Outlook MCP
PYPI · OUTLOOK-GRAPH-MCP
Microsoft Outlook personal accounts: mail, rules, calendar, contacts, to-do, drafts (77 tools).
Available components
Last scanned (7 hours ago)
Scores higher than 85% of PyPI servers
Category Communication
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 62 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 8034 tokens (~113/item across 71 items; 71 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 14 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 72 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +16
- Malware scan: unverified → pass ▲ security
- Stability: fail → pass ▲ security
- 4 Nov 26 0
- Package version: 1.31.3 → 1.31.4 functional
- 2 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.31.1 → 1.31.3 functional
- Package version: 1.31.1 → 1.31.2 functional
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.30.2 → 1.31.1 functional
- Package version: 1.30.2 → 1.31.0 functional
- 30 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 29 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.30.1 → 1.30.2 functional
- 28 Oct 26 −1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 1.28.0 → 1.30.1 functional
- Package version: 1.28.0 → 1.29.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/outlook-graph-mcp@1.31.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 62 packages
| Packages resolved | 62 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
outlook_read_message ~176
Get one full message by ID or Message-ID (`<abc@example.com>`). `format` is "text", "html", or "full" (the stored body, usually HTML, as body and body_html). Pass include_deferred_send=True to also return the scheduled-send time (PR_DEFERRED_SEND_TIME) as deferred_send_datetime — useful when recreating a delayed draft. Pass concise=True to drop large fields (body, body_html) and return a 200-char body_preview — ~10x fewer tokens for triage scans. include_sender_auth=True adds sender_authentication: did Microsoft verify the From domain?
| Name | Type | Req | Description |
|---|---|---|---|
| concise | boolean | – | – |
| format | string | – | – |
| include_deferred_send | boolean | – | – |
| include_sender_auth | boolean | – | – |
| message_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_read_messages ~179
Bulk read up to 20 messages by ID via $batch — use NOT N outlook_read_message calls. Per-message shape in `messages` matches outlook_read_message byte-for-byte for the same (format, concise, include_deferred_send, include_sender_auth). Ordering follows input `message_ids`. Returns `{messages, failures, requested, succeeded, failed}` — 404s on some IDs are surfaced in `failures` without failing the whole call (partial-failure tolerant). Example: outlook_read_messages(message_ids=[id1, id2, id3], concise=True) Hard cap of 20 (Graph $batch limit).
| Name | Type | Req | Description |
|---|---|---|---|
| concise | boolean | – | – |
| format | string | – | – |
| include_deferred_send | boolean | – | – |
| include_sender_auth | boolean | – | – |
| message_ids | array | yes | – |
No output schema declared.
No examples provided.
outlook_reclassify_message ~77
Reclassify ONE message's Focused/Other placement. `classification` is "focused" or "other". Use this to fix a single message; use outlook_set_inbox_override for a sticky rule that affects future messages from the same sender.
| Name | Type | Req | Description |
|---|---|---|---|
| classification | string | yes | – |
| message_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_remove_draft_attachment ~39
Remove a single attachment from a draft message by attachment ID.
| Name | Type | Req | Description |
|---|---|---|---|
| attachment_id | string | yes | – |
| draft_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_remove_event_attachment ~43
Remove one attachment from an event (IDs from outlook_get_event's `attachments`).
| Name | Type | Req | Description |
|---|---|---|---|
| attachment_id | string | yes | – |
| event_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_rename_folder ~34
Rename a user-created mail folder by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | yes | – |
| name | string | yes | – |
No output schema declared.
No examples provided.
outlook_reply ~73
Reply (or reply-all) to an email message. Use this for email; use outlook_rsvp for calendar meeting invites.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | – |
| is_html | boolean | – | – |
| is_markdown | boolean | – | – |
| message_id | string | yes | – |
| reply_all | boolean | – | – |
No output schema declared.
No examples provided.
outlook_rsvp ~71
RSVP to a calendar meeting invite. `response` is "accept", "decline", or "tentative". Use this for meeting invites; use outlook_reply to reply to a regular email message.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | – |
| message | string | – | – |
| response | string | yes | – |
No output schema declared.
No examples provided.
outlook_search_contacts ~61
Search contacts by name or email using KQL query syntax. phone (instead of query) finds a number written any way, with or without country code.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| phone | string | – | – |
| query | string | – | – |
No output schema declared.
