Initial import: SharePoint Embedded MCP Server

.gitattributes

@@ -0,0 +1,11 @@
+# Normalize line endings to LF in the repository for all text files.
+# Prevents CRLF churn across Windows/macOS/Linux contributors.
+* text=auto eol=lf
+
+# Explicitly binary (no EOL normalization) for common binary assets.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.pdf binary

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# <!-- The @microsoft/sharepoint-embedded team handle must be confirmed by the repo owner. -->
+* @microsoft/sharepoint-embedded

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - feat/**
+
+permissions:
+  contents: read
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 22.x
+          - 24.x
+          - 26.x
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npm test

.github/workflows/security.yml

@@ -0,0 +1,45 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '0 12 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+          cache: npm
+      - run: npm ci
+      - run: npm audit --audit-level=high
+
+  secrets:
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # gitleaks-action@v2 requires a GITLEAKS_LICENSE when run under a GitHub
+      # organization (free only for personal accounts). Until the owner
+      # provisions the secret, this step is skipped so the workflow stays green;
+      # it is also continue-on-error as a belt-and-suspenders. Owner action:
+      # add GITLEAKS_LICENSE (or switch to GitHub Advanced Security secret
+      # scanning, which is available org-wide) — see SECURITY.md.
+      - name: Scan for secrets (gitleaks)
+        if: ${{ env.GITLEAKS_LICENSE != '' }}
+        continue-on-error: true
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITLEAKS_ENABLE_COMMENTS: "false"

.gitignore

@@ -0,0 +1,9 @@
+node_modules/
+dist/
+coverage/
+*.tgz
+
+# Sample app build outputs (the sample SOURCES under samples/ are committed)
+samples/**/bin/
+samples/**/obj/
+samples/**/.publish/

.vscode/mcp.json

@@ -0,0 +1,15 @@
+{
+  // SPE MCP server for this repo. Bootstrap mode uses your Azure CLI sign-in,
+  // so no Entra app is required:
+  //   1. az login --allow-no-subscriptions
+  //   2. npm run build
+  //   3. Click the 'Start' CodeLens above the "spe" entry below.
+  // Then ask Copilot Chat things like "List my SPE container types".
+  "servers": {
+    "spe": {
+      "type": "stdio",
+      "command": "node",
+      "args": ["${workspaceFolder:SharePoint-Embedded-MCP-Server}/dist/cli.js", "start"]
+    }
+  }
+}

CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project will be documented in this file. The format
+is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0-alpha.1]
+
+### Added
+
+- **Per-instance data directory.** New `--data-dir <path>` flag and `SPE_DATA_DIR`
+  environment variable select where the provisioning `state.json` and MSAL token
+  cache are stored (precedence: flag > env > default `~/.spe-mcp`). Point each
+  server instance at a unique directory to run multiple instances (e.g. two
+  tenants, or a published build alongside a local build) without clobbering
+  shared state. Applies uniformly to `start`, `auth`, and `logout`. The default
+  path is unchanged and byte-identical to prior releases.
+
+### Security
+
+- **Fail-closed credential/state file handling.** The data directory and token
+  cache files are now validated fail-closed: a symlinked, foreign-owned, or
+  group/other-accessible directory is refused (POSIX `0o700`); an off-`%USERPROFILE%`
+  Windows override is given an owner-only DACL or refused. Reads and writes use
+  `O_NOFOLLOW` + `fstat` fd verification and `fchmod` the descriptor (never the
+  path) to defeat symlink/TOCTOU swaps. A caller-supplied `--data-dir` must be an
+  absolute (or `~/`-relative) path; CWD-relative paths are rejected so credentials
+  can never be written into a working directory. On an insecure/unverifiable
+  target, refresh-token persistence is skipped (forcing a fresh interactive
+  sign-in) rather than writing a token to an unsafe location.
+
+## [0.1.0]
+
+Initial release.

