Back to Home
the-sage-group icon

m365cp

by the-sage-group

Overview

This server exposes Microsoft 365 Graph API functionalities (user, drive, mail) as a Model Context Protocol (MCP) server, allowing AI models to interact with M365 services via defined tools.

Installation

Run Command
node dist/index.js

Environment Variables

  • PORT

Security Notes

CRITICAL VULNERABILITY: The `MicrosoftGraphTokenVerifier` explicitly decodes JWT access tokens without verifying their signature, relying solely on the Microsoft Graph API for verification. This means an attacker can craft a token (e.g., using `alg: "none"`) and include arbitrary `clientId`, `scopes`, or `expiresAt` claims in the `authInfo` object passed to the MCP tools. While actual Microsoft Graph API calls will fail if the token is truly invalid, any internal authorization logic or feature toggles within the MCP server's tools that rely on the contents of `extra.authInfo` could be bypassed, leading to unauthorized actions or information disclosure.

Similar Servers

Stats

Interest Score0
Security Score2
Cost ClassMedium
Avg Tokens25000
Stars0
Forks0
Last Update2025-12-04

Tags

Microsoft 365Graph APIOneDriveOutlookMCPTooling