Bulk actions by search and large attachments

Added

• bulk_action tool: apply delete, move, archive, markRead, markUnread, flag or unflag to the messages matching a KQL query or filters. It runs as a dry run by default (count and a sample of 10), processes up to max messages (default 100, hard cap 500) and reports per-message results, including the new id of each moved message.
• send_mail and create_draft accept attachments of 3 MB up to 150 MB through Graph upload sessions, streamed from disk in chunks. If an upload fails, send_mail deletes its draft and sends nothing; create_draft keeps the draft and lists the attachments that failed.

Prompt-injection hardening, keychain token storage and mail_digest

Added

• README setup for OpenAI Codex (codex mcp add and config.toml) and other MCP clients.
• OUTLOOK_TOKEN_STORE (auto, keychain, file; default auto): the token cache is kept in the macOS Keychain (security CLI) or the Linux Secret Service (secret-tool) when available, with no native dependencies. An existing cache file is imported into an empty keychain and deleted; logout clears both. Windows and systems without a keychain keep using the file.
• mail_digest tool (read-only): counts, high-importance and flagged messages, and messages grouped by sender with a newsletter hint for a folder and time window.
• Server-level MCP instructions telling clients that email content is untrusted and that sending, deleting, unsubscribing and rule changes should be confirmed with the user.
• Tests for tool handlers using a fake Graph client.

Changed

• Tool results that include message content now group sender-controlled text (subjects, senders, previews, attachment names) under an untrusted key instead of top-level subject, from, preview and name fields. This affects list_messages, search_messages, get_message, list_attachments, find_newsletters, get_unsubscribe_info and unsubscribe. download_attachment now returns the saved path as untrusted.savedTo (it contains the sender-chosen file name) instead of a top-level savedTo.

Security

• Prompt-injection hardening: get_message bodies are enclosed in <untrusted_email_content> markers (with look-alike markers inside the content neutralized), results carry a note that email content is untrusted data, and tool descriptions say so.
• The token cache is stored in the OS keychain by default where one is available, instead of a file. Secrets are passed to secret-tool and security -i over stdin, never as command-line arguments.

Listed in the MCP Registry

Added

• Listed in the official MCP Registry as io.github.Pepebits/outlook-mcp (mcpName and server.json).

Changed

• Releases are staged on npm with provenance through Trusted Publishing and approved by a maintainer before they go live.

First stable release, now on npm

Added

• Published to npm as @pepebits/outlook-mcp: install with npx -y @pepebits/outlook-mcp.
• Shared default Azure app for personal Microsoft accounts, so no app registration or .env file is needed.

Changed

• OUTLOOK_CLIENT_ID is now optional. Set it (and OUTLOOK_TENANT) only to use your own Azure app, for example with work or school accounts.

Fixed

• create_rule and block_sender return the rule that was created. On personal mailboxes Graph's response could describe a different, existing rule.

Bulk actions, newsletter cleanup, inbox rules and in-chat login

Added

• login, auth_status and logout tools: sign in and out from the MCP client without a terminal. login returns the device code URL and code, and sign-in completes in the background.
• get_unsubscribe_info and unsubscribe tools: read List-Unsubscribe headers and leave a mailing list by RFC 8058 one-click or a mailto request.
• Bulk operations: delete_message, move_message, mark_read, flag_message and unsubscribe accept ids (up to 50) as an alternative to id, report per-message results and never stop on the first error.
• find_newsletters tool: groups a folder's messages by sender and reports which senders are mailing lists and how to unsubscribe.
• Inbox rule tools list_rules, create_rule, delete_rule and block_sender.
• MailboxSettings.ReadWrite is now part of the default OUTLOOK_SCOPES. Add it in the Azure app registration and run npm run auth again.

Changed

• Node.js 24 (LTS) or newer is now required.
• CI workflow actions updated.

Fixed

• list_messages with from no longer fails with InefficientFilter when sorted by date.
• unsubscribe returns the unsubscribe link when the one-click request is refused, or fails with a network error or timeout.

Initial release

Features:

• Device code sign-in for personal and work Microsoft accounts
• List, search and read mail, download attachments
• Send, draft, reply, forward, move, flag and delete
• Optional read-only mode