← Back to search

microsoft-mcp-server

jordanburke Scanned 2d ago

Microsoft Graph MCP Server - Access Microsoft Graph API through the Model Context Protocol

C
73.3 / 100

Versions

0.1.0latest
Jan 26, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 6

microsoft_graph
annotations: none low

Execute multiple Microsoft Graph API requests in a single batch call (max 20). Use this for bulk operations like creating folder trees, sending multiple requests, or any scenario requiring many Graph API calls. Individual request failures don't fail the batch — each response has its own status code.

path string method enum apiVersion enum parameters object
microsoft_graph_batch
annotations: none low

Execute multiple Microsoft Graph API requests in a single batch call (max 20). Use this for bulk operations like creating folder trees, sending multiple requests, or any scenario requiring many Graph API calls. Individual request failures don't fail the batch — each response has its own status code.

id string url string method enum dependsOn array apiVersion enum parameters object
get_auth_status
annotations: none low

Check the current authentication status.

outputDir string apiVersion enum parameters object
download_file
annotations: none low

Download a file from SharePoint or OneDrive via Microsoft Graph API. Returns file content directly to the agent: images are returned inline, text files as text content, and binary files (Office docs, PDFs) are saved to disk. Supports optional format conversion (e.g., PDF).

outputDir string apiVersion enum parameters object
get_upload_config
annotations: none low

Get the authenticated upload endpoint URL and curl command for uploading files to SharePoint/OneDrive. Call this tool first, then execute the returned curl command (POST with --data-binary) to upload. This bypasses MCP protocol limits and handles files up to 250MB.

parameters object contentType string
read_document
annotations: none low

Download a file from SharePoint or OneDrive and return its readable text content. Supports DOCX, PDF, XLSX, and text-based files. Use this instead of download_file when you need to read document contents. Use with sharepoint_search results by constructing the path: /drives/{driveId}/items/{itemId}/content

apiVersion enum parameters object

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 29

low
Tool 'microsoft_graph' has no annotations annotation_checker · 100%
low
Tool 'microsoft_graph_batch' has no annotations annotation_checker · 100%
low
Tool 'get_auth_status' has no annotations annotation_checker · 100%
low
Tool 'download_file' has no annotations annotation_checker · 100%
low
Tool 'get_upload_config' has no annotations annotation_checker · 100%
low
Tool 'read_document' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in sapientsai-microsoft-mcp-server-94e1bbe/test/token-manager.spec.ts auth_checker · 95%
high
Hardcoded OAuth client ID in sapientsai-microsoft-mcp-server-94e1bbe/src/index.ts auth_checker · 85%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in sapientsai-microsoft-mcp-server-94e1bbe/test/download.spec.ts:289 entropy_analyzer · 75%
medium
Buffer.from base64 in sapientsai-microsoft-mcp-server-94e1bbe/test/download.spec.ts:311 entropy_analyzer · 75%
medium
Buffer.from base64 in sapientsai-microsoft-mcp-server-94e1bbe/test/download.spec.ts:326 entropy_analyzer · 75%
medium
Buffer.from base64 in sapientsai-microsoft-mcp-server-94e1bbe/test/download.spec.ts:358 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: microsoft_graph manifest_parser · 75%
info
Tool: microsoft_graph_batch manifest_parser · 75%
info
Tool: get_auth_status manifest_parser · 75%
info
Tool: download_file manifest_parser · 75%
info
Tool: get_upload_config manifest_parser · 75%
info
Tool: read_document manifest_parser · 75%
info
Required env vars (21) manifest_parser · 80%
medium
Hardcoded OAuth client ID in sapientsai-microsoft-mcp-server-94e1bbe/src/index.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 12 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%