Labsco
MCP SERVER

Microsoft To Do MCP

by jordanburke ↗

Read and write Microsoft To Do from a chat client — lists, tasks with due dates and importance, and subtasks — over Microsoft Graph with automatic token refresh.

Project & Task Management
Summary
The whole To Do surface, once Azure is set up.

Lists, tasks and subtasks are all covered with real create-read-update-delete rather than a read-only view, and the OData parameters mean filtering happens on Microsoft's side instead of in the model's context. The cost is front-loaded: an Azure App Registration with consented Graph permissions, done once before anything works.

What it is

An MCP server for Microsoft To Do built on the Microsoft Graph v1.0 endpoints, authenticating through OAuth 2.0 with the PKCE flow. It covers the full shape of the product: task lists, tasks with their properties, and the checklist items beneath a task.

What you get
  • Task lists retrieved with their metadata, then created, renamed or deleted — `get-task-lists`, `create-task-list`, `update-task-list`, `delete-task-list`
  • Tasks filtered, sorted and paged with OData parameters `$filter`, `$select`, `$orderby`, `$top`, `$skip` and `$count` — `get-tasks`
  • Tasks written with title, description, due date, start date, importance, reminders, status and categories — `create-task`, `update-task`, `delete-task`
  • Subtasks under a task listed, added, edited for text or completion, and removed — `get-checklist-items`, `create-checklist-item`, `update-checklist-item`, `delete-checklist-item`
  • Current authentication state, token expiry and account type — `auth-status`
Requirements

An Azure App Registration you create yourself, with delegated `Tasks.Read`, `Tasks.ReadWrite` and `User.Read` granted admin consent and a redirect URI of exactly `http://localhost:3000/callback`. `CLIENT_ID`, `CLIENT_SECRET` and `TENANT_ID` go in `.env`; `TENANT_ID` takes `organizations`, `consumers`, `common`, or a specific tenant id. Tokens land in `tokens.json` and refresh 5 minutes before expiry — `MSTODO_TOKEN_FILE` relocates that file, and `MS_TODO_ACCESS_TOKEN` / `MS_TODO_REFRESH_TOKEN` pass them in directly. Node.js 16 or higher; the npm package is `microsoft-todo-mcp-server` at 1.1.3 and also installs as `mstodo`. Personal outlook.com, hotmail.com and live.com accounts hit a Microsoft-side limit and can return `MailboxNotEnabledForRESTAPI`; work and school accounts have full API access.

Setup effort

One command plus a key — npm install -g microsoft-todo-mcp-server, then supply credentials