ms-365-mcp-server

Security Findings (679)

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×193

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  graph-batchget-drive-itemmove-rename-onedrive-itemdelete-onedrive-filelist-folder-filescreate-onedrive-folderupload-file-contentcopy-drive-itemcreate-drive-item-share-linkcreate-upload-sessionget-drive-deltashare-drive-itemlist-drive-item-permissionsdelete-drive-item-permissioncreate-drive-item-previewlist-drive-item-thumbnailslist-drive-item-versionslist-excel-tablesget-excel-tablelist-excel-table-rowsadd-excel-table-rowsupdate-excel-table-rowdelete-excel-table-rowlist-excel-worksheetscreate-excel-chartsort-excel-rangeget-excel-rangeupdate-excel-rangeclear-excel-rangedelete-excel-rangeget-excel-range-formatformat-excel-rangeformat-excel-range-borderformat-excel-range-fillformat-excel-range-fontinsert-excel-rangemerge-excel-rangeunmerge-excel-rangecreate-excel-tableget-excel-used-rangeget-drive-root-itemsearch-onedrive-fileslist-group-planner-plansget-current-userlist-my-calendar-permissionscreate-my-calendar-permissionupdate-my-calendar-permissiondelete-my-calendar-permissionlist-calendarscreate-calendarupdate-calendardelete-calendarget-specific-calendar-viewlist-specific-calendar-eventscreate-specific-calendar-eventget-specific-calendar-eventupdate-specific-calendar-eventdelete-specific-calendar-eventlist-calendar-event-instancesget-calendar-viewlist-calendar-view-deltalist-contact-folderscreate-contact-folderupdate-contact-folderdelete-contact-folderlist-contact-folder-child-folderscreate-contact-child-folderlist-contact-folder-contactscreate-contact-in-folderlist-outlook-contactscreate-outlook-contactget-outlook-contactupdate-outlook-contactdelete-outlook-contactlist-driveslist-calendar-eventscreate-calendar-eventget-calendar-eventupdate-calendar-eventdelete-calendar-eventaccept-calendar-eventadd-calendar-event-attachmentcreate-calendar-event-attachment-upload-sessioncancel-calendar-eventdecline-calendar-eventdismiss-calendar-event-reminderforward-calendar-eventsnooze-calendar-event-remindertentatively-accept-calendar-eventlist-calendar-events-deltaget-mail-tipslist-focused-inbox-overridescreate-focused-inbox-overrideupdate-focused-inbox-overridedelete-focused-inbox-overrideget-mailbox-settingsupdate-mailbox-settingslist-mail-folderscreate-mail-folderupdate-mail-folderdelete-mail-folderlist-mail-child-folderscreate-mail-child-folderlist-mail-rulescreate-mail-ruleupdate-mail-ruledelete-mail-rulelist-mail-folder-messageslist-mail-folder-messages-deltalist-mail-messagescreate-draft-emailget-mail-messageupdate-mail-messagedelete-mail-messageget-mail-message-mimelist-mail-attachmentsadd-mail-attachmentdelete-mail-attachmentget-mail-attachment-contentcreate-mail-attachment-upload-sessioncopy-mail-messagecreate-forward-draftcreate-reply-draftcreate-reply-all-draftforward-mail-messagemove-mail-messagereply-mail-messagereply-all-mail-messagesend-draft-messagelist-onenote-notebookscreate-onenote-notebooklist-onenote-notebook-sectionscreate-onenote-sectionlist-onenote-pagescreate-onenote-pagedelete-onenote-pageget-onenote-page-contentlist-onenote-section-groupslist-all-onenote-sectionslist-onenote-section-pagescreate-onenote-section-pagelist-outlook-categoriescreate-outlook-categorylist-supported-languageslist-supported-time-zonesupload-my-profile-photolist-planner-taskssend-maillist-todo-task-listscreate-todo-task-listupdate-todo-task-listdelete-todo-task-listlist-todo-taskscreate-todo-taskget-todo-taskupdate-todo-taskdelete-todo-tasklist-todo-checklist-itemscreate-todo-checklist-itemupdate-todo-checklist-itemdelete-todo-checklist-itemlist-todo-linked-resourcescreate-todo-linked-resourcedelete-todo-linked-resourcecreate-planner-bucketget-planner-bucketupdate-planner-bucketdelete-planner-bucketcreate-planner-planget-planner-planupdate-planner-planlist-plan-bucketslist-plan-taskscreate-planner-taskget-planner-taskupdate-planner-taskget-planner-task-detailsupdate-planner-task-detailslist-subscriptionscreate-subscriptionget-subscriptionupdate-subscriptiondelete-subscriptionreauthorize-subscriptionget-my-profilelist-planner-task-messagescreate-planner-task-messagedelete-planner-task-messageget-upload-urlparse-teams-urldownload-bytesdownload-bytes-to-fileget-download-url

