README accuracy pass: fix mcp-remote header pattern, add skill install steps

The Desktop config examples showed an inline 'Authorization: Bearer ...' header, which Claude Desktop breaks by splitting args on spaces — replace with the verified env-var pattern (Authorization:${MCP_AUTH_HEADER}, no space). Also: document how the skill is installed/discovered in Claude Code, note the person command in the CLI summary, and correct /health description (it now reports the secret-expiry countdown).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -20,7 +20,7 @@ The repo ships the same capability in two forms, sharing one core Graph client
 │   ├── SKILL.md                         # how the skill works + usage
 │   ├── .env.example                     # credential template (.env is git-ignored)
 │   ├── scripts/
-│   │   ├── sp.mjs                       # CLI: test|lists|columns|items|get|create|update|delete
+│   │   ├── sp.mjs                       # CLI: test|lists|columns|items|get|person|create|update|delete
 │   │   └── lib/graph.mjs                # shared, dependency-free Graph client (single source of truth)
 │   └── references/
 │       ├── setup.md                     # Azure AD (Entra) app registration walkthrough
@@ -48,6 +48,12 @@ Credentials live only in git-ignored `.env` files — **never commit secrets.**
 
 ## Option A — the skill (Claude Code)
 
+**Install:** clone this repo and open it in Claude Code — skills under
+`.claude/skills/` are discovered automatically at session start (invokable as
+`/sharepoint-lists`). To use the skill in a *different* project, copy the
+`.claude/skills/sharepoint-lists/` folder into that project (or into
+`~/.claude/skills/` to make it available everywhere), then create its `.env`:
+
 ```bash
 cp .claude/skills/sharepoint-lists/.env.example .claude/skills/sharepoint-lists/.env
 # fill in SP_TENANT_ID / SP_CLIENT_ID / SP_CLIENT_SECRET (optionally SP_SITE_URL)
@@ -129,7 +135,7 @@ curl -s http://localhost:3838/health        # -> {"ok":true,...}
 The service has `restart: unless-stopped` and a healthcheck. The port publishes on
 all host interfaces; restrict it to a LAN IP in `docker-compose.yml` (or via
 firewall) if desired — the bearer token guards `/mcp` regardless. `/health` is
-intentionally open (liveness only, returns no data).
+intentionally open (liveness + secret-expiry countdown only; no secrets).
 
 Full hosting details: [mcp-server/README.md](mcp-server/README.md).
 
@@ -163,16 +169,19 @@ server automatically.
         "-y", "mcp-remote",
         "http://<host>:3838/mcp",
         "--allow-http",
-        "--header", "Authorization: Bearer ${SP_MCP_TOKEN}"
+        "--header", "Authorization:${MCP_AUTH_HEADER}"
       ],
-      "env": { "SP_MCP_TOKEN": "<your MCP_AUTH_TOKEN>" }
+      "env": { "MCP_AUTH_HEADER": "Bearer <your MCP_AUTH_TOKEN>" }
     }
   }
 }
 ```
 
 `--allow-http` permits a plain-HTTP LAN URL; the token must match the container's
-`MCP_AUTH_TOKEN`. Fully quit and reopen Claude Desktop after editing the config.
+`MCP_AUTH_TOKEN`. Note the header value is passed via the env var (including the
+`Bearer ` prefix) and there is **no space after `Authorization:`** — Claude
+Desktop splits config args on spaces, so an inline `Bearer <token>` breaks.
+Fully quit and reopen Claude Desktop after editing the config.
 
 ---
 

mcp-server/README.md

@@ -91,16 +91,18 @@ Desktop:
         "-y", "mcp-remote",
         "http://192.168.101.12:3838/mcp",
         "--allow-http",
-        "--header", "Authorization: Bearer ${SP_MCP_TOKEN}"
+        "--header", "Authorization:${MCP_AUTH_HEADER}"
       ],
-      "env": { "SP_MCP_TOKEN": "<your MCP_AUTH_TOKEN>" }
+      "env": { "MCP_AUTH_HEADER": "Bearer <your MCP_AUTH_TOKEN>" }
     }
   }
 }
 ```
 
 `--allow-http` permits the plain-HTTP LAN URL (no TLS). The token must match the
-container's `MCP_AUTH_TOKEN`.
+container's `MCP_AUTH_TOKEN`. The header value goes through the env var (with the
+`Bearer ` prefix) and there is **no space after `Authorization:`** — Claude
+Desktop splits config args on spaces, so an inline `Bearer <token>` breaks.
 
 ### Claude Desktop → local stdio (no container)
 
@@ -124,6 +126,7 @@ The repo-root `.mcp.json` registers the local stdio server automatically.
 - App-only auth = the server has full access to the granted SharePoint sites
   with no per-user check. Anyone who can reach an unauthenticated `/mcp` has that
   access — always set `MCP_AUTH_TOKEN` for the HTTP transport.
-- `/health` is intentionally unauthenticated (liveness only; returns no data).
+- `/health` is intentionally unauthenticated (liveness + secret-expiry countdown
+  only; no secrets).
 - Field formats for writes (person/lookup/choice/date) are in
   `../.claude/skills/sharepoint-lists/references/graph-api.md`.