X1pheR/ms365-mcp (X1pheR/ms365-mcp) is an MCP server listed on the M8ven Trust Index. It scores 89 out of 100, grade B. It declares 3 tools. The publisher has proved control of what we score (Verified Publisher). It is connected through the M8ven GitHub App, so the listing is re-checked on every push.

Back to MCP Trust IndexM8ven
B
Caution
89/100
5 days ago

X1pheR/ms365-mcp

Community-maintained container distribution for @softeria/ms-365-mcp-server with reproducible builds and release validation.

→ X1pheR/ms365-mcp

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored

Monitored 14 days · every push re-verified

Who stands behind it

live.nl (@X1pheR) · Verified Publisher

Source: github_app_install

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
Are you the publisher? Confirm or correct these findings.
// quality suggestions

All four hints declared on every tool

3/3 tools missing one or more hints — save-mail-attachment (missing: idempotentHint); promote-mail-attachment (missing: idempotentHint); cleanup-mail-attachment (missing: idempotentHint). OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

2 tools perform destructive updates without destructiveHint — save-mail-attachment deletes at line 363 (fs.rm(directory, { recursive: true, force: true })); promote-mail-attachment deletes at line 465 (fs.unlink(tempPath))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/x1pher/ms365-mcp?variant=verified)](https://m8ven.ai/mcp/x1pher/ms365-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: c793161996cf1a6cef6f02b27dd1623728aceffa
code hash: 660ce8492e61de8debe43bad754dfde42bcea4264c52a08faa4283e5941f2629
verified: 9/5/2026, 2:16:06 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client