---
name: outlook
description: Microsoft 365 / Outlook.com via Microsoft Graph (read-only first cut). Per-account OAuth Auth Code + PKCE; no client secret. Tools — outlook-account-register: PKCE register; outlook-mail-list / outlook-mail-search: inbox; outlook-calendar-list / outlook-calendar-event: calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count.
tools:
  - name: outlook-account-register
    publicAllowlist: false
    adminAllowlist: false
  - name: outlook-mail-list
    publicAllowlist: false
    adminAllowlist: false
  - name: outlook-mail-search
    publicAllowlist: false
    adminAllowlist: false
  - name: outlook-calendar-list
    publicAllowlist: false
    adminAllowlist: false
  - name: outlook-calendar-event
    publicAllowlist: false
    adminAllowlist: false
  - name: outlook-contacts-list
    publicAllowlist: false
    adminAllowlist: false
  - name: outlook-mailbox-info
    publicAllowlist: false
    adminAllowlist: false
always: false
embed: ["admin"]
metadata: {"platform":{"optional":true}}
mcp:
  command: node
  args:
    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
    - ${PLATFORM_ROOT}/plugins/outlook/mcp/dist/index.js
  env:
    MCP_SPAWN_TEE_NAME: outlook
    LOG_DIR: ${LOG_DIR}
    PLATFORM_ROOT: ${PLATFORM_ROOT}
    ACCOUNT_ID: ${ACCOUNT_ID}
    SESSION_ID: ${SESSION_ID}
mcp-manifest: auto
---

# Outlook

Read-only Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes. Admin agent only — public agent surface is explicitly excluded.

## Capabilities

- **Register:** `outlook-account-register` — initiates OAuth Auth Code + PKCE flow against the operator's Entra app. Returns an authorization URL the operator opens in the VNC browser to consent. Tokens persist per-account, encrypted on disk (AES-256-CBC).
- **Mail (read-only):** `outlook-mail-list` returns recent messages; `outlook-mail-search` runs a Graph `$search` query.
- **Calendar (read-only):** `outlook-calendar-list` returns events in a future range; `outlook-calendar-event` returns a single event with full body + attendees.
- **Contacts (read-only):** `outlook-contacts-list` returns contacts.
- **Health:** `outlook-mailbox-info` reports auth state, refresh-window status, and top-level folder count. Use this to answer "did account X auth?" without grepping logs.

## Out of scope

- Send / draft / move / flag — write surfaces are deferred to a follow-up task.
- OneDrive, Files, Sites — separate plugin; different endpoints.
- Push notifications via `/subscriptions` — first cut polls.
- On-premises Exchange — Microsoft Graph deprecated hybrid REST 2023-07. The plugin detects on-prem mailboxes and routes the operator to the IMAP path (`email` plugin).
- M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`) — separate plugin.

## References

| Reference | Topics |
|-----------|--------|
| [auth.md](references/auth.md) | Entra app registration, PKCE flow, vendored upstream SHA, re-vendor procedure |
| [graph-surfaces.md](references/graph-surfaces.md) | Graph endpoint and response shape per tool |

## Skills

| Skill | Purpose |
|-------|---------|
| [outlook](skills/outlook/SKILL.md) | When to activate; how to register a new Outlook account |
