outlook-mcp/CHANGELOG.md
Seton Carmichael e70840552d feat(outlook-mcp): shared mailbox targeting, discovery, and scopes (v1.1.0)
Add optional mailbox (UPN/SMTP) routing on email/folder/thread tools via
users/{upn}/... and X-AnchorMailbox. New list-mailboxes probes primary,
OUTLOOK_SHARED_MAILBOXES seeds, cache, and candidates. Send supports
mailbox-rooted sendMail and onBehalfOf. MSAL requests Mail.*.Shared;
check-auth-status reports token scp gaps. Docs, env example, tests.
2026-08-24 08:41:05 -04:00

1.7 KiB

Changelog

1.1.0

Added

  • Shared/delegated mailbox support via optional mailbox (UPN/SMTP) on email, folder, and thread tools
  • Graph path routing me/...users/{upn}/... with X-AnchorMailbox header
  • list-mailboxes tool: primary + OUTLOOK_SHARED_MAILBOXES + cache + candidates[], non-destructive read/folder probes
  • Local mailbox probe cache (${tokenStore}.mailboxes.json or OUTLOOK_MAILBOX_CACHE_PATH)
  • send-email options: mailbox, from, onBehalfOf (mailbox-rooted send vs me-rooted send-on-behalf)
  • check-auth-status reports whether Mail.Read.Shared / Mail.ReadWrite.Shared / Mail.Send.Shared are on the token scp
  • Env: OUTLOOK_ENABLE_SHARED_MAILBOXES, OUTLOOK_SHARED_MAILBOXES, OUTLOOK_MAILBOX_CACHE_PATH, OUTLOOK_MAILBOX_PROBE_CONCURRENCY
  • Unit tests: tests/mailbox-path.test.js, tests/mailbox-send-path.test.js

Changed

  • Version bump to 1.1.0
  • Default MSAL scopes include shared mailbox delegated permissions when enabled
  • callGraphAPI accepts optional headers; queryParams copy no longer mutates caller $filter
  • read-email / read-emails no longer double-encode message IDs before path encoding
  • README: shared mailbox section, Azure shared scopes, env table updates

Notes / operator actions

  • Entra app registration needs new delegated permissions + admin consent
  • Existing users must re-run device-code authenticate after upgrade
  • Graph cannot enumerate all mailboxes a user can access; seed with env or EXO
  • Calendar and inbox rules remain primary-mailbox only in this release
  • sendAs capability is unverified until a successful send

1.0.1

Prior release: Graph empty-body write fix, timezone display/filters, search strict, folder list fixes, 429/503 retry/backoff.