CODE_OF_CONDUCT.md

@@ -0,0 +1,10 @@
+# Microsoft Open Source Code of Conduct
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+
+Resources:
+
+- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
+- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
+- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns
+- Employees can reach out at [aka.ms/opensource/moderation-support](https://aka.ms/opensource/moderation-support)

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to SharePoint Embedded MCP Server
+
+Thank you for your interest in contributing! This project welcomes contributions and
+suggestions.
+
+## Contributor License Agreement
+
+Most contributions require you to agree to a Contributor License Agreement (CLA)
+declaring that you have the right to, and actually do, grant us the rights to use your
+contribution. For details, visit <https://cla.opensource.microsoft.com>.
+
+When you submit a pull request, a CLA bot will automatically determine whether you need
+to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply
+follow the instructions provided by the bot. You will only need to do this once across
+all repositories using our CLA.
+
+## How to contribute
+
+1. Fork the repository and create your branch from `main`.
+2. Install dependencies: `npm install`.
+3. Make your change. Add or update tests alongside the code (`src/**/*.test.ts`).
+4. Validate locally: `npm run ci` (typecheck + test + build).
+5. Open a pull request describing the change and its motivation.
+
+## Code style
+
+- TypeScript, ES modules, strict mode. Run `npm run lint` and `npm run typecheck`
+  before opening a PR.
+- Each tool is a `{ name, description, inputSchema, handler }` export — see
+  "Adding New Tools" in the [README](README.md).
+
+## Code of Conduct
+
+This project has adopted the
+[Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the
+[Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact
+[opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or
+comments.
+
+## Reporting security issues
+
+Please report security issues privately as described in [SECURITY.md](SECURITY.md). Do
+not file public GitHub issues for security vulnerabilities.

LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+SharePoint Embedded MCP Server
+
+Copyright (c) Microsoft Corporation.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

PRIVACY.md

@@ -0,0 +1,57 @@
+# Privacy
+
+`@microsoft/spe-mcp` ("the tool") is an open-source Model Context Protocol (MCP)
+server that you run **locally** to manage **your own** SharePoint Embedded, Microsoft Graph,
+and Azure resources. This notice explains what the tool does and does not do with data. It is
+provided for transparency and does not replace the
+[Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) or your
+organization's agreements with Microsoft.
+
+## What the tool collects and sends
+
+**The tool does not collect telemetry or usage analytics, and it opens no dedicated channel
+to send data to Microsoft.** Specifically:
+
+- **No telemetry channel.** The tool does not implement application telemetry and does not
+  "phone home." Diagnostic logs are written to the local process's **stderr only**, with
+  tokens and secrets redacted (`src/logging.ts`), and are never transmitted by the tool.
+- **Authentication against your tenant.** You sign in with your own Microsoft Entra identity
+  via [MSAL](https://learn.microsoft.com/entra/identity-platform/msal-overview). Access and
+  refresh tokens are cached **locally** with owner-only file permissions (control
+  **SEC-003**). The tool does not send your tokens anywhere other than the standard Microsoft
+  authentication and API calls you initiate.
+- **API calls you initiate.** When you invoke a tool, the server calls Microsoft first-party
+  endpoints — Microsoft Graph and Azure Resource Manager — **on your behalf**, in **your**
+  tenant and subscription. The content and directory data involved flow between your machine
+  and those Microsoft services; the tool adds no additional recipients.
+- **Product `User-Agent`.** Outbound Graph/ARM requests are stamped with a static
+  `User-Agent` of the form `spe-mcp-server/<version>` (`src/user-agent.ts`). It contains
+  **no personal, tenant, or usage information** and exists only so the service can measure
+  aggregate traffic driven by this tool. It is a request header on calls you already make —
+  not a separate data feed.
+
+See [docs/DATA-FLOW.md](docs/DATA-FLOW.md) for the full list of network endpoints and what
+travels to each.
+
+## Service-side data handling
+
+Microsoft Graph, Azure, and SharePoint Embedded are Microsoft Online Services. Any data you
+create or access through them is handled under the
+[Microsoft Product Terms](https://www.microsoft.com/licensing/terms/), the
+[Microsoft Products and Services Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA),
+and the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement),
+according to your tenant's configuration (including any **EU Data Boundary** commitments).
+This tool does not change that handling.
+
+## Third-party MCP clients
+
+You connect the tool to an MCP client (for example VS Code, Claude Desktop, or Cursor). The
+prompts you type and the data the client displays are handled under **that client's** privacy
+terms, which are outside the control of this project.
+
+## Turning it off
+
+Because the tool has no telemetry channel, there is nothing to opt out of. To further limit
+outbound calls you can run with `--read-only` (no mutating operations) or `--tools` (restrict
+the exposed tool set, including the optional Microsoft Learn documentation lookup). See
+[docs/DATA-FLOW.md](docs/DATA-FLOW.md) and [docs/SECURITY-CONTROLS.md](docs/SECURITY-CONTROLS.md).