nitin27may/ms-graph-mcp

Releases · Changelog
A Model Context Protocol server for **Microsoft Graph** — 85
tools across mail, calendar, meetings (including transcripts), Teams chat, files, SharePoint,
search, people, contacts, directory, tasks and OneNote, over **stdio** or **Streamable HTTP**.
**Signs you in with your own Microsoft account** — browser SSO, no token to paste, no client secret.
- **No msgraph-sdk, no azure-identity** — the Graph client is raw httpx2, so the dependency tree
stays small and the wire behaviour is inspectable.
- **Read/write separation is enforced, not advisory** — write tools are hidden *and* refused unless
the caller explicitly opts in.
- **Auth-agnostic by default** — tools receive an already-acquired Graph token via the request
context. The server can also perform its own on-behalf-of exchange when you want it to act as a
proper OAuth resource server.
> **Status: early.** Extracted from a production agent platform where it has been running against a
> real tenant. The code is battle-tested; the packaging and public API surface are newer. Expect the
> config surface to move before 1.0.
Install
Requires **Python 3.12+**. Two paths — pick the one that matches what you want to do.
A. Use the package
Nothing to clone. uv runs it straight from PyPI:
or install it into an environment:
Release candidates are published too. pip skips them unless you ask:
A container image is on GHCR for the HTTP transport — see
docs/hosting.md.
Also listed on the official MCP registry as
io.github.nitin27may/ms-graph-mcp.
> **TestPyPI is not a distribution channel.** Every release is published there first, but that is a
> rehearsal of the publishing process: it can be wiped without notice and does not mirror PyPI, so
> installing from it needs --extra-index-url https://pypi.org/simple/ just to resolve ordinary
> dependencies. Use PyPI, or --pre.
B. Run from source
For hacking on it, forking it, or running an unreleased change:
uv sync is the only setup step. See
CONTRIBUTING.md before
opening a pull request — the tool allowlists and the tier separation have invariants that are
enforced rather than advisory.
To point an MCP client at your clone, you need its absolute path — clients do not inherit your
working directory and most do not expand ~:
Then use the source form of the config in
Configure your MCP client below.
Set up the Entra app
You need an **Entra ID app registration** — about two minutes. **Do not create a client secret:**
this registers as a *public client*, which signs you in through your browser using PKCE. A secret on
a program running on your own machine would be readable by anyone with the config file, which is why
the flow is designed not to need one. Nothing goes into a config file except two ids, neither of
which is sensitive.
In the Entra portal → **App registrations** → **New registration**:
- **Name:** anything, e.g. ms-graph-mcp
- **Supported account types:** *Accounts in this organizational directory only*
- **Redirect URI:** select **Public client/native**, value http://localhost
Leave **Certificates & secrets** alone — you do not need anything from it.
Then, on the new app:
- **Authentication** → enable **Allow public client flows**
- **API permissions** → **Add a permission** → **Microsoft Graph** → **Delegated permissions**, and
add what you want the agent to reach. A sensible read-only starting set:
The complete copy-paste consent sets — and which permission each individual tool needs — are in
docs/permissions.md.
Copy the **Application (client) ID** and **Directory (tenant) ID** from the Overview page. That is
everything you need.
Configure your MCP client
Every MCP client that speaks stdio takes the same three things — a command, its arguments, and an
environment block:
Where that block goes, and what the surrounding key is called, differs:
| Client | Config file | Key |