Ms Contacts MCP server
Microsoft Contacts MCP server — read and manage your address book through Microsoft Graph.
0 stars29 downloads/wk
Reviews
Write oneNobody has reviewed Ms Contacts yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Ms Contacts tools (7, 3 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
create_contactwrite actionCreate a new contact.
delete_contactwrite actionDelete a contact.
get_contactGet a single contact by ID.
list_contactsList contacts from the user's contact folder.
meGet the signed-in user's profile (id, displayName, mail).
search_contactsSearch contacts by name or email.
update_contactwrite actionUpdate contact properties.
Public scan report
scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it
- Code scan2 source files scanned13/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 111 days ago8/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Findings (1)
- highShell command built from a string (injection risk)
exec.shell-concatdist/index.js: …== "win32" ? 'start ""' : "xdg-open"; exec(`${cmd} "${url}"`, () => { }); }; var loginViaBro…
How Ms Contacts compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 63/100
- higher than 18% of 48,255 servers
- Tools
- 7
- the typical server has 7
- Tools that change things
- 43%
- typical: 0%. Fewer write tools means less an agent can break
- Downloads a week
- 29
- more than 16% of 12,191 servers with a package
What its tools let an agent do: 4 read · 1 create · 1 change · 1 delete
Install Ms Contacts in Claude Code, Cursor or VS Code
Runs npx -y ms-contacts-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add ms-contacts-mcp -- npx -y ms-contacts-mcp
What the publisher says
From the Ms Contacts repository's README, as published. We do not edit it. Read it on GitHub
Microsoft MCP
Model Context Protocol servers for Microsoft 365. Calendar · Contacts · OneDrive · Outlook · SharePoint — on the official @modelcontextprotocol/sdk, over stdio or Streamable HTTP.
Each server speaks the real MCP protocol and runs over either transport:
- stdio — for local MCP clients that launch the server as a subprocess (Claude Desktop, IDEs, the MCP Inspector).
- Streamable HTTP — for remote/hosted use, with the Microsoft Graph access token supplied per request via Authorization: Bearer.
Servers
All tools are thin wrappers over the Microsoft Graph v1.0 API.
Layout
microsoft-mcp/
├── apps/ # one MCP server per Microsoft 365 product
│ ├── calendar/
│ ├── contacts/
│ ├── onedrive/
│ ├── outlook/
│ └── sharepoint/
│ └── src/
│ ├── tools.ts # declarative tool definitions (schema + handler)
│ └── index.ts # run({ name, version }, tools)
└── packages/ # shared building blocks
├── core/ # MCP server bootstrap + dual transport (stdio / HTTP)
├── graph/ # Microsoft Graph HTTP client
├── validation/ # id / path / query sanitizers
└── logger/ # structured JSON logging (stderr-only — stdio-safe)A server is just a list of tools handed to run():
// apps/calendar/src/index.ts
import { run } from "@microsoft-mcp/core";
import { tools } from "./tools.js";
void run({ name: "microsoft-calendar", version: "1.0.0", title: "Microsoft Calendar" }, tools);// a single tool
defineTool({
name: "get_event",
description: "Get a single calendar event by ID.",
inputSchema: { event_id: z.string().describe("Event ID") },
confirmationPolicy: "never",
handler: ({ graph }, { event_id }) => {
validateId(event_id, "event_id");
return graph.request("GET", `/me/events/${event_id}`);
},
});Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Ms Contacts: common questions
- Is Ms Contacts MCP server safe?
- With care: it is graded C, so read the findings first (63/100). Read the Ms Contacts safety report
- How do I install Ms Contacts?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Ms Contacts need an API key?
- No secret keys are declared. It reads 1 setting from the environment.
- Is Ms Contacts maintained?
- The last commit was 149 days ago (2026-06-08). The latest release is v1.0.1.
- What can I use instead of Ms Contacts?
- Servers from other publishers that do the same job: Microsoft 365 MCP Server.
- How does Ms Contacts compare with other MCP servers?
- safety score 63/100 (higher than 18% of 48,255 servers); tools 7 (the typical server has 7); tools that change things 43% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Ms Contacts
Same job from other publishers: the closest match first, then the best rated.
- Microsoft 365 MCP ServerInteract with Microsoft 365 and Office services through the Microsoft Graph API.not reviewedEstablishedB