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×42

  input schema exposes 14 properties (threshold: 10)

  list-folder-filesget-drive-deltalist-drive-item-permissionslist-drive-item-thumbnailslist-drive-item-versionslist-excel-tableslist-excel-worksheetssearch-onedrive-fileslist-calendar-eventslist-mail-child-folderslist-mail-folder-messages-delta

  input schema exposes 15 properties (threshold: 10)

  list-excel-table-rowslist-specific-calendar-events

  input schema exposes 13 properties (threshold: 10)

  list-group-planner-planslist-contact-folder-child-folderslist-contact-folder-contactslist-mail-folderslist-mail-ruleslist-mail-folder-messageslist-mail-messageslist-mail-attachmentslist-onenote-notebook-sectionslist-onenote-section-pageslist-plan-bucketslist-plan-taskslist-planner-task-messages

  input schema exposes 12 properties (threshold: 10)

  list-my-calendar-permissionslist-calendarslist-contact-folderslist-outlook-contactslist-driveslist-focused-inbox-overrideslist-onenote-notebookslist-onenote-pageslist-onenote-section-groupslist-all-onenote-sectionslist-outlook-categorieslist-planner-taskslist-subscriptions

  input schema exposes 17 properties (threshold: 10)

  get-specific-calendar-view

  input schema exposes 18 properties (threshold: 10)

  list-calendar-event-instances

  input schema exposes 16 properties (threshold: 10)

  get-calendar-view

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×200

  No metadata.dependencies or repo_url were exposed by this MCP server, and no local project manifest could be inferred from the launch command.

  loginlogoutverify-loginlist-accountsselect-accountremove-accountgraph-batchget-drive-itemmove-rename-onedrive-itemdelete-onedrive-filelist-folder-filescreate-onedrive-folderupload-file-contentcopy-drive-itemcreate-drive-item-share-linkcreate-upload-sessionget-drive-deltashare-drive-itemlist-drive-item-permissionsdelete-drive-item-permissioncreate-drive-item-previewlist-drive-item-thumbnailslist-drive-item-versionslist-excel-tablesget-excel-tablelist-excel-table-rowsadd-excel-table-rowsupdate-excel-table-rowdelete-excel-table-rowlist-excel-worksheetscreate-excel-chartsort-excel-rangeget-excel-rangeupdate-excel-rangeclear-excel-rangedelete-excel-rangeget-excel-range-formatformat-excel-rangeformat-excel-range-borderformat-excel-range-fillformat-excel-range-fontinsert-excel-rangemerge-excel-rangeunmerge-excel-rangecreate-excel-tableget-excel-used-rangeget-drive-root-itemsearch-onedrive-fileslist-group-planner-plansget-current-userlist-my-calendar-permissionscreate-my-calendar-permissionupdate-my-calendar-permissiondelete-my-calendar-permissionlist-calendarscreate-calendarupdate-calendardelete-calendarget-specific-calendar-viewlist-specific-calendar-eventscreate-specific-calendar-eventget-specific-calendar-eventupdate-specific-calendar-eventdelete-specific-calendar-eventlist-calendar-event-instancesget-calendar-viewlist-calendar-view-deltalist-contact-folderscreate-contact-folderupdate-contact-folderdelete-contact-folderlist-contact-folder-child-folderscreate-contact-child-folderlist-contact-folder-contactscreate-contact-in-folderlist-outlook-contactscreate-outlook-contactget-outlook-contactupdate-outlook-contactdelete-outlook-contactlist-driveslist-calendar-eventscreate-calendar-eventget-calendar-eventupdate-calendar-eventdelete-calendar-eventaccept-calendar-eventadd-calendar-event-attachmentcreate-calendar-event-attachment-upload-sessioncancel-calendar-eventdecline-calendar-eventdismiss-calendar-event-reminderforward-calendar-eventsnooze-calendar-event-remindertentatively-accept-calendar-eventlist-calendar-events-deltaget-mail-tipslist-focused-inbox-overridescreate-focused-inbox-overrideupdate-focused-inbox-overridedelete-focused-inbox-overrideget-mailbox-settingsupdate-mailbox-settingslist-mail-folderscreate-mail-folderupdate-mail-folderdelete-mail-folderlist-mail-child-folderscreate-mail-child-folderlist-mail-rulescreate-mail-ruleupdate-mail-ruledelete-mail-rulelist-mail-folder-messageslist-mail-folder-messages-deltalist-mail-messagescreate-draft-emailget-mail-messageupdate-mail-messagedelete-mail-messageget-mail-message-mimelist-mail-attachmentsadd-mail-attachmentdelete-mail-attachmentget-mail-attachment-contentcreate-mail-attachment-upload-sessioncopy-mail-messagecreate-forward-draftcreate-reply-draftcreate-reply-all-draftforward-mail-messagemove-mail-messagereply-mail-messagereply-all-mail-messagesend-draft-messagelist-onenote-notebookscreate-onenote-notebooklist-onenote-notebook-sectionscreate-onenote-sectionlist-onenote-pagescreate-onenote-pagedelete-onenote-pageget-onenote-page-contentlist-onenote-section-groupslist-all-onenote-sectionslist-onenote-section-pagescreate-onenote-section-pagelist-outlook-categoriescreate-outlook-categorylist-supported-languageslist-supported-time-zonesupload-my-profile-photolist-planner-taskssend-maillist-todo-task-listscreate-todo-task-listupdate-todo-task-listdelete-todo-task-listlist-todo-taskscreate-todo-taskget-todo-taskupdate-todo-taskdelete-todo-tasklist-todo-checklist-itemscreate-todo-checklist-itemupdate-todo-checklist-itemdelete-todo-checklist-itemlist-todo-linked-resourcescreate-todo-linked-resourcedelete-todo-linked-resourcecreate-planner-bucketget-planner-bucketupdate-planner-bucketdelete-planner-bucketcreate-planner-planget-planner-planupdate-planner-planlist-plan-bucketslist-plan-taskscreate-planner-taskget-planner-taskupdate-planner-taskget-planner-task-detailsupdate-planner-task-detailslist-subscriptionscreate-subscriptionget-subscriptionupdate-subscriptiondelete-subscriptionreauthorize-subscriptionget-my-profilelist-planner-task-messagescreate-planner-task-messagedelete-planner-task-messageget-upload-urlparse-teams-urlread-mail-textdownload-bytesdownload-bytes-to-fileget-download-url

