mcp-outlook

A safe-by-default Model Context Protocol server for Microsoft Outlook mail, over Microsoft Graph. It lets an agent read and operate a mailbox — list folders and messages, full-text search, read bodies and attachment metadata, list contacts, and (in higher modes) create drafts, send / reply / forward, mark read, move messages, and delete. It also manages OneDrive files — browse, search, download, upload, create folders, move/rename, and delete — and the calendar — list calendars and events, check free/busy, and (gated) create, update, respond to, cancel and delete events.

Browser sign-in: on first run it opens your browser to the Microsoft sign-in page, then caches the token and refreshes it silently — the server never sees your password.

Part of the dockndevai MCP server suite — one governance model across all of them.

What it gives an agent

The server starts read-only (see Safe by default); higher-capability tools are only registered when you raise the mode.

Tool	For	Needs mode
whoami	confirm which mailbox is in use	read-only
list_folders	mail folders with unread/total counts	read-only
list_messages	recent messages (by folder, unread-only)	read-only
search_messages	full-text search across the mailbox	read-only
get_message	one message with full body + recipients	read-only
list_attachments	attachment metadata (bytes not returned)	read-only
list_contacts	personal contacts	read-only
create_draft	prepare a draft without sending	read-write
send_mail	compose & send a new email	read-write + OUTLOOK_ALLOW_SEND
reply_mail / forward_mail	reply (all) / forward a message	read-write + OUTLOOK_ALLOW_SEND
mark_read	mark read / unread (reversible)	read-write
move_message	move to another folder (asks a human first)	read-write
delete_message	delete (to Deleted Items)	admin + OUTLOOK_ALLOW_DELETE
list_drive_items / get_drive_item	browse OneDrive files & folders	read-only
search_drive_files	search OneDrive	read-only
download_drive_file	read a OneDrive file's text	read-only
upload_drive_file	create/overwrite a OneDrive file (asks a human first)	read-write
create_drive_folder	create a folder (additive; never replaces an existing one, no prompt)	read-write
move_drive_item	move / rename a OneDrive item (asks a human first)	read-write
delete_drive_item	delete a OneDrive item (→ recycle bin)	admin + OUTLOOK_ALLOW_DELETE
list_calendars / list_events / get_event	browse calendars & events (window expands recurrences)	read-only
get_free_busy	check availability for people before scheduling	read-only
create_event / update_event	create / update a meeting (invites attendees)	read-write + OUTLOOK_ALLOW_SEND
respond_to_event	accept / decline / tentatively accept an invite	read-write + OUTLOOK_ALLOW_SEND
cancel_event / delete_event	cancel a meeting / delete an event	admin + OUTLOOK_ALLOW_DELETE

Access is ultimately governed by your Microsoft account's granted scopes. Calendar tools need the Calendars.ReadWrite delegated scope (included in the defaults). If your token wasn't consented for it, Graph returns 403 — the suite's modes/flags are defence in depth on top of that Microsoft-level control. Downscope with OUTLOOK_SCOPES (e.g. dro

... View full README on GitHub