dockndevai/mcp-outlook

A **safe-by-default** Model Context Protocol server for **Microsoft Outlook** mail, over Microsoft Graph. It lets an agent read and operate a mailbox — list folders and messages, full-text **search**, read bodies and attachment metadata, list contacts, and (in higher modes) create drafts, **send / reply / forward**, mark read, move messages, and delete. It also manages **OneDrive files** — browse, search, download, upload, create folders, move/rename, and delete — and the **calendar** — list calendars and events, check free/busy, and (gated) create, update, respond to, cancel and delete events.
**Browser sign-in:** on first run it opens your browser to the Microsoft sign-in page, then caches the token and refreshes it silently — the server never sees your password.
Part of the dockndevai MCP server suite — one governance model across all of them.
What it gives an agent
The server starts **read-only** (see Safe by default); higher-capability tools are only registered when you raise the mode.
| Tool | For | Needs mode |
|---|---|---|
| whoami | confirm which mailbox is in use | read-only |
| list_folders | mail folders with unread/total counts | read-only |
| list_messages | recent messages (by folder, unread-only) | read-only |
| search_messages | full-text search across the mailbox | read-only |
| get_message | one message with full body + recipients | read-only |
| list_attachments | attachment metadata (bytes not returned) | read-only |
| list_contacts | personal contacts | read-only |
| create_draft | prepare a draft without sending | read-write |
| send_mail | compose & send a new email | read-write + OUTLOOK_ALLOW_SEND |
| reply_mail / forward_mail | reply (all) / forward a message | read-write + OUTLOOK_ALLOW_SEND |
| mark_read | mark read / unread (reversible) | read-write |
| move_message | move to another folder (reversible) | read-write |
| delete_message | delete (to Deleted Items) | admin + OUTLOOK_ALLOW_DELETE |
| list_drive_items / get_drive_item | browse OneDrive files & folders | read-only |
| search_drive_files | search OneDrive | read-only |
| download_drive_file | read a OneDrive file's text | read-only |
| upload_drive_file | create/overwrite a OneDrive file | read-write |
| create_drive_folder / move_drive_item | create folder / move-rename | read-write |
| delete_drive_item | delete a OneDrive item (→ recycle bin) | admin + OUTLOOK_ALLOW_DELETE |
| list_calendars / list_events / get_event | browse calendars & events (window expands recurrences) | read-only |
| get_free_busy | check availability for people before scheduling | read-only |
| create_event / update_event | create / update a meeting (invites attendees) | read-write + OUTLOOK_ALLOW_SEND |
| respond_to_event | accept / decline / tentatively accept an invite | read-write + OUTLOOK_ALLOW_SEND |
| cancel_event / delete_event | cancel a meeting / delete an event | admin + OUTLOOK_ALLOW_DELETE |
> **Access is ultimately governed by your Microsoft account's granted scopes.** Calendar tools need the
> Calendars.ReadWrite delegated scope (included in the defaults). If your token wasn't consented for it,
> Graph returns 403 — the suite's modes/flags are defence in depth on top of that Microsoft-level control.