Microsoft 365 MCP Server

An MCP server that exposes Microsoft 365 operations as tools, backed by Microsoft Graph — SharePoint, OneDrive, Mail, Calendar, Users & Directory, and Groups — plus text extraction from Office/PDF documents and mail attachments.

It is stateless and does not do any OAuth: your application already holds a valid Microsoft Graph access token, and it supplies that token with each request. No re-authentication, no token exchange, no gateway.

Why this exists

If you already obtained a Microsoft Graph delegated access token (aud = https://graph.microsoft.com) via a 3LO flow in your app, you cannot feed that token into an On-Behalf-Of (OBO) exchange — Entra requires the OBO assertion to target a middle-tier app, not Graph itself. This server avoids the problem entirely by calling Graph directly with the token you already have.

Install & run with uvx

The server ships as a uvx-runnable package. uv builds and runs it in an isolated environment on demand — no manual pip install.

Once published to an index you can run it by name:

uvx keos-microsoft365-mcp

Providing the access token

The token is resolved per request in this order:

1. Explicit argument — pass access_token in the tool call arguments.
2. Bearer header — when running over HTTP, send Authorization: Bearer <token>.
3. Environment — GRAPH_ACCESS_TOKEN (or the legacy SHAREPOINT_ACCESS_TOKEN).

The token must be a Microsoft Graph delegated access token (aud = https://graph.microsoft.com). Grant the scopes for the tools you use:

Tokens are short-lived (~1 hour). This server never refreshes them — supplying a fresh token is the caller's responsibility.

Tools

Identity

SharePoint

OneDrive

The drive tools (read_file, extract_file, get_item, list_items) work against OneDrive and Group/Teams drives too — pass the relevant drive_id.

Mail

Calendar

Users & Directory

Groups

Document extraction

extract_file and extract_mail_attachment return readable text from binary formats that read_file cannot decode:

• Word .docx, Excel .xlsx, PowerPoint .pptx — parsed with the Python standard library (no third-party dependency).
• PDF .pdf — via pypdf (a declared dependency, installed automatically).
• Text family .txt .csv .tsv .json .md .xml .html .yaml, etc.

Legacy binary formats (.doc, .xls, .ppt) are not supported — convert to the OpenXML equivalent or PDF first.

Response shape

Every tool returns a normalized object:

// success
{ "ok": true, "data": { /* Graph response, or extracted text */ } }

// failure
{ "ok": false, "error": "graph_error", "status_code": 403, "message": "...", "body": { } }

Extraction failures use "error": "extraction_error"; a missing token uses "error": "missing_token".

Notes

• The server never stores or logs tokens.
• Token expiry/refresh is the caller's responsibility — this server only forwards what it is given.
• Write and send operations (send_mail, create_event, move_message, ...) act as the signed-in user. Guard them with autoApprove care in your client.