Enables reading and searching Microsoft SharePoint content via the Graph API, including sites, document libraries, folders, and files. Also provides admin tools for configuration and token management.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
process.env. You'll be asked to provide them before it can run.APP_NAME— defaults to sharepoint.MCP_ADMIN_AUTH_KEY— If is configured, mutating tools require authorizationKey.MCP_ALLOW_SENSITIVE_OUTPUT— Sensitive fields are redacted unless =true.MCP_CONFIG_DEFAULT_USER_ID— MCP config tools accept optional userId; when omitted, is used.MCP_HTTP_OAUTH2_CLIENT_IDMCP_HTTP_OAUTH2_CLIENT_SECRETMCP_HTTP_OAUTH2_INTROSPECTION_URLMCP_HTTP_OAUTH2_REQUIRED_AUDIENCEMCP_HTTP_TLS_CERT_PATHMCP_HTTP_TLS_KEY_PATHMCP_HTTP_VAULT_TOKEN_INDEX_PATH— Store HTTP bearer tokens in Vault at .MCP_HTTP_VAULT_TOKEN_REQUIRED_AUDIENCE— MCP_HTTP_VAULT_TOKEN_REQUIRED_SCOPES and enforce policy checks.MCP_SERVER_NAMEMCP_SERVER_VERSIONMCP_TOKEN_ROTATION_DEFAULT_INTERVAL_MS— Global default env variable:MCP_TOKEN_ROTATION_USER_INTERVAL_CONFIG_KEY— User-scoped config key name: (default token.rotation.intervalMs)POSTGRES_CONFIG_TABLEPOSTGRES_DB— POSTGRES_HOST, POSTGRES_PORT, , POSTGRES_USER, POSTGRES_PASSWORDPOSTGRES_HOST— , POSTGRES_PORT, POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORDPOSTGRES_PASSWORD— POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DB, POSTGRES_USER,POSTGRES_PORT— POSTGRES_HOST, , POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORDPOSTGRES_USER— POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DB, , POSTGRES_PASSWORDSHAREPOINT_ACCESS_TOKEN— 2. environment variable.VAULT_ADDR— docker exec -e =http://127.0.0.1:8200 sharepoint-mcp-vault vault operator init -key-shares=1 -key-threshold=1 -format=jsonVAULT_AGENT_AUTH_MODE— (none, file, listener, both)VAULT_AGENT_ENABLED— Enable with =trueVAULT_AGENT_LISTENER_ADDR— Configure listener withVAULT_AGENT_LISTENER_ENABLED— Enable listener with =trueVAULT_AGENT_TOKEN_FILE_PATH— Configure sink file path withVAULT_KV_MOUNTVAULT_TOKEN— VAULT_ADDR,VAULT_UNSEAL_KEY— [scripts/vault-unseal-key.js](scripts/vault-unseal-key.js): Script to resolve unseal key from or src/config/vault.unseal.key.json.VAULT_WRITE_RETRY_ATTEMPTSVAULT_WRITE_RETRY_BASE_DELAY_MSVAULT_WRITE_RETRY_MAX_DELAY_MS[](https://m8ven.ai/mcp/lesterajohn-sharepoint-mcp-1mrknj)