Labsco
MCP SERVER

Microsoft Planner MCP

by aixolotl ↗

Read and change Microsoft Planner from an assistant — plans, buckets and basic tasks — through Microsoft Graph with per-client OAuth consent.

Project & Task Management
Summary
The consent prompt is on by default, and that is the right default.

Requiring each new client to be explicitly approved is a deliberate defence against a confused-deputy problem, and it costs one click. The tool annotations are the other quiet quality signal: reads are marked so clients stop asking, deletes are marked so clients keep asking. Scope note worth knowing up front — basic Planner tasks and plans only.

What it is

An MCP server over Microsoft Planner via the Graph API. You register an Azure Entra ID application, and the server handles the OAuth flow, so an assistant can list what is overdue, create a task in the right plan, move work between buckets and mark things complete. Read-only tools carry `readOnlyHint: true` so clients can skip confirmation, and deletes carry `destructiveHint: true` so they do not.

What you get
  • The signed-in user's profile, and Microsoft 365 users resolved by GUID, email or free-text search — which is what turns an assignment GUID into a name — `get_me`, `list_users`
  • The groups you belong to, since a Planner plan is owned by an M365 group — `list_my_groups`
  • Plans listed for you or for a group, created, and deleted with an ETag — `list_my_plans`, `list_group_plans`, `create_plan`, `delete_plan`
  • Buckets listed and created within a plan — `list_buckets`, `create_bucket`, `delete_bucket`
  • Tasks listed across your plans or within one, opened in detail, created, updated and deleted — `list_my_tasks`, `list_tasks`, `get_task_details`, `create_task`, `update_task`, `delete_task`
  • The plan's categories and the available task fields, so the agent works from the real schema — `list_plan_categories`, `list_task_fields`
  • Field selection on most read tools via `select`, with `*all` when you want everything
Requirements

A Microsoft 365 account with Planner access and an Azure Entra ID app registration you create yourself — the README walks the six steps, including exposing an API scope and setting the token version. Three values are required: `CLIENT_ID`, `CLIENT_SECRET` and `TENANT_ID`, plus `BASE_URL` for the OAuth redirect and `ALLOWED_ORIGINS` as a JSON list. Python 3.12+ with `uv`, or Docker. `REQUIRE_AUTHORIZATION_CONSENT` defaults to true and makes each new MCP client be approved explicitly — the README says to keep it that way in production to prevent confused-deputy attacks, and only turn it off for local development with throwaway clients. Rate limiting defaults to 120 requests per 1 minute per client. The server supports Planner basic tasks and plans, not the premium features.

Setup effort

One command plus a key — docker pull ghcr.io/aixolotl/microsoft-planner-mcp:latest, then supply credentials