It authenticates as an application rather than as you, so search and file reads run unattended - and because the two permissions it asks for are the read-only pair, the most it can do is read.
A TypeScript MCP server over the Microsoft Graph API. It searches files across SharePoint, lists the sites the app registration can reach, opens a site's document libraries, walks folders inside them, and returns the contents of a text file. Sites are also exposed as resources under sharepoint://site/{siteId}.
- Files found across SharePoint through the Graph Search API
- The sites your app registration can reach, filtered by display name
- One site's details, from its URL
- The document libraries in a site
- The files and folders in a library, from the root or from a folder path
- The contents of a text file
An Azure app registration with Sites.Read.All and Files.Read.All granted as application permissions, with admin consent given - without the consent step the tools come back empty. Four environment variables: the SharePoint site URL, your tenant id, and the app's client id and secret. The permissions are read-only, and file contents are returned for text files only.