sharepoint-docs-mcp

The server relies on Azure AD for authentication, supporting both certificate-based (application permissions) and OAuth (user delegated permissions) methods. It uses environment variables for sensitive configurations, preventing hardcoded secrets. The `SharePointTokenVerifier` explicitly notes it accepts SharePoint tokens without full cryptographic validation, relying on the OIDC proxy flow's security (PKCE, direct Azure AD issuance). This is a documented design choice, not a direct vulnerability, but it's a point of awareness. Robust error handling and network timeouts are implemented.