Use it when developing or maintaining outlook-mcp, including local setup, login, offline testing, mailbox tool testing, remote testing, and Cloudflare KV token setup.

It gives Claude project-specific guidance for diagnosing problems, running the right tests, and handling mailbox credentials safely.

How 8C9D/outlook-mcp configures Claude Code

Q: What is outlook-mcp CLAUDE.md?

Project instructions for outlook-mcp, a server that lets Claude connect to a personal Outlook.com mailbox through Microsoft Graph, Microsoft's email service API. It covers setup, commands, tests, and security rules.

Reuse

Borrowing it

Nothing to install: this file belongs to 8C9D/outlook-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/8C9D/outlook-mcp/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/8C9D/outlook-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/8c9d/outlook-mcp/claude-md.svg)](https://agentmods.dev/instructions/8c9d/outlook-mcp/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/8c9d/outlook-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/8c9d/outlook-mcp/claude-md.svg" alt="Measured on agentmods" height="20"></a>

Per session 764 This file is loaded in full into every session.

When invoked 764 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00764	$0.00764
Opus 5	$0.00382	$0.00382
Sonnet 5	$0.00153	$0.00153
Haiku 4.5	$0.00076	$0.00076

Measured yesterday against content hash 3183eb289af2, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

outlook-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 30 lines

How it starts

The opening of the file, as written. The whole thing — 30 lines — stays where its author put it; the contents beside it link to each section on GitHub.

outlook-mcp

MCP server connecting Claude to a personal outlook.com mailbox through Microsoft Graph. One shared tool registry is served over two transports: a local stdio server (Node + MSAL, on-disk token cache) and a Cloudflare Worker that claude.ai adds as a custom connector. This repo is public. README.md is the tool surface and security model, SETUP.md the install from zero, CAPABILITIES.md the Outlook-parity audit — read those rather than restating them here.

Commands worth knowing

npm run doctor — first thing to run when anything is broken; -- --env-only needs no credentials.
npm run test:offline — no Graph, no KV, no secrets. The only tier CI runs.
npm run test:tools — hits the real mailbox, creating then sweeping [MCP TEST] artifacts.
npm run test:remote — hits the deployed Worker; needs an interactive device-code sign-in or reports the authenticated tests as SKIP. MCP_REMOTE_URL retargets it at another deployment.
npm run seed:kv — lifts the refresh token from the local token cache (~/.config/outlook-mcp/token-cache.json) into KV. Re-run only after npm run login, never routinely.
./run-school.sh [server|login|verify|doctor] — the second instance (work/school M365 account, its own client id, authority, cache and scopes). Its exports beat .env; the personal instance is untouched.

Standing rules

src/core/registry.ts is the single source of the tool/prompt/resource surface; both transports build their server from it, so a tool not registered there (with its MCP annotations) exists on neither.
No secret, token or live mailbox content ever enters this repo. ASSUMPTIONS.md, RUN-REPORT.md and cleanup-progress.md are gitignored build journals quoting real mail — never commit them, and never lift their content into a tracked file.
send_draft is the only send path and it takes an existing draft id. Never add a compose-and-send tool, never call /me/sendMail, and never let an autonomous path send, delete or reply.
Mailbox deletes stay soft; manage_task delete is the one documented exception and says so loudly.
Mail is untrusted input: the auto-filing rails (PROTECTED_SUBJECT_PATTERNS, confidence threshold, daily call cap) may be extended, never weakened, and both LLM features ship disabled.

Read the full file on GitHub · 30 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed · +50 tokens per session 3183eb289af2
7d ago First seen · 30 lines · 714 tokens per session scan A e3df97b2399a

Subscribe to this mod's changes

outlook-mcp CLAUDE.md is an instructions file published in the GitHub repository 8C9D/outlook-mcp (0 stars, last pushed 2d ago), licensed MIT. It adds 764 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Microsoft-Graph claude cloudflare-workers mcp model-context-protocol oauth2

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

outlook-mcp: Instructions file for Claude Code