outlook-mcp@1.32.0
CAUTION· static onlyPublisher claims: "Production-grade MCP server for personal Outlook (Outlook.com / Hotmail / Live). 77 typed Graph tools across mail, inbox rules, calendar, contacts, to-do, drafts, attachments, folders, threading, batch ops, delta-sync. Granular permissions, OS-keyring auth, /$batch-optimized triage and bulk read. Built for agents that need real Outlook coverage, not a CLI wrapper. BYO Azure app; zero telemetry." Observed in sandbox: static analysis only — behavior not yet observed.
Registry ClawHubPublisher mpalermiti · publishing for 215 daysInstalls 3,003Last detonated 29 min ago
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 58/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Credential pass-through configuration; Credential pass-through configuration. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
MEDIUM
File permission modification commandsrc/outlook_mcp/config.py:688 · File permission modification command — agent changes file ownership/permissions
AST05# has marked read-only used to have that attribute cleared here — chmod on Windows doesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
MCP server using network transport (SSE/HTTP)src/outlook_mcp/http_transport.py:312 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04def build_app(server: MCPServer, settings: HttpSettings) -> ASGIApp:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File permission modification commandsrc/outlook_mcp/config.py:473 · File permission modification command — agent changes file ownership/permissions
AST05# The 0o700 directory and 0o600 file modes below are POSIX-only. On Windows os.chmod can setFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Credential pass-through configurationsrc/outlook_mcp/toolsets.py:41 · Credential pass-through configuration — agent relays sensitive credentials
AST02# feature here (~1.2k proxy tokens, ~8% of the default surface — mostlyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Credential pass-through configurationsrc/outlook_mcp/toolsets.py:81 · Credential pass-through configuration — agent relays sensitive credentials
AST02# feature here (~1.2k proxy tokens, mostly `create_rule`'s argument list), andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
MCP server using network transport (SSE/HTTP)src/outlook_mcp/http_transport.py:332 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04def uvicorn_config(server: MCPServer, settings: HttpSettings) -> uvicorn.Config:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.HIGH
Credential pass-through configurationsrc/outlook_mcp/toolsets.py:11 · Credential pass-through configuration — agent relays sensitive credentials
AST022. **Config-gated toolsets** — the full tool schemas cost chars/4 proxy tokensFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
MCP server using network transport (SSE/HTTP)src/outlook_mcp/http_transport.py:353 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04def serve(server: MCPServer, settings: HttpSettings) -> None:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File permission modification commandsrc/outlook_mcp/tools/mail_attachments.py:166 · File permission modification command — agent changes file ownership/permissions
AST05# Ours to lock down. Never chmod a directory the user pointed us at.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandsrc/outlook_mcp/tools/mail_attachments.py:167 · File permission modification command — agent changes file ownership/permissions
AST05# POSIX-only: on Windows os.chmod sets nothing but the read-only attribute, so thisFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_attachment_paths.py:172 · Python subprocess execution detected
AST05out = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Credential pass-through configurationsrc/outlook_mcp/server.py:182 · Credential pass-through configuration — agent relays sensitive credentials
AST02# re-fetching ~13k chars/4 proxy tokens of schemas. The set is fixed at import —Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_document_review_guards.py:169 · Python subprocess execution detected
AST05done = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_config_environment.py:626 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Credential pass-through configurationtests/test_tool_surface_budget.py:332 · Credential pass-through configuration — agent relays sensitive credentials
AST02proxy tokens on 1.25.1), and the budget measured a different surfaceFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_delta_url_validation.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05pytest.param("file:///etc/passwd", id="file-scheme"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_tool_surface_budget.py:391 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_readable_attachments.py:477 · Python subprocess execution detected
AST05'p=subprocess.Popen([sys.executable,"-c","import time; time.sleep(60)"])\n'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Hex-encoded string detectedtests/test_attachments_as_content.py:346 · Hex-encoded string detected — may contain obfuscated payloads
AST07("image/jpeg", b"\xff\xd8\xff\xe0\x00\x10JFIF"),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedtests/test_docs_match_the_surface.py:54 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtests/test_validation.py:618 · Process kill command — agent can terminate processes
AST05"""An upgrade must not kill a server whose config.json already says EST.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_readable_attachments.py:257 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_startup_degrades.py:208 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_readable_attachments.py:539 · Python subprocess execution detected
AST05off = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_config.py:556 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_readable_attachments.py:542 · Python subprocess execution detected
