Outlook Triage MCP Server
Microsoft 365 mailbox triage, attachment parsing, and inbox rule management.
Data last scanned today · Reviewed today
Overview
This MCP server enables direct interaction with Microsoft 365 mailboxes via the Microsoft Graph API. It provides tools for searching messages, generating Markdown-formatted daily digests, and extracting text from local PDF, DOCX, or XLSX attachments using deterministic heuristics.
Our verdict
The Outlook Triage MCP Server carries a high-risk rating of 30/100 due to its community-maintained nature and lack of formal editorial review. While it implements a read-only default and requires an explicit environment variable override for write operations, users should exercise caution given the potential for account access through token caching. This tool is best suited for developers comfortable auditing the codebase themselves.
- Zero direct external dependencies minimize supply-chain surface
- Local text extraction for common office attachment formats
- Explicit opt-in required for all mailbox write operations
- Idempotent inbox rule provisioning prevents redundant API calls
- High risk level due to community-maintained project status
- Limited community oversight with only one contributor
- Authentication method and security posture pending formal review
Tools
| Tool | Description | Risk |
|---|---|---|
| auth_status | Token state; starts device-code sign-in and returns the URL + code when login is needed | low |
| search_messages | Search (KQL) or list messages; since accepts ISO 8601 or relative (24h, 7d) | low |
| get_message | Full body + metadata; optionally extracts text from PDF/DOCX/XLSX attachments locally | low |
| daily_briefing | Markdown digest classified into urgent / action_needed / fyi / newsletter | low |
| list_inbox_rules | Inventory of inbox rules with conditions and actions | low |
| ensure_inbox_rule | Idempotently converge one rule (sender contains X → move to folder Y); creates the folder if missing | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›Does the server require write permissions to operate?
No, the server is read-only by default and uses only Mail.Read and MailboxSettings.Read scopes. Write access is only granted if you explicitly set the OUTLOOK_MCP_ENABLE_WRITE environment variable to 1 and re-authenticate.
›How does authentication work?
The server uses the Microsoft MSAL device-code flow, which provides a URL and code through the auth_status tool for you to sign in via your browser. Once signed in, tokens are cached locally in your home directory with restricted 0600 file permissions.
›Can I extract text from email attachments?
Yes, the get_message tool can locally parse PDF, DOCX, and XLSX files. You must install the server with the [attachments] extra during setup to enable these dependencies.
›Does this server send my email data to an LLM?
No, classification is performed locally using deterministic keyword heuristics. Message content remains on your machine and is not processed by an LLM unless you explicitly provide that information to Claude via the MCP interface.
›What happens if I try to use the inbox rule provisioning tool without write access?
The ensure_inbox_rule tool is designed to refuse execution unless the server is started with the OUTLOOK_MCP_ENABLE_WRITE environment variable enabled.
›Can I use my own Azure AD app registration?
Yes, if your tenant blocks the default Microsoft Graph CLI client, you can register your own public-client application and provide its ID using the OUTLOOK_MCP_CLIENT_ID environment variable.
Alternatives
Badge
Maintain this server? Add the live badge to your README.