Microsoft 365 MCP Server

Integrate Microsoft 365 to manage Outlook email, calendar events, OneDrive files, Tasks, Teams chats, and user profiles via Microsoft Graph and MCP protocol.

This skill implements a full Microsoft 365 integration and needs tenant-level Azure app credentials (TENANT_ID, CLIENT_ID, CLIENT_SECRET) and admin-consented application permissions. Before installing: 1) Don’t trust the registry metadata alone — it fails to list the required secrets; verify SKILL.md and code. 2) Only install if you trust the author and you understand the privileges you will grant — the requested permissions give tenant-wide read/write access to mail, files, Teams, and users. 3) Prefer creating a dedicated least-privilege Azure app (grant only the exact permissions you need), use a test or limited tenant, and avoid granting Mail.Send or Files.ReadWrite.All unless absolutely necessary. 4) Rotate and store the client secret securely; do not reuse high-priv creds. 5) If you must run in production, consider restricting the app (permission scoping, conditional access) and review the source code yourself (it only calls Microsoft identity and graph endpoints). 6) Be aware that the agent may invoke the skill autonomously; combine that with strong controls and monitoring (audit logs, limited service account) to reduce risk.

Type: OpenClaw Skill Name: mcp-microsoft365 Version: 1.0.0 The skill is classified as suspicious due to the extremely broad Microsoft Graph API permissions it requests and utilizes, such as `Files.Read.All`, `Mail.Read.All`, `Chat.Read.All`, and `User.Read.All`. While these permissions are explicitly documented in `SKILL.md` and `README.md` as requirements for 'full Microsoft 365 integration' and the `src/index.ts` code only interacts with legitimate Microsoft endpoints (Azure AD for authentication, Microsoft Graph for API calls), the inherent capability to access and potentially exfiltrate a vast amount of sensitive organizational data (all files, emails, chats, and user profiles across the organization) represents a significant risk if the skill or the underlying Azure application credentials were ever compromised or misused. There is no evidence of intentional malicious behavior in the code itself, but the broad permissions elevate it beyond benign.