CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
35.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
20.0 pts
Maintenancestaleness, pinning, CI
15%
15.0 pts
TransparencySKILL.md, perms, README
15%
15.0 pts
Communityinstalls, verify, response
15%
15.0 pts
Findings & checks · 0 flagged
Security
✓—All security checks passedNo findings in this category for the latest scan.pass
Supply chain
✓—All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenance
✓—All maintenance checks passedNo findings in this category for the latest scan.pass
Transparency
✓—All transparency checks passedNo findings in this category for the latest scan.pass
Community
✓—All community checks passedNo findings in this category for the latest scan.pass
Every scanned point with the score it earned and what moved between them.
13b0122
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Microsoft 365 (SharePoint & OneDrive) MCP Server
A modern Model Context Protocol (MCP) server that lets ChatGPT (and other MCP compatible clients) interact with SharePoint Online and OneDrive content using Microsoft Graph. The server is designed for environments where multiple Microsoft 365 accounts may exist on the same workstation: each session can authenticate with the signed-in Windows/Microsoft account that the user chooses at runtime.
Why this fork? The original SharePoint-only implementation relied on application credentials tied to a specific tenant. This version embraces user-centric authentication (device code flow + MSAL cache) so the connector works with whichever account is selected on the machine—ideal for teams that share GPT licenses but want to access their own SharePoint/OneDrive resources.
Feature Highlights
- 🔐 Device-code authentication – Pick the Microsoft account that is signed into the local machine instead of the ChatGPT account.
- 👥 Multi-account aware – List cached accounts, switch between them, and inspect the active context at any time.
- 🗂️ Drive discovery – Enumerate OneDrive personal drives and SharePoint document libraries.
- 📄 Full file lifecycle – Create folders, upload/update files (text or binary), download contents, and delete resources.
- 🔍 Deep research – Perform scoped searches inside a drive or global Microsoft Graph Search across SharePoint + OneDrive.
- 📚 Site exploration – Search for SharePoint sites and list their document libraries before activating one.
MCP Tools Overview
| Tool | Purpose |
|---|---|
Start_Device_Login / Complete_Device_Login | Initiate and complete the device-code flow for the desired Microsoft account. |
List_Available_Accounts / Set_Active_Account | Inspect cached accounts and pick which one is active. |
Get_Auth_Context / Get_Graph_Context | Debug helpers showing the current authentication + drive context. |
List_My_Drives / List_Site_Drives / Search_SharePoint_Sites | Discover drives and sites available to the active account. |
Set_Active_Drive | Choose the OneDrive or SharePoint library used for subsequent operations. |
List_Drive_Items, Get_Drive_Item_Metadata, Get_Drive_Item_Content | Explore the selected drive and read file contents. |
Create_Drive_Folder, Upload_Drive_File, Update_Drive_File, Delete_Drive_Item | Create, modify, and remove items. |
Search_Drive_Items | Search inside the currently-selected drive. |
Deep_Search_Microsoft365 | Perform a Microsoft Graph Search across SharePoint and OneDrive resources for deep research scenarios. |
All tools automatically reuse the selected Microsoft account and drive context.
Prerequisites
- Azure AD App Registration – Register a public client application (no secret) in Azure AD / Entra ID.
- Redirect URI can be
https://login.microsoftonline.com/common/oauth2/nativeclient. - Required delegated permissions:
Files.ReadWrite.All,Sites.ReadWrite.All,User.Read, and optionally others you need.
- Client ID – Note the Application (client) ID of the registration.
- Python 3.10+ – A recent Python interpreter for running the MCP server.
Configuration
The server is configured with environment variables (you can store them in a .env file during development):
| Variable | Description |
|---|---|
MCP_GRAPH_CLIENT_ID | Required. Client ID of the Azure AD public application (fallback: SHP_ID_APP). |
MCP_GRAPH_TENANT_ID | Optional. Tenant ID to restrict sign-ins. Defaults to common for multi-tenant. |
MCP_GRAPH_SCOPES | Optional comma-separated scopes. Defaults to Files.ReadWrite.All,Sites.ReadWrite.All,User.Read,offline_access. |
MCP_GRAPH_CACHE_PATH | Optional custom path for the MSAL token cache. Default: ~/.cache/mcp_sharepoint/token_cache.bin. |
MCP_GRAPH_DEFAULT_DRIVE_ID | Optional drive ID to auto-select on startup. |
MCP_GRAPH_LOG_LEVEL / MCP_GRAPH_LOG_FILE | Optional logging settings. |
Quickstart
Installation
pip install -e .Running the server
python -m mcp_sharepointIntegrate the binary into your MCP-aware client (ChatGPT desktop, Claude Desktop, MCP Inspector, etc.) by referencing the script mcp-sharepoint (created via the console script entry point) or by executing python -m mcp_sharepoint directly.
First-time authentication workflow
- Call
Start_Device_Loginfrom your MCP client. - Follow the
verification_urianduser_codeprovided to authenticate with the Microsoft account currently logged into the workstation. - Call
Complete_Device_Loginwith the returnedflow_idto finish the sign-in. - (Optional) Use
List_Available_AccountsandSet_Active_Accountto switch between cached profiles. - Discover drives with
List_My_DrivesorList_Site_Drives, then select one usingSet_Active_Drive. - You are ready to browse, search, and modify files using the rest of the tools.
Development
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -e .Use the MCP Inspector to debug traffic:
npx @modelcontextprotocol/inspector -- python -m mcp_sharepointLicense
This project is released under the MIT License.