outlook-mcp

The server employs robust security practices including OAuth 2.0 with PKCE for secure delegated authentication, ensuring no client secrets are stored. Tokens are encrypted and stored locally, leveraging the OS keychain if available, or encrypted file storage as a fallback. Critical configuration values (Client ID, Tenant ID) are explicitly handled via environment variables, preventing hardcoding. Input and output content are actively sanitized using DOMPurify and custom malicious pattern detection to mitigate XSS and other injection vulnerabilities. Furthermore, HTTP connections to the Microsoft Graph API utilize TLSv1.2 with strong ciphers and configured connection pooling, enhancing network security and reliability. There is active validation of file paths to prevent traversal attacks. No instances of 'eval' or obvious obfuscation were found.