# Teams MCP Server

The first open-source Microsoft Teams connector for Claude. Any Microsoft 365 user can connect — just sign in with your work account. No setup, no credentials, no self-hosting required.

Read messages, list channels, search across Teams, send messages — all from Claude Code, Claude Desktop, or Claude Cowork.

Built by [SurgeEnterpriseAI](https://github.com/SurgeEnterpriseAI).

## How It Works

```
┌─────────────┐     Click "Connect"     ┌──────────────────────┐
│ Claude User  │ ──────────────────────► │ Teams MCP Server     │
│ (Cowork/     │                         │ (hosted by Surge)    │
│  Desktop/    │     SSE/MCP Protocol    │                      │
│  Code)       │ ◄─────────────────────► │  ┌────────────────┐  │
└─────────────┘                          │  │ OAuth (common)  │  │
                                         │  │ Any M365 user   │  │
       User signs in with their          │  │ can sign in     │  │
       own Microsoft account             │  └───────┬────────┘  │
       ─────────────────────►            │          │           │
                                         │  ┌───────▼────────┐  │
                                         │  │ Microsoft       │  │
                                         │  │ Graph API       │  │
                                         │  └────────────────┘  │
                                         └──────────────────────┘
```

**The user connects their own Microsoft 365 account.** They see their own teams, their own channels, their own messages. Each user's tokens are isolated. The server is the bridge — it never stores messages, just passes them through.

## Features

- **One-click connect** — visit `/connect`, sign in with Microsoft, done
- **Multi-tenant** — any Microsoft 365 organization, any user
- **11 tools** — teams, channels, messages, chats, search, profile
- **Dual transport** — STDIO for Claude Code, HTTP/SSE for Cowork & remote
- **Multi-user** — each session gets isolated OAuth tokens
- **Auto-detect** — picks the right transport based on launch method
- **Token caching** — silent refresh, no re-login every session
- **Retry logic** — automatic retries on throttled Graph API calls
- **TypeScript** — fully typed, clean architecture, MIT licensed

## For Users: Connect in 1 Click

If someone is already hosting this server (e.g., on `https://teams-mcp.surgeai.com`):

1. Claude asks you to connect Microsoft Teams
2. You click the auth link
3. Sign in with your Microsoft work account
4. Done — Claude can now read your Teams

No API keys, no Azure portal, no setup.

## For Developers: Self-Host

### 1. Clone & Install

```bash
git clone https://github.com/SurgeEnterpriseAI/teams-mcp-server.git
cd teams-mcp-server
npm install
npm run build
```

### 2. Azure AD App Registration

1. Go to [Azure Portal](https://portal.azure.com) → **App registrations** → **New registration**
2. Name: `Teams MCP Server`
3. **Supported account types: "Accounts in any organizational directory (Any Azure AD directory - Multitenant)"**
4. Redirect URI: **Web** → `https://your-server.com/auth/callback`
5. Click **Register**

Configure:

- **Certificates & secrets** → New client secret → copy the Value
- **API Permissions** → Add Delegated (Microsoft Graph):
  - `ChannelMessage.Read.All`, `ChannelMessage.Send`
  - `Chat.Read`, `Chat.ReadWrite`, `ChatMessage.Send`
  - `Team.ReadBasic.All`, `Channel.ReadBasic.All`
  - `User.Read`
- Click **Grant admin consent** (for your own tenant; other tenants consent on first login)

### 3. Configure & Deploy

```bash
cp .env.example .env
# Set TEAMS_CLIENT_ID, TEAMS_CLIENT_SECRET
# Set BASE_URL and REDIRECT_URI to your production URL
# TEAMS_AUTHORITY=common (multi-tenant, default)
```

Deploy to Railway, Render, Azure App Service, or any Node.js host:

```bash
# Railway
railway login && railway init && railway up

# Or Azure
az webapp up --name teams-mcp-server --runtime "NODE:20-lts"

# Or just run directly
TRANSPORT_MODE=http node dist/index.js
```

### 4. Submit to MCP Registry

Once deployed and tested, submit your server URL to Anthropic's MCP connector registry. Users will then see "Microsoft Teams" as a connect option in Claude Cowork — just like Slack and Gmail.

## For Claude Code Users: Local STDIO Mode

Add to your `.mcp.json`:

```json
{
  "mcpServers": {
    "teams": {
      "command": "node",
      "args": ["/path/to/teams-mcp-server/dist/index.js"],
      "cwd": "/path/to/teams-mcp-server"
    }
  }
}
```

First run will open your browser for Microsoft login. After that, tokens are cached.

## Available Tools

| Tool | What it does |
|------|-------------|
| `teams_list_teams` | List all your Teams |
| `teams_list_channels` | List channels in a team |
| `teams_read_channel_messages` | Read recent channel messages |
| `teams_send_channel_message` | Send a message to a channel |
| `teams_reply_to_message` | Reply in a channel thread |
| `teams_read_message_replies` | Read thread replies |
| `teams_list_chats` | List your DMs and group chats |
| `teams_read_chat_messages` | Read messages from a chat |
| `teams_send_chat_message` | Send a direct/group chat message |
| `teams_search_messages` | Search messages across all Teams |
| `teams_get_profile` | Get your Microsoft 365 profile |

## Architecture

```
src/
├── index.ts               Main entry (auto-detects transport)
├── config.ts              Central configuration
├── logger.ts              Structured logging
├── types.ts               TypeScript interfaces
├── sessions.ts            Multi-user session manager
├── auth/
│   ├── oauth.ts           MSAL OAuth (multi-tenant, per-user)
│   └── token-store.ts     Persistent token cache
├── graph/
│   ├── client.ts          Graph HTTP client with retries
│   ├── teams.ts           Teams & channels API
│   ├── messages.ts        Channel messages API
│   ├── chats.ts           DM & group chat API
│   └── search.ts          Search & profile API
├── mcp/
│   ├── server.ts          MCP server factory
│   └── tools/             11 tool definitions
├── transport/
│   ├── stdio.ts           STDIO (Claude Code)
│   └── http.ts            Express + SSE (Cowork / remote)
```

## Environment Variables

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `TEAMS_CLIENT_ID` | Yes | — | Azure AD app client ID |
| `TEAMS_CLIENT_SECRET` | Yes | — | Azure AD client secret |
| `TEAMS_AUTHORITY` | No | `common` | `common` for multi-tenant, or a specific tenant ID |
| `TRANSPORT_MODE` | No | `auto` | `auto`, `stdio`, or `http` |
| `PORT` | No | `3000` | HTTP server port |
| `BASE_URL` | No | `http://localhost:3000` | Public URL |
| `REDIRECT_URI` | No | `{BASE_URL}/auth/callback` | OAuth callback URL |
| `TOKEN_STORE_PATH` | No | `./.data/tokens` | Token cache directory |
| `LOG_LEVEL` | No | `info` | Logging level |

## License

MIT — [LICENSE](LICENSE)

## Contributing

Issues and PRs welcome. Built by [SurgeEnterpriseAI](https://github.com/SurgeEnterpriseAI).