outlook-connector

Cowork Outlook MCP Server

A local MCP server that gives Claude full access to Microsoft 365 email and calendar through the Microsoft Graph API. Built to be distributed as a standalone package — no secrets are baked in, no environment variables are required. Each user authenticates with their own Microsoft account through a browser-based OAuth flow.

Works with any Microsoft 365 account: work, school, or personal (outlook.com, hotmail.com, live.com).

Non-destructive by design

This server is deliberately built so that it cannot cause irreversible harm, even if Claude is misdirected:

• No delete. Messages can only be archived (moved to Archive) or moved between folders. There is no delete operation.
• No send. Emails can only be created as drafts. There is no send operation, and the Mail.Send OAuth scope is never requested — the token is physically incapable of sending mail, even if a prompt injection attack tries to invoke it.
• No calendar deletion. Events can be created, updated, and RSVP'd to, but not deleted.

Security

Prompt injection protection

When Claude reads an email, the content passes through a multi-layer HTML sanitizer before it reaches the model. This prevents attackers from embedding hidden instructions in emails that could manipulate Claude's behaviour.

The sanitizer defends against:

Attack vector	Defence
Hidden text via CSS (display:none, visibility:hidden, opacity:0)	Detected and stripped, including element content
Zero-size text (font-size:0, height:0, width:0)	Detected and stripped
Off-screen positioning (position:absolute; left:-9999px)	Detected and stripped
Same-colour text/background (color:white on background:white)	Colour comparison detects and strips
text-indent:-9999px and overflow:hidden with zero dimensions	Detected and stripped
aria-hidden="true" elements	Stripped with content
Dangerous tags (<script>, <style>, <iframe>, <svg>, <form>, etc.)	Removed entirely including content
Invisible Unicode characters (zero-width spaces, joiners, BOM, directional marks)	Stripped
Unicode tag characters (U+E0001-U+E007F, used in homoglyph attacks)	Stripped
Tracking pixels (1x1 images)	Detected and removed
HTML comments (can hide instructions)	Removed
data: URIs and base64 in attributes	Removed

Sanitized email content is wrapped in boundary markers (--- BEGIN EMAIL CONTENT --- / --- END EMAIL CONTENT ---) so Claude can clearly distinguish email content from its own instructions.

Authentication security

• OAuth 2.0 with PKCE — No client secret is stored or transmitted. Authentication uses the Authorization Code flow with Proof Key for Code Exchange, a standard designed for public clients.
• Localhost loopback — During login, the server spins up a temporary HTTP listener on a random port. The browser redirects back to http://localhost:{port}/callback after authentication. The listener shuts down immediately after receiving the callback.
• CSRF protection — A random state parameter is generated for each login and validated on callback.
• Local token storage — Access and refresh tokens are stored only on the user's machine. They are never transmitted to any third party.
• Automatic token refresh — Tokens are refreshed 60 seconds before expiry. A concurrency guard ensures that if multiple tools fire simultaneously with an expired token, only a single refresh request is made.
• Minimal scopes — Only four OAuth scopes are requested: offline_access, User.Read, Mail.ReadWrite, Calendars.ReadWrite. Notably, Mail.Send is excluded.

Scope justification

Scope	Why
offline_access	Allows token refresh without re-authentication
User.Read	Validates the authenticated identity (o365_whoami)
Mail.ReadWrite	Read messages, create drafts, move/archive messages, manage folders
Calendars.ReadWrite	Read/create/update events, RSVP

Tools (18)

Authentication

Tool	Description
o365_login	Opens a browser window for Microsoft sign-in. Tokens are saved locally.
o365_logout	Removes stored tokens from this machine.
o365_whoami	Shows the currently authenticated user.

Email