LabscoMCP early access ↗
jordanburkeMCP SERVER

Microsoft To Do MCP

Read and write Microsoft To Do from a chat client — lists, tasks with due dates and importance, and subtasks — over Microsoft Graph with automatic token refresh.

by jordanburke ↗Project & Task ManagementCommunity

LABSCO SUMMARY

The whole To Do surface, once Azure is set up.

Lists, tasks and subtasks are all covered with real create-read-update-delete rather than a read-only view, and the OData parameters mean filtering happens on Microsoft's side instead of in the model's context. The cost is front-loaded: an Azure App Registration with consented Graph permissions, done once before anything works.

What it is

An MCP server for Microsoft To Do built on the Microsoft Graph v1.0 endpoints, authenticating through OAuth 2.0 with the PKCE flow. It covers the full shape of the product: task lists, tasks with their properties, and the checklist items beneath a task.

What you get

  • Task lists retrieved with their metadata, then created, renamed or deleted — get-task-lists, create-task-list, update-task-list, delete-task-list
  • Tasks filtered, sorted and paged with OData parameters $filter, $select, $orderby, $top, $skip and $count — get-tasks
  • Tasks written with title, description, due date, start date, importance, reminders, status and categories — create-task, update-task, delete-task
  • Subtasks under a task listed, added, edited for text or completion, and removed — get-checklist-items, create-checklist-item, update-checklist-item, delete-checklist-item
  • Current authentication state, token expiry and account type — auth-status

Requirements

An Azure App Registration you create yourself, with delegated Tasks.Read, Tasks.ReadWrite and User.Read granted admin consent and a redirect URI of exactly http://localhost:3000/callback. CLIENT_ID, CLIENT_SECRET and TENANT_ID go in .env; TENANT_ID takes organizations, consumers, common, or a specific tenant id. Tokens land in tokens.json and refresh 5 minutes before expiry — MSTODO_TOKEN_FILE relocates that file, and MS_TODO_ACCESS_TOKEN / MS_TODO_REFRESH_TOKEN pass them in directly. Node.js 16 or higher; the npm package is microsoft-todo-mcp-server at 1.1.3 and also installs as mstodo. Personal outlook.com, hotmail.com and live.com accounts hit a Microsoft-side limit and can return MailboxNotEnabledForRESTAPI; work and school accounts have full API access.

Setup effort

Follow the published steps

See installation options