No examples provided.
outlook_search_mail ~196
Full-text search mail with KQL across all folders (or one, if `folder` is set). Use this for "find emails about X"; use outlook_list_inbox for structured filters scoped to a single folder. Example: outlook_search_mail(query="from:sarah@acme.com received>=2026-01-01", count=10) `query` is Microsoft KQL (from:, subject:, received>=, hasattachment:true, AND/OR/NOT). Operators must be UPPERCASE — lowercase `and` is matched as a literal term. Two terms with no operator between them broaden the search; use AND explicitly to narrow. Pass concise=True to drop large fields (preview, categories) — ~10x fewer tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| concise | boolean | – | – |
| count | integer | – | – |
| cursor | string | – | – |
| folder | string | – | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
outlook_send_draft ~35
Send an existing draft (pair with outlook_create_draft for human-review send flow).
| Name | Type | Req | Description |
|---|---|---|---|
| draft_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_send_message ~150
Send an email immediately, no human review. For human-review workflows use outlook_create_draft + outlook_send_draft instead. For replying to an existing message use outlook_reply; for calendar invites use outlook_rsvp. Pass reply_to to route recipient replies to a different address (e.g. a shared team alias).
| Name | Type | Req | Description |
|---|---|---|---|
| bcc | array | – | – |
| body | string | yes | – |
| cc | array | – | – |
| importance | string | – | – |
| is_html | boolean | – | – |
| is_markdown | boolean | – | – |
| reply_to | array | – | – |
| request_read_receipt | boolean | – | – |
| subject | string | yes | – |
| to | array | yes | – |
No output schema declared.
No examples provided.
outlook_send_with_attachments ~185
Send an email with file attachments; auto-switches to upload-session for files >3MB. `attachment_paths` resolve inside the configured attachments directory (`attachments_dir`, an `attachments` folder in the settings directory by default) — a bare filename is looked up there, and a path outside it is refused. `attachments`: inline files [{name, content_base64, content_type?}], up to 3MB each. Pass reply_to to route replies to a different address.
| Name | Type | Req | Description |
|---|---|---|---|
| attachment_paths | array | – | – |
| attachments | array | – | – |
| bcc | array | – | – |
| body | string | yes | – |
| cc | array | – | – |
| importance | string | – | – |
| is_html | boolean | – | – |
| reply_to | array | – | – |
| subject | string | yes | – |
| to | array | yes | – |
No output schema declared.
No examples provided.
outlook_set_inbox_override ~107
Create or update a sticky Focused/Other rule for a sender (upsert, case-insensitive). Use this to permanently change classification for FUTURE messages from a sender; use outlook_reclassify_message to fix ONE existing message. Example: outlook_set_inbox_override(sender_email="marketing@acme.com", classify_as="other") Returns status: "created" or "updated".
| Name | Type | Req | Description |
|---|---|---|---|
| classify_as | string | yes | – |
| sender_email | string | yes | – |
No output schema declared.
No examples provided.
outlook_update_checklist_item ~92
Update a checklist item (partial patch — only provided fields change). `is_checked=True` marks a sub-step done; Graph maintains the checked timestamp from it. Renaming passes `display_name`.
| Name | Type | Req | Description |
|---|---|---|---|
| checklist_item_id | string | yes | – |
| display_name | string | – | – |
| is_checked | boolean | – | – |
| list_id | string | – | – |
| task_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_update_contact ~357
Update an existing contact (partial patch — only provided fields change). A text field passed as "" is cleared; job_title is the job, company the employer. An address takes the shape outlook_get_contact returns — any subset of {"street", "city", "state", "postal_code", "country_or_region"} — and REPLACES that whole address, so pass back every part you want to keep. Omit it to leave it untouched. phone_type ("mobile", "business", "home") picks the field; business/home REPLACE that list. clear_phones empties those types: phone_type="business", clear_phones=["mobile"] moves it. title is the name prefix ("Dr.", "Ms."), shown in the display name — not the job. birthday is a date, YYYY-MM-DD. categories REPLACES the whole list ([] clears it). email REPLACES every address; add_emails/remove_emails change only those (3 at most).
| Name | Type | Req | Description |
|---|---|---|---|
| add_emails | array | – | – |
| birthday | string | – | – |
| business_address | object | – | – |
| categories | array | – | – |
| clear_phones | array | – | – |
| company | string | – | – |
| contact_id | string | yes | – |
| string | – | – | |
| first_name | string | – | – |
| home_address | object | – | – |
| job_title | string | – | – |
| last_name | string | – | – |
| middle_name | string | – | – |
| other_address | object | – | – |
| personal_notes | string | – | – |
| phone | string | – | – |
| phone_type | string | – | – |
| remove_emails | array | – | – |
| title | string | – | – |
No output schema declared.
