v0.1.0 — First stable release (read-only mail)

v0.1.0 — First stable release (read-only mail)

First tagged release of outlook-mcp-suite: a Go-based MCP server that
exposes the Microsoft Graph mail API to MCP-compatible clients.

What's included

11 tools, all read-only, all backed by httptest smoke coverage:

Tool	Purpose
list_messages	List messages in a folder (or top-level)
get_message	Fetch a single message by ID with optional $select
search_messages	KQL search across the mailbox
list_folders	Top-level or child mail folders
get_folder	Folder metadata (display name, counts)
list_categories	Outlook master categories
list_attachments	Attachment metadata for a message
get_attachment	Single attachment (size-capped)
list_rules	Inbox message rules
get_user_profile	Current user profile (/me)
get_mailbox_settings	Timezone and auto-reply settings

Authentication

OAuth 2.0 device-code flow. You bring your own Azure AD app registration
and bearer token — this server never stores credentials. See
docs/onboarding-real-account.md for the 8-step walkthrough against a
real Microsoft 365 / Outlook.com account.

Safety

• get_attachment enforces a hard cap (MaxAttachmentBytes, default 25 MiB)
  and rejects oversize payloads post-decode.
• All HTTP errors propagate with the Graph status code and error message
  preserved in the returned error string.
• Every public method rejects an empty bearer token at the call boundary
  (regression-guarded by TestBearerRequired_AllMethods).

Testing

cd graph/outlook-mcp-go
go test ./internal/mail/...   # 24 PASS, ~0.2s

24 tests cover request shape, headers, JSON envelope decoding, error
propagation, and the size-cap guard. No real Microsoft account is required
to run them.

Out of scope (this release)

• Write operations (send, move, delete, mark-as-read) — planned for 0.2.
• Calendar endpoints.
• Contacts / People.
• Playwright automation fallback for tenants without admin consent.

License

Apache 2.0. See LICENSE.

Contributing

See CONTRIBUTING.md.