Claude-SharepointLists/mcp-server

sharepoint-lists MCP server

An MCP server exposing Microsoft SharePoint Lists as tools, using app-only (client-credentials) Microsoft Graph auth. It reuses the same core client as the skill (../.claude/skills/sharepoint-lists/scripts/lib/graph.mjs) — one source of truth for the Graph logic.

Tools

Tool	Access	Purpose
sharepoint_test	read	Verify credentials; with a site, list its lists
sharepoint_list_lists	read	Enumerate lists in a site
sharepoint_get_columns	read	Column internal names + types (call before writing)
sharepoint_list_items	read	Query items (filter/select/orderby/top/all)
sharepoint_get_item	read	Get one item by id
sharepoint_create_item	write	Create an item
sharepoint_update_item	write	Update an item (partial)
sharepoint_delete_item	write	Delete an item (irreversible)

Set SP_READONLY=true to register only the read tools.

Setup

cd mcp-server
npm install
cp .env.example .env      # then fill in SP_TENANT_ID / SP_CLIENT_ID / SP_CLIENT_SECRET

Credentials and the optional SP_SITE_URL default are documented in ../.claude/skills/sharepoint-lists/references/setup.md.

Run

stdio (Claude Desktop / Claude Code / Cowork — local):

npm start            # node index.mjs

Streamable HTTP (for a hosted/remote connector):

npm run start:http   # node index.mjs --http   → http://localhost:3838/mcp

Connect it

Claude Code

A project .mcp.json at the repo root already registers this server. From the repo root, Claude Code will offer to start it (approve the prompt). Ensure mcp-server/.env is filled in first.

Claude Desktop (stdio)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "sharepoint-lists": {
      "command": "node",
      "args": ["/absolute/path/to/Claude-SharepointLists/mcp-server/index.mjs"]
    }
  }
}

Claude.ai web (remote connector)

Run with --http and expose it over HTTPS with authentication (a reverse proxy / tunnel, plus typically OAuth). claude.ai cannot reach localhost, and custom connectors expect an authenticated HTTPS MCP endpoint — see the repo README's "Remote hosting" notes before exposing this publicly.

Notes

• App-only auth means there is no per-user permission check — every caller of this server acts as the app. Don't expose it unauthenticated.
• Field formats for writes (person/lookup/choice/date) are documented in ../.claude/skills/sharepoint-lists/references/graph-api.md.