# @chrischall/office-outlook-mcp

Outlook / Microsoft 365 for Claude — mail, calendar, contacts and tasks, with confirm-gated sending

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 0.1.4
- **Author:** io.github.chrischall
- **License:** MIT
- **npm:** @chrischall/office-outlook-mcp
- **Source:** https://github.com/chrischall/office-outlook-mcp
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-23T00:28:13.415Z
- **Version scanned:** 0.1.4
- **CVEs:** none found by OSV at scan time

## Tools

17 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `outlook_list_events` — List calendar events in a date window. This uses the calendar VIEW, which expands recurring series into their individual occurrences — the right tool for "what 
- `outlook_get_event` — Get one calendar event in full, including attendees and their responses.
- `outlook_list_calendars` — List the calendars in the mailbox, for picking one to read or write against.
- `outlook_get_profile` — Get the signed-in mailbox's identity (email address, display name, alias). The cheapest call that proves the credential works.
- `outlook_get_mailbox_settings` — Get mailbox settings: time zone, working hours, language, and automatic-replies (out-of-office) configuration.
- `outlook_list_contacts` — List saved contacts from the mailbox address book.
- `outlook_list_people` — List people ranked by relevance to the user — colleagues and frequent correspondents, drawn from mail traffic rather than the saved address book. Better than ou
- `outlook_list_tasks` — List Outlook tasks with status and due dates.
- `outlook_list_folders` — List mail folders with unread and total counts. Use this to discover folder ids before listing messages; the well-known names (
- `outlook_list_messages` — List messages in a folder, newest first. Defaults to the inbox. Use `unreadOnly` for a triage view. Bodies are NOT included — call outlook_get_message for one. 
- `outlook_get_message` — Get one message including its body. The body is requested as plain text rather than HTML (measured ~9x smaller and far easier to read); pass view:"raw" to get O
- `outlook_list_attachments` — List a message's attachments (name, size, content type). Metadata only — this deliberately does not download bytes.
- `outlook_send_mail` — Send an email from the signed-in mailbox. Requires confirm:true — without it this makes no network call and returns a preview of exactly what would be sent.
- `outlook_create_draft` — Create a draft message in the Drafts folder without sending it. Requires confirm:true. Returns the created draft, which can be reviewed and sent from Outlook.
- `outlook_mark_read` — Mark a message read or unread. Requires confirm:true. The result is verified by re-reading the message — a 2xx alone is not proof it persisted.
- `outlook_move_message` — Move a message to another folder (e.g. "archive", "deleteditems", or a folder id from outlook_list_folders). Requires confirm:true. Moving assigns a NEW message
- `outlook_create_event` — Create a calendar event. Requires confirm:true. `timeZone` takes a WINDOWS zone name such as "Eastern Standard Time", not an IANA name.

## Install

**Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"office-outlook\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@chrischall/office-outlook-mcp\"\n      ],\n      \"env\": {\n        \"OUTLOOK_ACCESS_TOKEN\": \"<YOUR_OUTLOOK_ACCESS_TOKEN>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `OUTLOOK_ACCESS_TOKEN` — Outlook Access Token (optional)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Extensive blast radius — mutates data; holds an api key.
- Floor 45, ceiling 45 (tier: extensive)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40chrischall%2Foffice-outlook-mcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40chrischall%2Foffice-outlook-mcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40chrischall%2Foffice-outlook-mcp
- HTML page: https://forgeregistry.com/registry/%40chrischall%2Foffice-outlook-mcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.