned development scope'), so an agent can recognize this as a read-only flow listing tool. It does not say exactly what fields the metadata contains, but it is distinct from the unrelated sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'from a pinned development scope' implies the tool should be used for development-scoped flow metadata, which is a useful usage constraint. However, it does not explicitly say when to prefer this tool over alternatives, why the data is synthetic, or what to use for production flow metadata.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sharepoint_list_folderB
Read-only

List synthetic SharePoint metadata for an allowlisted logical folder.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds 'synthetic' and 'allowlisted' which inform the agent that data is not real and access is restricted to a specific folder. These are useful behavioral clues beyond the annotations, but the description does not elaborate on return format or pagination. Given the annotations, a 3 is reasonable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence with no filler. It front-loads the core action and resource, and every word contributes value. It is appropriately sized for a tool with a single parameter and no output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with one optional parameter and no output schema, the description covers the purpose and the safety (via annotations). However, it does not describe what the returned metadata looks like (e.g., a list of files, nested structure, or specific fields), which could be important for downstream usage. The word 'synthetic' implies placeholder data but doesn't confirm the structure. Overall, it is adequate but not fully complete for an agent to know what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not directly explain the 'target' parameter. However, the phrase 'for an allowlisted logical folder' hints that 'target' selects the folder, and the schema's single enum value (demo-folder) reduces ambiguity. Still, the description fails to explicitly map the parameter to its meaning, leaving the agent to infer from the enum name and the tool name. This is a minimal contribution beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a clear resource ('synthetic SharePoint metadata for an allowlisted logical folder'). It distinguishes itself from sibling sharepoint_read_document by focusing on listing metadata rather than reading a document, and the 'synthetic' qualifier clarifies the nature of the data. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given on when to use this tool versus alternatives. There is no mention of context (e.g., 'when you need to see available folders') or exclusions (e.g., 'for real data use X'). The usage is only implied by the name and description, but a clear differentiation would help an agent decide between this and other listing tools like teams_channel_digest or calendar_agenda.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sharepoint_read_documentA
Read-only

Read one bounded synthetic UTF-8 document by logical alias.

ParametersJSON Schema
NameRequiredDescriptionDefault
alias_or_known_itemYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds 'synthetic' and 'bounded', which signals it's a test/demo document and possibly limited in scope. It does not describe return format or error behavior, but that is not critical for a read-only tool with a single enum value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly-worded sentence with no fluff. It front-loads the action ('Read') and specifies the resource type. Every word contributes to the meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool this simple—one required enum parameter, read-only annotations, no output schema—the description is nearly complete. It could mention that it returns the document content, but the absence is not significant given the trivial scope. The only real omission is guidance on when to use it versus listing, which is covered under usage_guidelines.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It says 'by logical alias', which maps directly to the parameter alias_or_known_item, giving it meaning. However, it does not explain what a 'known_item' is or how the alias format works, though the enum already constrains it to one value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action (Read) and a specific resource (one bounded synthetic UTF-8 document by logical alias). It is unambiguous about what the tool does. However, it does not explicitly distinguish itself from the sibling sharepoint_list_folder, though reading vs listing is inherently different.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: when you need to read a document by alias. But it provides no explicit when-to-use or when-not-to-use guidance, and does not mention alternatives like sharepoint_list_folder for browsing. The context is simple enough that this is a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

teams_channel_digestC
Read-only

Classify only explicit decision, task, plan, status, blocker, and question markers.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
team_refYes
timezoneNo
channel_refYes
end_datetimeYes
start_datetimeYes