AST05on = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_config_environment.py:655 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_server.py:900 · Python subprocess execution detected
AST05out = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_validation.py:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05validate_graph_id("../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_keychain_collision.py:246 · Python subprocess execution detected
AST05out = subprocess.run(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandtests/test_config.py:38 · File permission modification command — agent changes file ownership/permissions
AST05reason="os.chmod on Windows honours only the read-only attribute, so 0o700 is not "Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandtests/test_config.py:51 · File permission modification command — agent changes file ownership/permissions
AST05reason="os.chmod on Windows honours only the read-only attribute, so 0o600 is not "Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_config.py:133 · Python subprocess execution detected
AST05out = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandtests/test_mail_attachments.py:678 · File permission modification command — agent changes file ownership/permissions
AST05reason="os.chmod on Windows honours only the read-only attribute (#85).",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_tool_surface_budget.py:434 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandtests/test_config.py:280 · File permission modification command — agent changes file ownership/permissions
AST05reason="the repair asserts a POSIX mode, and os.chmod on Windows cannot set 0o600 (#85).",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Unicode escape sequence detectedtests/test_live_drafts_write.py:124 · Unicode escape sequence detected — may contain obfuscated payloads
AST07_INVISIBLE = dict.fromkeys(map(ord, "\u200b\u200c\u200d\u2060\ufeff\u034f"))Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedtests/test_readable_attachments.py:392 · Python subprocess execution detected
AST05done = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Hex-encoded string detectedtests/test_mail_attachments.py:130 · Hex-encoded string detected — may contain obfuscated payloads
AST07raw_content = b"PK\x03\x04\x14\x00\x00\x00\x08\x00\xff\xfe\x00\x01binary"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with embedded credentialstests/test_delta_url_validation.py:261 · URL with embedded credentials — may be phishing or credential leaking
AST07pytest.param("https://user:[email protected]/x", id="userinfo"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_server.py:196 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_http_transport.py:755 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_http_transport.py:436 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Credential pass-through configurationtests/test_tool_surface_budget.py:353 · Credential pass-through configuration — agent relays sensitive credentials
AST02f"`prompts/list` now costs ~{cost} proxy tokens. A prompt's body is supposed "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Credential pass-through configurationtests/test_tool_surface_budget.py:413 · Credential pass-through configuration — agent relays sensitive credentials
AST02# (+79 proxy tokens). All groups: 77 / 12,175. Measured on Python 3.13 withFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_expected_username.py:164 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_validation.py:512 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05for key in ("/etc/localtime", "../../etc/passwd"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Hex-encoded string detectedtests/test_attachments_as_content.py:86 · Hex-encoded string detected — may contain obfuscated payloads
AST07DOCX = b"PK\x03\x04\x14\x00\x00\x00\x08\x00\xff\xfe\x00\x01binary"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandtests/test_downloads_never_replace.py:40 · File permission modification command — agent changes file ownership/permissions
AST05reason="os.chmod on Windows honours only the read-only attribute (#85).",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Access to sensitive file pathstests/test_mail_attachments.py:193 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05save_path="/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_server.py:996 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandtests/test_attachment_paths.py:111 · File permission modification command — agent changes file ownership/permissions
AST05reason="os.chmod on Windows honours only the read-only attribute, so 0o700 is not "Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_config.py:178 · Python subprocess execution detected
AST05out = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Destructive file system command detectedtests/test_mail_read_bulk.py:293 · Destructive file system command detected
AST05# ── Format / concise / deferred-send ─────────────────────────────────────Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Credential pass-through configurationtests/test_tool_surface_budget.py:268 · Credential pass-through configuration — agent relays sensitive credentials
AST02f"The 71-tool default surface now costs ~{cost} proxy tokens per turn, over the "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_document_followups.py:72 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_tool_surface_budget.py:306 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Credential pass-through configurationtests/test_tool_surface_budget.py:319 · Credential pass-through configuration — agent relays sensitive credentials
AST02f"The rules-enabled surface costs ~{measured['cost']} proxy tokens, over the "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈9,199 tok
2 files · 183 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
22 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim mpalermiti: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mpalermitiPropose a patch to the maintainer