microsoft-mcp

The server uses `os.getenv` for sensitive IDs (MICROSOFT_MCP_CLIENT_ID), stores tokens securely in a local cache (`~/.microsoft_mcp_token_cache.json`) via MSAL, and handles authentication via device flow. Input validation is implemented using Pydantic and custom validators (`email_params.py`, `validators.py`). HTML content is escaped using `html.escape` to prevent XSS. CSS inlining uses `xml.etree.ElementTree` and regex, not `eval` or `exec`. `ast.literal_eval` is used for internal flow cache from MSAL, which is generally safer than direct `eval` and is used on controlled data. Overall, the codebase demonstrates good security practices for an application interacting with a third-party API.