TDQS

C2.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds a meaningful behavioral boundary by stating that only explicit markers are classified, implying implicit or ambiguous content will be ignored. This is useful context, though it does not disclose return shape, pagination, or aggregation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence with no filler, but it is under-specified rather than concise in a useful way. It front-loads a classification rule while omitting the tool's primary function, making the brevity a liability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With six parameters, no output schema, and no parameter descriptions, the description is far too incomplete for an agent to invoke the tool correctly. The readOnlyHint and sibling names add some context, but the description fails to explain what a 'digest' is, what data it returns, or how the classification markers map to an actionable result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no information about team_ref, channel_ref, start_datetime, end_datetime, limit, or timezone. The parameter semantics are entirely undocumented in both the schema and the description, so an agent cannot know how to format datetime values or how limit affects results.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Classify') and enumerates the marker types (decision, task, plan, status, blocker, question), so it is not a pure tautology. However, it never states the resource being classified (presumably Teams channel messages) or what output the digest produces, leaving the core purpose vague. It also does not distinguish itself from the sibling teams_channel_history.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus alternatives such as teams_channel_history or calendar_agenda. The phrase 'only explicit' hints at a conservative classification policy, but it does not explain use cases, exclusions, or selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

teams_channel_historyC
Read-only

Read bounded history for an operator-registered synthetic channel alias.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
team_refYes
timezoneNo
channel_refYes
end_datetimeYes
start_datetimeYes

TDQS

C2.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the 'bounded' scope and the synthetic-alias context, but it does not disclose return format, pagination, or access requirements. It adds some value but not rich behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence and front-loaded, but it is under-specified for a tool with 6 parameters and 4 required fields. This is not effective conciseness; it omits needed operational context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameter descriptions, the description is too incomplete for reliable invocation. It does not mention required fields, datetime format expectations, limits, or what the returned history looks like. Read-only annotations help, but the tool still lacks sufficient guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no parameter-level meaning. 'Bounded history' vaguely hints at a time range or limit, but it does not explain team_ref, channel_ref, start_datetime, end_datetime, timezone, or limit. The description fails to compensate for the schema's lack of parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Read bounded history' for a 'synthetic channel alias.' It clearly identifies what the tool does, though it does not explicitly distinguish itself from sibling tools like teams_channel_digest.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'operator-registered synthetic channel alias' implies when the tool is appropriate, but there is no explicit guidance about when to prefer this over siblings such as teams_channel_digest or mail_list_inbox. Usage context is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.0
    • First observedcalendar_agenda
    • First observedmail_list_inbox
    • First observedmail_prepare_draft
    • First observedpowerplatform_list_flows
    • First observedsharepoint_list_folder
    • First observedsharepoint_read_document
    • First observedteams_channel_digest
    • First observedteams_channel_history

TDQS

B3.2/5.0

Scored across 8 tools

Disambiguation4/5

Each tool targets a distinct Microsoft 365 domain (calendar, mail, teams, sharepoint, powerplatform), so there is little overlap. The only mild ambiguity is between teams_channel_history and teams_channel_digest, but their descriptions clearly separate raw history from classified markers.

Naming Consistency4/5

Tool names consistently follow a domain_noun_verb pattern (e.g., calendar_agenda, mail_list_inbox, sharepoint_read_document). Minor inconsistency exists between mail_prepare_draft (verb_noun) and teams_channel_digest (noun_noun), but the overall pattern is predictable.

Tool Count5/5

Eight tools is well-scoped for a Microsoft 365 integration covering five product areas. Each tool earns its place by exposing a distinct read-only or draft operation without unnecessary bloat.

Completeness3/5

The surface covers read and draft operations across several M365 domains, but it is intentionally synthetic and read-only. Obvious gaps like sending mail, updating calendar events, or writing to SharePoint are absent, though the descriptions suggest this is a bounded preview scope rather than a full CRUD API.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    A production-ready MCP server that provides secure, delegated access to Microsoft 365 services including Email, SharePoint, OneDrive, and Calendar. It enables AI models to search messages, browse files, manage calendar events, and parse document contents using OAuth 2.1 authentication.
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Exposes Azure AI Foundry agents, workflows, and AI Search vector-database capabilities as MCP tools, enabling natural language interaction with agents, semantic search, and index management.
    10
    2
    MIT