  Fix: Review and remediate the identified issue.

• InfoAS-002

  ⚠️Excessive Permissions ×195

  declared capabilities: filesystem access

  remove-accountread-mail-text

  declared capabilities: network access, HTTP requests

  graph-batchlist-calendar-events-deltalist-todo-linked-resourceslist-subscriptions

  declared capabilities: network access, filesystem access, HTTP requests

  get-drive-itemcopy-drive-itemcreate-drive-item-share-linkcreate-upload-sessionlist-drive-item-permissionscreate-drive-item-previewlist-drive-item-thumbnailslist-drive-item-versionscreate-calendar-event-attachment-upload-sessioncancel-calendar-eventget-mail-message-mimelist-mail-attachmentsget-mail-attachment-contentcreate-mail-attachment-upload-sessioncreate-reply-draftcreate-reply-all-draftforward-mail-messagereply-mail-messagereply-all-mail-messageupload-my-profile-photocreate-todo-linked-resourcecreate-planner-plancreate-subscription

  declared capabilities: filesystem access, HTTP requests

  move-rename-onedrive-itemdelete-onedrive-filelist-folder-filescreate-onedrive-folderupload-file-contentshare-drive-itemdelete-drive-item-permissionupdate-excel-table-rowdelete-excel-table-rowcreate-excel-chartupdate-excel-rangedelete-excel-rangecreate-excel-tableget-drive-root-itemcreate-my-calendar-permissionupdate-my-calendar-permissiondelete-my-calendar-permissioncreate-calendarupdate-calendardelete-calendarcreate-specific-calendar-eventupdate-specific-calendar-eventdelete-specific-calendar-eventcreate-contact-folderupdate-contact-folderdelete-contact-folderlist-contact-folder-child-folderscreate-contact-child-foldercreate-contact-in-folderlist-outlook-contactscreate-outlook-contactget-outlook-contactupdate-outlook-contactdelete-outlook-contactcreate-calendar-eventupdate-calendar-eventdelete-calendar-eventadd-calendar-event-attachmentcreate-focused-inbox-overrideupdate-focused-inbox-overridedelete-focused-inbox-overrideupdate-mailbox-settingscreate-mail-folderupdate-mail-folderdelete-mail-foldercreate-mail-child-folderlist-mail-rulescreate-mail-ruleupdate-mail-ruledelete-mail-rulecreate-draft-emailupdate-mail-messagedelete-mail-messageadd-mail-attachmentdelete-mail-attachmentcopy-mail-messagecreate-forward-draftmove-mail-messagesend-draft-messagecreate-onenote-notebookcreate-onenote-sectiondelete-onenote-pagelist-onenote-section-groupscreate-onenote-section-pagecreate-outlook-categorysend-mailcreate-todo-task-listupdate-todo-task-listdelete-todo-task-listcreate-todo-taskupdate-todo-taskdelete-todo-taskcreate-todo-checklist-itemupdate-todo-checklist-itemdelete-todo-checklist-itemdelete-todo-linked-resourcecreate-planner-bucketupdate-planner-bucketdelete-planner-bucketupdate-planner-plancreate-planner-taskupdate-planner-taskupdate-planner-task-detailsget-my-profilecreate-planner-task-messagedelete-planner-task-message

