outlook-mcp
outlook-mcp is an MCP server that lets AI assistants interact with Microsoft Outlook email and calendar (and optionally SharePoint files) via the Microsoft Graph API. It supports reading/searching/sending emails, managing calendar events, downloading/parsing attachments and SharePoint files, and saving large downloads to a local work directory to avoid MCP response size limits.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Uses OAuth 2.0 with PKCE and states tokens are encrypted and stored via OS keychain when available. However, the README indicates multiple high-privilege delegated scopes (Mail.ReadWrite, Mail.Send, Files/Sites/Calendars read-write), which increases blast radius if an agent is misconfigured. Rate limiting and operational safety controls (tool-level least-privilege, idempotency, explicit retry/backoff guidance) are not documented here. Dependency list includes several third-party packages; no vulnerability/CVE or maintenance policy is provided in the provided data.
⚡ Reliability
Best When
You want an MCP-compatible agent toolchain to access the user’s Outlook/Graph data with OAuth (PKCE) authentication and you’re comfortable with Microsoft Graph permission setup.
Avoid When
You cannot tolerate local token storage/encryption tradeoffs, large-file disk writes, or you cannot obtain the necessary Graph delegated permissions.
Use Cases
- • Read and summarize emails and threads
- • Search for emails by sender/subject/date and retrieve attachments
- • Draft, reply to, and send emails from an assistant
- • View and manage calendar events (read/plan/schedule)
- • Download and extract text from common office documents attached to emails
- • Fetch and summarize SharePoint files via sharing links or IDs
Not For
- • Highly sensitive environments that cannot grant broad Microsoft Graph permissions
- • Use as a general-purpose Outlook API client outside the MCP ecosystem
- • Workloads requiring strict guarantees of idempotency for send/update operations (not documented)
Interface
Authentication
Delegated Microsoft Graph permissions are configured in the Azure App registration. README states no client secret is required (PKCE flow) and that tokens are encrypted and stored locally (OS keychain if available, otherwise encrypted file storage).
Pricing
No usage pricing described for the package itself. Costs would primarily be due to Azure/Microsoft Graph tenant configuration and any underlying Graph consumption constraints.
Agent Metadata
Known Gotchas
- ⚠ Graph permission consent may be required/admin consent might be needed depending on tenant policies
- ⚠ MCP response size limits require local disk space for large attachments/SharePoint downloads; ensure MCP_OUTLOOK_WORK_DIR is set and writable
- ⚠ Token reset may be needed if auth fails; stored tokens are kept locally and may need clearing
- ⚠ Delegated permissions requested are broad (Mail.ReadWrite/Files.*.ReadWrite/Sites.*.ReadWrite), so agents should be constrained by prompt/tool policy to avoid unintended actions
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for outlook-mcp.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-30.