Outlook MCP
PYPI · OUTLOOK-GRAPH-MCP · SCANNED SEP 21
Microsoft Outlook personal accounts: mail, calendar, contacts, to-do, drafts (62 tools).
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 64 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (MIT License) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 8 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 5585 tokens (~90/item across 62 items; 62 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management57
- Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 11 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 63 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the Outlook MCP server?
Outlook MCP runs locally as a PyPI package, launched with uvx outlook-graph-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · outlook-graph-mcp
claude mcp add mpalermiti-outlook-mcp -- uvx outlook-graph-mcp
{
"mcpServers": {
"mpalermiti-outlook-mcp": {
"command": "uvx",
"args": [
"outlook-graph-mcp"
]
}
}
} {
"servers": {
"mpalermiti-outlook-mcp": {
"command": "uvx",
"args": [
"outlook-graph-mcp"
]
}
}
} codex mcp add mpalermiti-outlook-mcp -- uvx outlook-graph-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mpalermiti-outlook-mcp": {
"type": "local",
"command": [
"uvx",
"outlook-graph-mcp"
],
"enabled": true
}
}
} openclaw mcp add mpalermiti-outlook-mcp --command uvx --arg outlook-graph-mcp
mcp_servers:
mpalermiti-outlook-mcp:
command: "uvx"
args: ["outlook-graph-mcp"] {
"McpServers": {
"mpalermiti-outlook-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"outlook-graph-mcp"
]
}
}
} assistant mcp add mpalermiti-outlook-mcp -t stdio -c uvx -a outlook-graph-mcp
{
"mcpServers": {
"mpalermiti-outlook-mcp": {
"command": "uvx",
"args": [
"outlook-graph-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- 13 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 12 Sept 26 +1
- Package version: 1.20.0 → 1.22.0 functional
- Package version: 1.20.0 → 1.21.0 functional
- 10 Sept 26 +3
- Schema quality: unverified → 100 ▲ functional
- Package version: 1.19.0 → 1.20.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed pypi/outlook-graph-mcp@1.22.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 64 packages
| Packages resolved | 64 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
outlook_search_contacts ~35
Search contacts by name or email using KQL query syntax.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
outlook_search_mail ~192
Full-text search mail with KQL across all folders (or one, if `folder` is set). Use this for "find emails about X"; use outlook_list_inbox for structured filters scoped to a single folder. Example: outlook_search_mail(query="from:sarah@acme.com received>=2026-01-01", count=10) `query` is Microsoft KQL (from:, subject:, received>=, hasattachment:true, AND/OR/NOT). Operators must be UPPERCASE — lowercase `and` is matched as a literal term. Two terms with no operator between them broaden the search; use AND explicitly to narrow. Pass concise=True to drop large fields (preview, categories) — ~10x fewer tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| concise | boolean | – | – |
| count | integer | – | – |
| cursor | – | – | – |
| folder | – | – | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
outlook_send_draft ~35
Send an existing draft (pair with outlook_create_draft for human-review send flow).
| Name | Type | Req | Description |
|---|---|---|---|
| draft_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_send_message ~135
Send an email immediately, no human review. For human-review workflows use outlook_create_draft + outlook_send_draft instead. For replying to an existing message use outlook_reply; for calendar invites use outlook_rsvp. Pass reply_to to route recipient replies to a different address (e.g. a shared team alias).
| Name | Type | Req | Description |
|---|---|---|---|
| bcc | – | – | – |
| body | string | yes | – |
| cc | – | – | – |
| importance | string | – | – |
| is_html | boolean | – | – |
| reply_to | – | – | – |
| request_read_receipt | boolean | – | – |
| subject | string | yes | – |
| to | array | yes | – |
No output schema declared.
No examples provided.
outlook_send_with_attachments ~145
Send an email with file attachments; auto-switches to upload-session for files >3MB. `attachment_paths` resolve inside the configured attachments directory (`attachments_dir`, default ~/.outlook-mcp/attachments) — a bare filename is looked up there, and a path outside it is refused. Pass reply_to to route replies to a different address.
| Name | Type | Req | Description |
|---|---|---|---|
| attachment_paths | array | yes | – |
| bcc | – | – | – |
| body | string | yes | – |
| cc | – | – | – |
| importance | string | – | – |
| is_html | boolean | – | – |
| reply_to | – | – | – |
| subject | string | yes | – |
| to | array | yes | – |
No output schema declared.
