Microsoft Work IQ — Plugin MarketplaceBLOCK
mcp/microsoft/work-iq
MCP Server and CLI for accessing Work IQ
Verdict
BLOCK
Grade
F
Trust score
59 /100
Exposed tools
—
Transport
stdio · streamable-http
License
NOASSERTION
Stars
1,031
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The official Microsoft Work IQ plugin collection for GitHub Copilot ✨
Extend the power of GitHub Copilot with Work IQ plugins — MCP servers, skills, and tools that connect AI assistants to your Microsoft 365 data.
⚠️ Public Preview: Features and APIs may change.
To access Microsoft 365 tenant data, the WorkIQ CLI and MCP Server need to be consented to permissions that require administrative rights on the tenant. On first access, a consent dialog appears. If you are not an administrator, contact your tenant administrator to grant access.
For Tenant Administrators: See the Tenant Administrator Enablement Guide for detailed instructions on granting admin consent, including a quick one-click consent URL.
For more information, see Microsoft's User and Admin Consent Overview.
📋 Prerequisites
Before getting started, ensure you have Node.js (which includes NPM and NPX) installed:
- Node.js 18+ — Download from nodejs.org
You can verify your installation by running:
node --version npm --version
💡 Why Node.js? WorkIQ uses NPX to run the MCP server. NPX is included automatically with NPM, which comes bundled with Node.js.
🚀 Quick Start with GitHub Copilot CLI
# 1. Open GitHub Copilot CLI copilot # 2. Add this plugin marketplace (one-time setup) /plugin marketplace add microsoft/work-iq # 3. Install any plugin /plugin install workiq@work-iq /plugin install workiq-preview@work-iq /plugin install microsoft-365-agents-toolkit@work-iq /plugin install workiq-productivity@work-iq
That's it! Restart Copilot CLI and start using the plugin:
You: What are my upcoming meetings this week? You: Summarize emails from Sarah about the budget You: Find documents I worked on yesterday
📦 Alternative: Standalone MCP
Read from source at commit
6f4157a79a4aOBSERVED · 2026-10-1202
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude-code (npm)
claude mcp add workiq -- npx -y @microsoft/[email protected] mcp
03
Trust audit
BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/setup-sso-ui-widget/SKILL.md:41
> - Execute every `az`, `devtunnel`, `atk`, `npm`, and PowerShell command in the TERMINAL yourself. Do NOT tell the user to run them.
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/ui-widget-developer/SKILL.md:155
**FULL AUTOMATION:** Never tell the user to run commands manually. Install tools, authenticate, start services — do everything automatically. Only ask the user for interactive input that truly require
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
plugins/workiq/skills/workiq/SKILL.md:140
> - **Do not claim a specific cause you did not observe.** Never tell the user "this returned
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/prompt-engineer.md:22
14. **Put all data sections at the top, `<INSTRUCTIONS>` at the bottom.** Data sections occupy the top of the prompt where they're loaded into context. The `<INSTRUCTIONS>` block goes at the bottom —
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/prompt-engineer.md:23
15. **Reference section names inside `<INSTRUCTIONS>` using the same tag format.** When a rule in `<INSTRUCTIONS>` refers to data, use the exact `<SECTION_NAME>` tag from the data section. Writing "Us
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/prompt-engineer.md:24
16. **Move `<INSTRUCTIONS>` to user messages for multi-turn flows.** In multi-turn conversations where each turn needs different instructions, place the data sections in the system prompt (stable acro
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/prompt-engineer.md:103
<INSTRUCTIONS>
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/prompt-engineer.md:125
<INSTRUCTIONS>
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/bridge/rest-only-integration-ts.md:73
Authorization: Bearer xoxb-your-token
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/deploy/aws-bot-deploy-ts.md:151
SLACK_BOT_TOKEN=xoxb-your-token \
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/deploy/aws-bot-deploy-ts.md:220
export SLACK_BOT_TOKEN=xoxb-your-token
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/deploy/azure-bot-deploy-ts.md:185
SLACK_BOT_TOKEN=xoxb-your-token \
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/deploy/azure-bot-deploy-ts.md:209
SLACK_BOT_TOKEN=xoxb-your-token \
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/workiq-guidance/oracle.test.mjs:253
const workflow = parseDocument(fs.readFileSync(new URL('../../.github/workflows/workiq-guidance.yml', import.meta.url), 'utf8')).toJS();LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
plugins/microsoft-365-agents-toolkit/skills/declarative-agent-developer/references/mcp-plugin.md:132
> **WSL / headless environments:** `mcp-remote` starts a local HTTP server for the OAuth callback and tries to open a browser. In WSL, the browser opens on the Windows host but the `http://127.0.0.1:3
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/slack/cli.app-management.md:19
11. **`slack collaborator update` changes a collaborator's role.** Modify permissions (e.g., read-only vs full access) for an existing collaborator.
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/teams/compat.botbuilder-interop-ts.md:28
description: "Rewrite all handlers directly in Teams SDK v2. Cleaner result, full access to streaming/plugins/MCP/A2A. Best for bots with <15 routes or when starting fresh."
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
plugins/workiq-productivity/skills/site-explorer/SKILL.md:310
- Download the file directly from SharePoint for full access.
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/declarative-agent-developer/references/editing-workflow.md:170
not return one, read `M365_TITLE_ID` from `env/.env.<environment>` and construct:
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/declarative-agent-developer/references/mcp-plugin.md:139
**Read the cached access token from `~/.mcp-auth`:**
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/setup-sso-ui-widget/references/easy-auth.md:11
| `<api-app-client-id>` | the `CLIENT_ID` this skill registered (your MCP server's Entra app) — read it from `env/.env.local` |
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/setup-sso-ui-widget/references/wire-and-guard.md:81
1. Ensure the server loads the **ATK local env** so `auth.ts` sees the SSO vars — add at the **very top** of the file (Express MCP Apps servers usually lack dotenv; `inject-guard.ps1` already installe
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/models/foundry-cloud-ts.md:13
5. **GitHub Models provides free-tier access to the same model catalog.** Use `https://models.inference.ai.azure.com` as the base URL with a GitHub personal access token as the API key. Great for prot
Why it matters. asks the agent to read credentials
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/deploy/aws-bot-deploy-ts.md:212
curl -fsSL https://rpm.nodesource.com/setup_20.x | sudo bash -
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
plugins/microsoft-365-agents-toolkit/skills/teams-app-developer/experts/models/oss-openai-compatible-ts.md:14
6. **Ollama is the easiest local server to start with.** Install: `curl -fsSL https://ollama.com/install.sh | sh` (Linux/macOS) or download from [ollama.com](https://ollama.com). Pull a model: `ollama
Gates applied: instruction_override, no_behavioural_pass.
Audited 2026-10-12 · audit v0.4.1 · source sha
6f4157a79a4afull audit observations/trust-audit/mcp-server/microsoft__work-iq.json · Report an issue / request a re-scan04
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 6f4157a79a4a | BLOCK | F | 59 | first audit |
05
Questions
What is the @microsoft/workiq MCP server?
MCP Server and CLI for accessing Work IQ
Is @microsoft/workiq safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (59/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @microsoft/workiq need?
No credential environment variables were found in its source, so it appears to need none.
How does @microsoft/workiq run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as workiq-guidance-contract at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (6f4157a79a4a), read on 2026-10-12. The repository is watched and re-audited when it changes.