  declared capabilities: HTTP requests

  get-drive-deltalist-excel-tablesget-excel-tablelist-excel-table-rowsadd-excel-table-rowslist-excel-worksheetssort-excel-rangeget-excel-rangeclear-excel-rangeget-excel-range-formatformat-excel-rangeformat-excel-range-borderformat-excel-range-fillformat-excel-range-fontinsert-excel-rangemerge-excel-rangeunmerge-excel-rangeget-excel-used-rangelist-group-planner-planslist-my-calendar-permissionslist-calendarslist-specific-calendar-eventsget-specific-calendar-eventlist-driveslist-calendar-eventsget-calendar-eventaccept-calendar-eventdecline-calendar-eventdismiss-calendar-event-reminderforward-calendar-eventsnooze-calendar-event-remindertentatively-accept-calendar-eventget-mail-tipslist-focused-inbox-overridesget-mailbox-settingsget-mail-messagelist-onenote-notebookslist-onenote-notebook-sectionslist-onenote-pagesget-onenote-page-contentlist-all-onenote-sectionslist-onenote-section-pageslist-outlook-categorieslist-supported-languageslist-supported-time-zoneslist-planner-taskslist-todo-task-listslist-todo-tasksget-todo-tasklist-todo-checklist-itemsget-planner-bucketget-planner-planlist-plan-bucketslist-plan-tasksget-planner-taskget-planner-task-detailslist-planner-task-messages

  declared capabilities: network access, filesystem access, database access, HTTP requests

  search-onedrive-fileslist-mail-folder-messageslist-mail-folder-messages-deltalist-mail-messages

  declared capabilities: database access, HTTP requests

  get-current-userlist-calendar-event-instances

  declared capabilities: network access, database access, HTTP requests

  get-specific-calendar-viewget-calendar-viewlist-calendar-view-delta

  declared capabilities: filesystem access, database access, HTTP requests

  list-contact-folderslist-contact-folder-contactslist-mail-folderslist-mail-child-folderscreate-onenote-page

  declared capabilities: code/command execution, network access, HTTP requests

  get-subscription

  declared capabilities: code/command execution, filesystem access, HTTP requests

  update-subscriptiondelete-subscription

  declared capabilities: code/command execution, HTTP requests

  reauthorize-subscription

  declared capabilities: network access, filesystem access

  get-upload-urldownload-bytesdownload-bytes-to-fileget-download-url

  declared capabilities: network access

  parse-teams-url

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-010

  🔑Insecure Secret Handling ×49

  input parameter "skiptoken" accepts a credential (informational; not evidence of insecure handling)

  list-folder-filesget-drive-deltalist-drive-item-permissionslist-drive-item-thumbnailslist-drive-item-versionslist-excel-tableslist-excel-table-rowslist-excel-worksheetssearch-onedrive-fileslist-group-planner-planslist-my-calendar-permissionslist-calendarsget-specific-calendar-viewlist-specific-calendar-eventslist-calendar-event-instancesget-calendar-viewlist-calendar-view-deltalist-contact-folderslist-contact-folder-child-folderslist-contact-folder-contactslist-outlook-contactslist-driveslist-calendar-eventslist-calendar-events-deltalist-focused-inbox-overrideslist-mail-folderslist-mail-child-folderslist-mail-ruleslist-mail-folder-messageslist-mail-folder-messages-deltalist-mail-messageslist-mail-attachmentslist-onenote-notebookslist-onenote-notebook-sectionslist-onenote-pageslist-onenote-section-groupslist-all-onenote-sectionslist-onenote-section-pageslist-outlook-categorieslist-supported-languageslist-supported-time-zoneslist-planner-taskslist-todo-task-listslist-todo-taskslist-todo-linked-resourceslist-plan-bucketslist-plan-taskslist-subscriptionslist-planner-task-messages

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.