simply-outlook-mcp

The server securely handles authentication tokens using `@azure/identity` with local persistence. User-provided content for emails/events is sanitized via `DOMPurify` when converted from Markdown to HTML before being sent to Microsoft Graph, mitigating potential XSS. The client ID is not hardcoded and the README provides strong warnings and best practices for creating a dedicated Azure AD application. No 'eval' or malicious obfuscation patterns were found. Communication with the MCP client is over standard I/O (stdio), limiting direct network exposure.