No examples provided.
outlook_update_draft ~157
Update an existing draft (partial patch). Pass is_html=True when body is HTML — required when overwriting a draft originally composed as HTML (consumer Outlook rejects Text-over-HTML PATCH). Pass reply_to=[...] to overwrite Reply-To; reply_to=[] to clear it. Pass deferred_send_datetime (ISO 8601) to set the scheduled-send time; empty string clears it.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | – |
| cc | array | – | – |
| deferred_send_datetime | string | – | – |
| draft_id | string | yes | – |
| is_html | boolean | – | – |
| is_markdown | boolean | – | – |
| reply_to | array | – | – |
| subject | string | – | – |
| to | array | – | – |
No output schema declared.
No examples provided.
outlook_update_event ~383
Update fields on an existing event (partial patch — only provided fields change). `recurrence` takes the same shapes as outlook_create_event and converts a single event into a series, or replaces an existing series' pattern. Omit it to leave any recurrence alone; pass remove_recurrence=True to turn a series back into a single event, keeping the first occurrence's time (the two are mutually exclusive). `attendees` REPLACES the whole guest list (Graph has no add-one operation) and sends invitations to everyone on it plus cancellations to anyone dropped — pass the full intended list; [] removes everyone. `is_all_day` REQUIRES start and end in the same call, both on midnight boundaries. Patching a time keeps the zone the event is anchored in; pass `timezone` (with start and end) to re-anchor it somewhere else. A start, end or recurrence patch to a series with edited or deleted occurrences is refused, since Graph would discard them. Omitting an argument leaves it unchanged, so False and [] are instructions, not absences. `show_as` is Outlook's "Show as" — same values as outlook_create_event — and patches on its own; unlike is_all_day it needs nothing resent alongside it. `key` patches on its own too.
| Name | Type | Req | Description |
|---|---|---|---|
| attendees | array | – | – |
| body | string | – | – |
| end | string | – | – |
| event_id | string | yes | – |
| is_all_day | boolean | – | – |
| key | string | – | – |
| location | string | – | – |
| recurrence | – | – | – |
| remove_recurrence | boolean | – | – |
| show_as | string | – | – |
| start | string | – | – |
| subject | string | – | – |
| timezone | string | – | – |
No output schema declared.
No examples provided.
outlook_update_task ~69
Update fields on a To Do task (partial patch — only provided fields change).
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | – |
| due | string | – | – |
| importance | string | – | – |
| list_id | string | – | – |
| task_id | string | yes | – |
| title | string | – | – |
No output schema declared.
No examples provided.
outlook_upload_task_attachment ~108
Attach a local file to a To Do task via inline base64 POST (1 byte – 20 MiB). `file_path` resolves inside the configured attachments directory. Larger files are refused up front: Graph caps the request body at 30 MB and base64 inflates the file 4/3, so 20 MiB is the honest ceiling.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | – |
| list_id | string | – | – |
| task_id | string | yes | – |
No output schema declared.
No examples provided.
outlook_whoami ~23
Get the authenticated user's profile (display name, email, ID).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Outlook MCP server?
Outlook MCP runs locally as a PyPI package, launched with uvx outlook-graph-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · outlook-graph-mcp
claude mcp add mpalermiti-outlook-mcp -- uvx outlook-graph-mcp
What is the Outlook MCP server?
Outlook MCP is listed in the public MCP registry as io.github.mpalermiti/outlook-mcp. Microsoft Outlook personal accounts: mail, rules, calendar, contacts, to-do, drafts (77 tools). This page covers its PyPI package (outlook-graph-mcp).
Is the Outlook MCP server safe to use?
Outlook MCP scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Outlook MCP server expose?
Outlook MCP exposes 71 tools: outlook_auth_status, outlook_list_inbox, outlook_read_message, outlook_read_messages, outlook_search_mail, and 66 more. Their descriptions and schemas cost roughly 7,269 tokens of context every time the server is loaded.
Is the Outlook MCP server still maintained?
Outlook MCP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Outlook MCP server under?
Outlook MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.