Skills/npm/ms-365-mcp-server

ms-365-mcp-server@0.181.0

CAUTION· not started

Publisher claims: " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher softeria · publishing for 590 daysInstalls 297KLast detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MS365_MCP_ALLOW_UNAUTHENTICATED_DISCOVERYMS365_MCP_CLIENT_SECRETMS365_MCP_FEDERATED_TOKEN_FILEMS365_MCP_OAUTH_TOKENMS365_MCP_PKCE_SECRETMS365_MCP_TOKEN_CACHE_PATHMS365_MCP_TRUST_PROXY_AUTHPKCE_SECRET_MIN_LENGTH or --trust-proxy-auth / --enable-auth-tools / --allow-unauthenticated-discoveryConfiguration, not credentials: CACHE_KEY_BYTES, ENABLED_TOOLS, ENABLED_TOOLS_FILE, MS365_MCP_ALLOW_PAGINATION, MS365_MCP_ALLOWED_REDIRECT_URIS, MS365_MCP_ALLOWED_SCOPES, MS365_MCP_APP_MODE, MS365_MCP_ATTACHMENT_HOST, MS365_MCP_ATTACHMENT_PORT, MS365_MCP_ATTACHMENT_URL_BASE, MS365_MCP_ATTACHMENT_URL_KEY, MS365_MCP_ATTACHMENT_URL_KEY_FILE, MS365_MCP_ATTACHMENT_URL_KEY_ID, MS365_MCP_ATTACHMENT_URL_TTL_S, MS365_MCP_AUDIT_LOG, MS365_MCP_BASE_URL, MS365_MCP_BLOB_MAX_BYTES, MS365_MCP_BLOB_OUTPUT, MS365_MCP_BODY_FORMAT, MS365_MCP_CLIENT_CERTIFICATE_PATH, MS365_MCP_CLIENT_ID, MS365_MCP_CLOUD_TYPE, MS365_MCP_CORS_ORIGIN, MS365_MCP_DISABLE_DCR, MS365_MCP_EAGER_TOOLS, MS365_MCP_EXPECTED_HOME_ACCOUNT_ID, MS365_MCP_EXPECTED_USERNAME, MS365_MCP_EXTRA_SCOPES, MS365_MCP_FORCE_WORK_SCOPES, MS365_MCP_GRAPH_CIRCUIT_DISABLED, MS365_MCP_HTTP_LOCAL_FILE_TOOLS, MS365_MCP_KEYVAULT_URL
Where it talks to
no vendor host named in the codeAlso microsoft.com, githubusercontent.com, microsoftonline.com, azure.com, chinacloudapi.cn, azure.cn, microsoftonline.us, microsoft.us, azure.us, graph.invalid — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names microsoft.com, githubusercontent.com, microsoftonline.com, azure.com, chinacloudapi.cn, azure.cn, microsoftonline.us, microsoft.us, azure.us, graph.invalid as well as its own vendor. The guard injects MS365_MCP_ALLOW_UNAUTHENTICATED_DISCOVERY, MS365_MCP_CLIENT_SECRET, MS365_MCP_FEDERATED_TOKEN_FILE, MS365_MCP_OAUTH_TOKEN, MS365_MCP_PKCE_SECRET, MS365_MCP_TOKEN_CACHE_PATH, MS365_MCP_TRUST_PROXY_AUTH, PKCE_SECRET_MIN_LENGTH only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @softeria/ms-365-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 18 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
17sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-0KgFFh/task/home/.npm/_logs/2026-11-09T03_50_50_439Z-debug-0.log
17sclaimednot started: dependency install failed (exit 1); the server itself was not observed
17sprocessscript backend runs setup only
17sprocessno install scripts to re-run

Static findings

HIGH
Destructive file system command detectedbin/modules/simplified-openapi.mjs:24 · Destructive file system command detected// Microsoft's published OpenAPI metadata (e.g. range(address='{address}')/formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/app-mode.js:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessecrets.clientSecret && "a client secret (MS365_MCP_CLIENT_SECRET, .env or Key Vault)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detecteddist/lib/attachment-url-config.js:11 · Unicode escape sequence detected — may contain obfuscated payloadsconst PYTHON_WHITESPACE = " \n\v\f\r \x85\xA0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200A\u2028\u2029\u202F\u205F\u3000";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionbin/modules/generate-mcp-tools.mjs:48 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Created directory: ${outputDir}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/__tests__/graph-tools.test.js:2336 · File type combined with upload action — agent may exfiltrate local data filesit("honors endpoints.json contentType override on binary uploads", async () => {Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/lib/mail-text.js:235 · Unicode escape sequence detected — may contain obfuscated payloads…u05D1\u05E8\u05D4|\u0625\u0639\u0627\u062F\u0629 \u062A\u0648\u062C\u064A\u0647|\u0BAE\u0BC1\u0BA9\u0BCD\u0BA9\u0BA9\u0BC1\u0BAA\u0BCD\u0BAA\u0BC1)\\s*[:\uFF1A]", "iu" ); function isForwardSubject(subject) { return FORWARD…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commandtsup.config.ts:14 · File permission modification command — agent changes file ownership/permissionsonSuccess: process.platform === 'win32' ? undefined : 'chmod +x dist/index.js',Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/load-env.js:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…console.error( `[ms365-mcp] Ignored ${ignoredOwn.length} variable(s) from .env: ${[...ignoredOwn].sort().join(", ")}. Only ${ENV_FILE_ALLOWLIST.join(", ")} ar…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/load-env.js:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst file = options.path ?? path.resolve(process.cwd(), ".env");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/modules/generate-mcp-tools.mjs:52 · npx invocation of non-well-known package — may execute untrusted code`npx -y openapi-zod-client "${openapiTrimmedFile}" -o "${clientFilePath}" --with-description --strict-objects --additional-props-default-value=false`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈71 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @softeria/ms-365-mcp-server@0.181.0 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim softeria: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim softeriaPropose a patch to the maintainer