by ryaker
MCP server for Claude to access Outlook data via Microsoft Graph API
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
# Add to your Claude Code skills
git clone https://github.com/ryaker/outlook-mcpGuides for using mcp servers skills like outlook-mcp.
Last scanned: 8/28/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/inspector: MCP Inspector proxy server lacks authentication between the Inspector client and proxy",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
"severity": "low"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"severity": "low"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiter",
"severity": "high"
},
{
"type": "npm-audit",
"message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "serve-handler: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-08-28T15:55:19.741Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}A comprehensive MCP (Model Context Protocol) server that connects Claude with Microsoft 365 services through the Microsoft Graph API and Power Automate API.
├── index.js # Main entry point
├── config.js # Configuration settings
├── auth/ # Authentication modules
│ ├── index.js # Authentication exports
│ ├── token-manager.js # Token storage and refresh (Graph + Flow)
│ └── tools.js # Auth-related tools
├── calendar/ # Calendar functionality
│ ├── index.js # Calendar exports
│ ├── list.js # List events
│ ├── create.js # Create event
│ ├── delete.js # Delete event
│ ├── cancel.js # Cancel event
│ ├── accept.js # Accept event
│ └── decline.js # Decline event
├── email/ # Email functionality
│ ├── index.js # Email exports
│ ├── list.js # List emails
│ ├── search.js # Search emails
│ ├── read.js # Read email
│ ├── send.js # Send email
│ └── mark-as-read.js # Mark email read/unread
├── folder/ # Folder functionality
│ ├── index.js # Folder exports
│ ├── list.js # List folders
│ ├── create.js # Create folder
│ └── move.js # Move emails
├── rules/ # Email rules functionality
│ ├── index.js # Rules exports
│ ├── list.js # List rules
│ └── create.js # Create rule
├── onedrive/ # OneDrive functionality
│ ├── index.js # OneDrive exports
│ ├── list.js # List files/folders
│ ├── search.js # Search files
│ ├── download.js # Get download URL
│ ├── upload.js # Simple upload (<4MB)
│ ├── upload-large.js # Chunked upload (>4MB)
│ ├── share.js # Create sharing link
│ └── folder.js # Create/delete folders
├── power-automate/ # Power Automate functionality
│ ├── index.js # Power Automate exports
│ ├── flow-api.js # Flow API client
│ ├── list-environments.js # List environments
│ ├── list-flows.js # List flows
│ ├── run-flow.js # Trigger flow
│ ├── list-runs.js # Run history
│ └── toggle-flow.js # Enable/disable flow
└── utils/ # Utility functions
├── graph-api.js # Microsoft Graph API helper
├── odata-helpers.js # OData query building
└── mock-data.js # Test mode data
| Tool | Description |
|---|---|
list-emails |
List recent emails from inbox |
search-emails |
Search emails with filters |
read-email |
Read email content |
send-email |
Send a new email |
mark-as-read |
Mark email as read/unread |
list-events |
List calendar events |
create-event |
Create calendar event |
accept-event |
Accept event invitation |
decline-event |
Decline event invitation |
delete-event |
Delete calendar event |
list-folders |
List mail folders |
create-folder |
Create mail folder |
move-emails |
Move emails between folders |
list-rules |
List inbox rules |
create-rule |
Create inbox rule |
| Tool | Description |
|---|---|
onedrive-list |
List files in a path |
onedrive-search |
Search files by query |
onedrive-download |
Get download URL |
onedrive-upload |
Upload small file (<4MB) |
onedrive-upload-large |
Chunked upload (>4MB) |
onedrive-share |
Create sharing link |
onedrive-create-folder |
Create folder |
onedrive-delete |
Delete file or folder |
| Tool | Description |
|---|---|
flow-list-environments |
List Power Platform environments |
flow-list |
List flows in environment |
flow-run |
Trigger a manual flow |
flow-list-runs |
Get flow run history |
flow-toggle |
Enable/disable a flow |
npm install.env.example to .env and add your Azure credentialsnpm run auth-servernpm install
http://localhost:3333/auth/callback.env fileoffline_accessUser.ReadMail.Read, Mail.ReadWrite, Mail.SendCalendars.Read, Calendars.ReadWriteFiles.Read, Files.ReadWriteFor Power Automate (optional):
cp .env.example .env
Edit .env:
# Get these values from Azure Portal > App Registrations > Your App
MS_CLIENT_ID=your-application-client-id-here
MS_CLIENT_SECRET=your-client-secret-VALUE-here
MS_TENANT_ID=your-tenant-id-here
USE_TEST_MODE=false
Important Notes:
MS_CLIENT_ID and MS_CLIENT_SECRET in the .env fileMS_TENANT_ID for single-tenant apps to avoid /common endpoint errorsOUTLOOK_CLIENT_ID and OUTLOOK_CLIENT_SECRETAdd to your Claude Desktop config:
{
"mcpServers": {
"m365-assistant": {
"command": "node",
"args": ["/path/to/outlook-mcp/index.js"],
"env": {
"USE_TEST_MODE": "false",
"OUTLOOK_CLIENT_ID": "your-client-id",
"OUTLOOK_CLIENT_SECRET": "your-client-secret"
}
}
}
}
npm run auth-serverauthenticate tool in Claude~/.outlook-mcp-tokens.jsonPower Automate requires a separate token with the Flow API scope. Configure additional Azure AD permissions for https://service.flow.microsoft.com//.default scope.
Limitations:
"Cannot find module"
npm install
"Port 3333 in use"
npx kill-port 3333
npm run auth-server
"Invalid client secret" (AADSTS7000215)
"Authentication required"
~/.outlook-mcp-tokens.json and re-authenticate# Run with MCP Inspector
npm run inspect
# Run in test mode (mock data)
npm run test-mode
# Run Jest tests
npm test
TOOLS array in index.jsoutlook-mcp is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by ryaker. MCP server for Claude to access Outlook data via Microsoft Graph API. It has 433 GitHub stars.
outlook-mcp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/ryaker/outlook-mcp" and add it to your Claude Code skills directory (see the Installation section above).
outlook-mcp is primarily written in JavaScript. It is open-source under ryaker on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh outlook-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Top skills in this category by stars