No examples provided.
outlook_set_inbox_override ~107
Create or update a sticky Focused/Other rule for a sender (upsert, case-insensitive). Use this to permanently change classification for FUTURE messages from a sender; use outlook_reclassify_message to fix ONE existing message. Example: outlook_set_inbox_override(sender_email="marketing@acme.com", classify_as="other") Returns status: "created" or "updated".
| Name | Type | Req | Description |
|---|---|---|---|
| classify_as | string | yes | – |
| sender_email | string | yes | – |
No output schema declared.
No examples provided.
outlook_switch_account ~32
Switch the active Outlook account by configured `name` (from outlook_list_accounts).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
No output schema declared.
No examples provided.
outlook_update_contact ~52
Update an existing contact (partial patch — only provided fields change).
| Name | Type | Req | Description |
|---|---|---|---|
| contact_id | string | yes | – |
| – | – | – | |
| first_name | – | – | – |
| last_name | – | – | – |
| phone | – | – | – |
No output schema declared.
No examples provided.
outlook_update_draft ~136
Update an existing draft (partial patch). Pass is_html=True when body is HTML — required when overwriting a draft originally composed as HTML (consumer Outlook rejects Text-over-HTML PATCH). Pass reply_to=[...] to overwrite Reply-To; reply_to=[] to clear it. Pass deferred_send_datetime (ISO 8601) to set the scheduled-send time; empty string clears it.
| Name | Type | Req | Description |
|---|---|---|---|
| body | – | – | – |
| cc | – | – | – |
| deferred_send_datetime | – | – | – |
| draft_id | string | yes | – |
| is_html | boolean | – | – |
| reply_to | – | – | – |
| subject | – | – | – |
| to | – | – | – |
No output schema declared.
No examples provided.
outlook_update_event ~244
Update fields on an existing event (partial patch — only provided fields change). `recurrence` takes the same shapes as outlook_create_event and converts a single event into a series, or replaces an existing series' pattern. Omit it to leave any recurrence alone; pass remove_recurrence=True to turn a series back into a single event, keeping the first occurrence's time (the two are mutually exclusive). `attendees` REPLACES the whole guest list (Graph has no add-one operation) and sends invitations to everyone on it plus cancellations to anyone dropped — pass the full intended list; [] removes everyone. `is_all_day` REQUIRES start and end in the same call, both on midnight boundaries. Omitting an argument leaves it unchanged, so False and [] are instructions, not absences.
| Name | Type | Req | Description |
|---|---|---|---|
| attendees | – | – | – |
| body | – | – | – |
| end | – | – | – |
| event_id | string | yes | – |
| is_all_day | – | – | – |
| location | – | – | – |
| recurrence | – | – | – |
| remove_recurrence | boolean | – | – |
| start | – | – | – |
| subject | – | – | – |
No output schema declared.
No examples provided.
outlook_update_task ~59
Update fields on a To Do task (partial patch — only provided fields change).
| Name | Type | Req | Description |
|---|---|---|---|
| body | – | – | – |
| due | – | – | – |
| importance | – | – | – |
| list_id | – | – | – |
| task_id | string | yes | – |
| title | – | – | – |
No output schema declared.
No examples provided.
outlook_whoami ~23
Get the authenticated user's profile (display name, email, ID).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the Outlook MCP server?
Outlook MCP is listed in the public MCP registry as io.github.mpalermiti/outlook-mcp. Microsoft Outlook personal accounts: mail, calendar, contacts, to-do, drafts (62 tools). This page covers its PyPI package (outlook-graph-mcp).
Is the Outlook MCP server safe to use?
Outlook MCP scores 60 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Outlook MCP server expose?
Outlook MCP exposes 62 tools: outlook_auth_status, outlook_list_inbox, outlook_read_message, outlook_read_messages, outlook_search_mail, and 57 more. Their descriptions and schemas cost roughly 5,268 tokens of context every time the server is loaded.
Is the Outlook MCP server still maintained?
Outlook MCP is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.