Atlas / MCP servers / xenoxilus / Outlook

OutlookBLOCK

Name: Outlook
Author: xenoxilus

mcp/xenoxilus/outlook-8

MCP server by xenoxilus · ai · ai assistant · anthropic · Audited 2026-10-09

MCP server for Microsoft Office 365 Outlook – email, calendar & SharePoint integration for Claude, ChatGPT, and AI assistants via Microsoft Graph API

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

53 34r · 17w · 2d

Transport

stdio

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server that enables AI assistants to interact with Microsoft Outlook email and calendar through the Microsoft Graph API.

[](https://github.com/XenoXilus/outlook-mcp/releases/latest) [](https://ko-fi.com/xenoxilus)

Features

Email Operations: Read, search, send, reply to emails and download attachments
SharePoint Integration: Access SharePoint files via sharing links or direct file IDs. Download files shared to you via emails.
Calendar Management: View and manage calendar events and appointments
Office Document Processing: Parse PDF, Word, PowerPoint, and Excel files with extracted text content
Receipt & Invoice Collection: Discover emailed receipts by sender/subject/date, save them as verified and consistently named PDFs (attachment, billing link, or rendered fallback), and stage a review draft — built for scheduled, non-interactive runs
Large File Support: Automatic handling of files that exceed MCP response size limits

Quick Start

Choose your installation method:

Prerequisites: Before installing, you'll need to set up an Azure application to get your Client ID and Tenant ID.

Installation

Installing as DXT Extension

For Claude Desktop users, DXT extensions provide the simplest installation experience.

Option 1: Download Pre-built Extension

Download outlook-mcp.dxt from the Releases page
In Claude Desktop, go to Settings → Extensions
Click **Install

Read from source at commit ddda38e1aa8cOBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add outlook-mcp --env MCP_OUTLOOK_AUTH_MODE=${MCP_OUTLOOK_AUTH_MODE} --env MCP_OUTLOOK_REFRESH_TOKEN_PATH=${MCP_OUTLOOK_REFRESH_TOKEN_PATH} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "outlook-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "MCP_OUTLOOK_AUTH_MODE": "${MCP_OUTLOOK_AUTH_MODE}",
        "MCP_OUTLOOK_REFRESH_TOKEN_PATH": "${MCP_OUTLOOK_REFRESH_TOKEN_PATH}"
      }
    }
  }
}

Exposed tools (53)

34 read · 17 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`check_recent_unread`	read	Check unread emails from the last 36 hours, summarize them, and highlight action items
`draft_reply`	read	Draft a reply to a specific email with a specified tone
`email_id`	read	The ID of the email to reply to
`outlook_add_attachment`	write	Add an attachment to an email draft
`outlook_archive_email`	write	Archive an email (move to Archive folder)
`outlook_batch_process_emails`	read	Perform bulk operations on multiple emails
`outlook_build_recurrence_pattern`	read	Build a recurrence pattern object
`outlook_categorize_email`	write	Apply categories to an email
`outlook_check_availability`	read	Check availability for users
`outlook_check_calendar_permissions`	read	Check permissions for a calendar
`outlook_collect_receipts`	read	Collect all vendor receipts for a period in one call: discovers each vendor\
`outlook_create_draft`	write	Create an email draft without sending
`outlook_create_event`	write	Create a new calendar event in Outlook with optional Teams meeting integration
`outlook_create_folder`	write	Create a new email folder
`outlook_create_recurrence_helper`	write	Helper to create a recurring event with simplified inputs
`outlook_create_recurring_event`	write	Create a recurring calendar event
`outlook_delete_email`	destructive	Delete an email (move to Deleted Items or permanently delete)
`outlook_delete_event`	destructive	Delete a calendar event
`outlook_download_attachment`	write	Download a specific email attachment. Set saveToFile (or destDir/fileName) to write the raw bytes server-side and get back only {savedPath, size, sha256} — the reliable route for binary files, since inline base64 exceeds the MCP response cap above ~20 KB.
`outlook_extract_receipt`	read	Extract a compact structured summary (vendor, amount, currency, receipt/invoice numbers, product label, billing link, attachment ids) from a receipt email — instead of its large HTML body.
`outlook_fetch_billing_pdf`	read	Fetch a billing PDF from an allowlisted host (default: Stripe) linked in an email body, and save it. Fallback for receipts without PDF attachments. HTTPS-only, allowlist-only, validated as PDF. Provide url or messageId (at least one). If both are given, url takes precedence.
`outlook_find_meeting_times`	read	Find optimal meeting times for attendees
`outlook_flag_email`	read	Flag or unflag an email for follow-up
`outlook_forward_email`	read	Forward an existing email to new recipients
`outlook_get_busy_times`	read	Get busy times for users
`outlook_get_calendar_view`	read	Get a view of a calendar for a specific time range
`outlook_get_email`	read	Get detailed information about a specific email
`outlook_get_event`	read	Get a specific calendar event
`outlook_get_folder_stats`	read	Get statistics for a specific folder
`outlook_get_sharepoint_file`	read	Fetch a SharePoint file using the same authenticated session as Outlook. Handles sharing links from emails. Either sharePointUrl OR fileId must be provided.
`outlook_list_attachments`	read	List all attachments for a specific email
`outlook_list_calendars`	read	List available calendars
`outlook_list_emails`	read	List emails from Outlook inbox or specified folder
`outlook_list_events`	read	List calendar events from Outlook
`outlook_list_folders`	read	List all email folders
`outlook_list_sharepoint_files`	read	List files in SharePoint sites or OneDrive folders using the same authenticated session
`outlook_mark_as_read`	read	Mark an email as read or unread
`outlook_move_email`	write	Move an email to a different folder
`outlook_rename_folder`	write	Rename an existing email folder
`outlook_render_email_pdf`	read	Render an email\
`outlook_reply_all`	read	Reply to all recipients of an existing email
`outlook_reply_to_email`	read	Reply to an existing email
`outlook_resolve_sharepoint_link`	read	Resolve SharePoint sharing links from emails to get file metadata without downloading
`outlook_respond_to_invite`	read	Respond to a meeting invitation
`outlook_save_attachment`	write	Save an email attachment\
`outlook_scan_attachments`	read	Scan emails for large or suspicious attachments
`outlook_schedule_online_meeting`	write	Schedule an online meeting (Teams/Skype)
`outlook_search_emails`	read	Search emails across all folders with advanced filters for analysis
`outlook_send_email`	write	Send an email through Outlook
`outlook_update_event`	write	Update an existing calendar event
`outlook_validate_event_datetimes`	write	Validate event start and end times
`summarize_schedule`	write	Summarize today\
`tone`	read	The tone of the response (e.g., professional, casual, urgent)

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (4 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (13)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

server/auth/auth.js:41

exec(command, (error) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

outlook_delete_email, outlook_delete_event

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.dxtignore

.dxtignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence