Your AI's native
interface to Outlook.

100% LOCALNo intermediate servers
ZERO ENTRA IDPre-authorized client ID
CALENDAR + MAILBook, reschedule, search, send
$ go install github.com/desek/outlook-local-mcp/cmd/outlook-local-mcp@latest
Download Claude Desktop extension (.mcpb)↗
Scroll to explore

Connect Claude to your calendar.
No servers. No registration.
Just your data, locally.

A Model Context Protocol server that connects Claude — or any MCP client — directly to Microsoft Calendar and Mail via the Graph API. All data stays on your machine. OAuth tokens live in your OS keychain. The server process never leaves localhost.

OAuth 2.0Device code, browser, or PKCE
OS KeychainmacOS, Linux, Windows native storage
Graph API v1.0Calendar + Mail scopes only
LanguageGo 1.24+
ProtocolMCP (JSON-RPC)
APIGraph API v1.0
LicenseMIT
AuthOAuth 2.0
Token StorageOS Keychain
LoggingStructured JSON
ResilienceExp. backoff
What can it do?

Ask for your week, book the meeting, find the thread, send the reply. Claude does it in Outlook, not in a copy of it.

APRIL 2026‹ ›MoTuWeThFrSaSu123456789101112131415161718192021222324252627282930MCP TOOLScalendar · create_eventcalendar · search_eventscalendar · get_free_busycalendar · reschedule_eventTODAYoutlook-mcp — terminal$Schedule standup tomorrow at 9am→ calendar · create_event · "Team Standup" · 2026-04-07 · 09:00–09:3014MCP TOOLSCALENDAR MANAGEMENT
01

Calendar Management15 verbs

Read, search, create, update, and delete calendar events and meetings. Check free/busy availability across accounts.

Meeting tools include attendee confirmation guidance and extra warnings for external attendees — the LLM won't accidentally spam a meeting invite without a check.

helplist_calendarslist_eventsget_eventsearch_eventscreate_eventupdate_eventdelete_eventrespond_eventreschedule_eventcreate_meetingupdate_meetingcancel_meetingreschedule_meetingget_free_busy
Wwork@company.comAUTHENTICATEDtoken:APpersonal@outlook.comAUTHENTICATEDtoken:BTteam@org.comAUTHENTICATEDtoken:CMCP SERVER>account · list · account · addOS KEYCHAIN
02

Multi-Account7 verbs

Add, list, and remove Microsoft accounts at runtime. Each account gets isolated token storage. Accounts persist across restarts.

Lazy auth — no credentials required at startup. Authentication triggers on first tool call per account.

helpaddremovelistloginlogoutrefresh
subject:"Sprint" AND from:aliceALaliceSprint Planning — Q2 R…9:42 AMBKb.kumarRe: Sprint retro notesYesterdayCJc.jamesSprint demo recordingMonDMdesignFigma assets updateSunEMemilyOnboarding checklistFriSprint Planning — Q2 Roadmapalice@contoso.comHi team, sharing the updated Sprint Planningdoc for Q2. Please review sections 2–4before Thursday. Key items: capacity plan,backlog grooming, and milestone dates.KQL match · 1 result📎 roadmap-q2.pdfmail · list_foldersmail · list_messagesmail · search_messagesmail · get_message
03

Mail Access (opt-in)5 verbs

Read-only access to mailbox folders, messages, and full-text search via KQL. Disabled by default; enabled with one env var.

Opt-in only. Set OUTLOOK_MCP_MAIL_ENABLED=true. Never writes to mail.

helplist_folderslist_messagesget_messagesearch_messages
YOUR MACHINEMCP Serveroutlook-local-mcpOS KeychainmacOS · libsecret · DPAPIAES-256-GCMEncrypted file cache (fallback)FALLBACKNETWORK BOUNDARYMICROSOFT CLOUDGraph APIgraph.microsoft.comIdentity Platformlogin.microsoftonline.comHTTPSOAuth 2.0Third-party ServersProxies · SaaS middleware · CloudsBLOCKED100% LOCAL — All data processing occurs on your machine
04

Local Privacy & Security

No data routing through third parties. Every credential and token stays on your machine.

AES-256-GCM encrypted file fallback when OS keychain is unavailable. OData injection protection on all inputs.

  • OAuth tokens in macOS Keychain / Linux libsecret / Windows DPAPI
  • AES-256-GCM encrypted file fallback
  • Only outbound: Graph API + Microsoft Identity Platform
  • PII sanitization built into structured logging
  • OData injection protection on all inputs
  • Read-only mode via single env var
>FIRST TOOL CALL"List my calendars"ABCDDevice CodeABCD-1234microsoft.com/deviceloginheadless environmentsDEFAULTBrowserMicrosoft loginlocalhost callbackopens system browser$_Auth CodePKCE flowheadless / remoteno browser neededTOKEN CACHEDOS keychain · silent refresh90 day expiry · auto-renewNo Entra ID Required3 METHODSZERO CONFIG
05

Zero-Config Auth

Three auth methods, all requiring ZERO ENTRA ID app registration.

Token expiry is ~90 days. Silent refresh is automatic. First-time auth is a one-time browser action.

Device code (default)

Displays URL + code. Works in headless environments.

Interactive browser

Opens system browser, listens on localhost.

Authorization code (PKCE)

For fully headless/remote setups.

That’s

Outlook Local MCP.

How do you get started?

Install. Configure. Done.

01

Install

go install github.com/desek/outlook-local-mcp/cmd/outlook-local-mcp@latest
02

Configure

{  "mcpServers": {    "outlook-local": {      "command": "outlook-local-mcp",      "env": {        "OUTLOOK_MCP_DEFAULT_TIMEZONE": "America/New_York"      }    }  }}
DEFAULT_TIMEZONEAmerica/New_York
AUTH_METHODdevice | browser | authcode
READ_ONLYtrue to disable writes
MAIL_ENABLEDtrue to enable mail tools
03

First Run

No credential setup before first use. On first tool call, a device code URL displays. Complete auth once in a browser. Tokens are cached in your OS keychain for ~90 days.

terminal
$ outlook-local-mcp
INFO  MCP server starting on stdio...
INFO  No accounts configured yet.
INFO  Authentication required for first account.

To sign in, use a web browser to open
https://aka.ms/devicelogin
and enter the code: ABCD-EFGH

INFO  Authentication successful.
INFO  Token cached in OS keychain (~90 day expiry).
INFO  Ready. 4 tools registered.
Is your data private?

Every credential stays on your machine.

No credential and no message body is relayed through a third party. The only outbound destinations are Microsoft’s own endpoints, plus any telemetry endpoint you configure. Verifiable, auditable, explainable to your security team.

OS-Native Token Storage

OAuth tokens stored in macOS Keychain, Linux libsecret, or Windows DPAPI. Your credentials never leave your operating system's secure enclave.

AES-256-GCM Fallback

When the OS keychain is unavailable, tokens are encrypted with AES-256-GCM in a local file. No plaintext credentials, ever.

Outbound Only

Outbound requests reach only Microsoft's own endpoints — the Graph API and the Identity Platform — plus any telemetry endpoint you configure. No third party relays your data. The one inbound socket is a temporary loopback port opened only for interactive browser sign-in.

PII Sanitization

Structured logging with PII sanitization enabled by default. Event subjects, attendee emails, and message content are stripped from logs.

OData Injection Protection

All user inputs validated and escaped before reaching the Graph API. OData query injection is blocked at the request construction layer.

Read-Only Mode

Set OUTLOOK_MCP_READ_ONLY=true to disable all write operations. Perfect for evaluation or security-restricted environments.

YOUR MACHINEMCP CLIENT(Claude)MCP SERVER(outlook-local-mcp)OS KEYCHAINMICROSOFTGRAPH APIOUTBOUND ONLY
Observability

Optional OpenTelemetry export (OTLP gRPC) — zero overhead when disabled. Per-tool audit logging, structured JSON output, configurable log levels. Exponential backoff retry on transient Graph API errors. Graceful SIGINT/SIGTERM shutdown.