# sharepoint-lists MCP server

An [MCP](https://modelcontextprotocol.io) server exposing Microsoft SharePoint
Lists as tools, using app-only (client-credentials) Microsoft Graph auth. It
reuses the same core client as the skill
(`../.claude/skills/sharepoint-lists/scripts/lib/graph.mjs`) — one source of
truth for the Graph logic.

## Tools

| Tool | Access | Purpose |
|---|---|---|
| `sharepoint_test` | read | Verify credentials; with a site, list its lists |
| `sharepoint_list_lists` | read | Enumerate lists in a site |
| `sharepoint_get_columns` | read | Column internal names + types (call before writing) |
| `sharepoint_list_items` | read | Query items (filter/select/orderby/top/all) |
| `sharepoint_get_item` | read | Get one item by id |
| `sharepoint_create_item` | write | Create an item |
| `sharepoint_update_item` | write | Update an item (partial) |
| `sharepoint_delete_item` | write | Delete an item (irreversible) |

Set `SP_READONLY=true` to register only the read tools.

## Setup

```bash
cd mcp-server
npm install
cp .env.example .env      # then fill in SP_TENANT_ID / SP_CLIENT_ID / SP_CLIENT_SECRET
```

Credentials and the optional `SP_SITE_URL` default are documented in
`../.claude/skills/sharepoint-lists/references/setup.md`.

## Run

**stdio** (Claude Desktop / Claude Code / Cowork — local):

```bash
npm start            # node index.mjs
```

**Streamable HTTP** (for a hosted/remote connector):

```bash
npm run start:http   # node index.mjs --http   → http://localhost:3838/mcp
```

## Connect it

### Claude Code
A project `.mcp.json` at the repo root already registers this server. From the
repo root, Claude Code will offer to start it (approve the prompt). Ensure
`mcp-server/.env` is filled in first.

### Claude Desktop (stdio)
Add to `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "sharepoint-lists": {
      "command": "node",
      "args": ["/absolute/path/to/Claude-SharepointLists/mcp-server/index.mjs"]
    }
  }
}
```

### Claude.ai web (remote connector)
Run with `--http` and expose it over **HTTPS** with authentication (a reverse
proxy / tunnel, plus typically OAuth). claude.ai cannot reach `localhost`, and
custom connectors expect an authenticated HTTPS MCP endpoint — see the repo
README's "Remote hosting" notes before exposing this publicly.

## Notes

- App-only auth means there is no per-user permission check — every caller of
  this server acts as the app. Don't expose it unauthenticated.
- Field formats for writes (person/lookup/choice/date) are documented in
  `../.claude/skills/sharepoint-lists/references/graph-api.md`.