ms-365-mcp-server@0.180.0
CAUTION· not startedPublisher claims: " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
Code inventory arrives with this version's next honeypot run.- It will ask for
- unknown until the next run
- Where it talks to
- unknown until the next run
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try ms-365-mcp-server` runs it now and prints the full answer.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-07 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 2 s · 2 scenarios · 0 deviationsStatic findings
onSuccess: process.platform === 'win32' ? undefined : 'chmod +x dist/index.js',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.it("honors endpoints.json contentType override on binary uploads", async () => {Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.// Microsoft's published OpenAPI metadata (e.g. range(address='{address}')/formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.`[ms365-mcp] Ignored ${ignoredOwn.length} variable(s) from .env: ${[...ignoredOwn].sort().join(", ")}. Only ${ENV_FILE_ALLOWLIST.join(", ")} are read from .env - set anything else in your shell or MCPFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.const PYTHON_WHITESPACE = " \n\v\f\r \x85\xA0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200A\u2028\u2029\u202F\u205F\u3000";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.console.log(`Created directory: ${outputDir}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.return `Accept header for the response representation. Defaults to "${acceptType}". Only set this when Graph asks for a different format \u2014 e.g. a 403 SpeakerAttributionNotAllowed on transcript coFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.secrets.clientSecret && "a client secret (MS365_MCP_CLIENT_SECRET, .env or Key Vault)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.const file = options.path ?? path.resolve(process.cwd(), ".env");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose."^\\s*(?:\\[[^\\]\\n]{0,60}\\]\\s*){0,5}(?:fwd?|vs|vb|wg|tr|trs|rv|i|enc|doorst|vl|ed|fs|pd|yml|ilt|\u0130lt|tov\xE1bb\xEDt\xE1s|p\u0101rs\\.|\u03C0\u03C1\u03B8|\u8F6C\u53D1|\u8F49\u5BC4|\u05D4\u05D5\Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.`npx -y openapi-zod-client "${openapiTrimmedFile}" -o "${clientFilePath}" --with-description --strict-objects --additional-props-default-value=false`,Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @softeria/ms-365-mcp-server@0.180.0 as of 7d ago. This is the package itself, not its dependencies.
What would make this Verified
3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim softeria: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.