Shared Microsoft Graph auth helpers (Device Code, token cache, BYO client) for MCP servers.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-microsoft-graph-auth","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
<!-- SPDX-License-Identifier: MIT OR Apache-2.0 SPDX-FileCopyrightText: 2026 XMV Solutions GmbH SPDX-FileContributor: David Koller <david.koller@xmv.de> --> # mcp-microsoft-graph-auth Shared Microsoft Graph authentication helpers for [MCP](https://modelcontextprotocol.io) servers. [](https://pypi.org/project/mcp-microsoft-graph-auth/) [](https://github.com/XMV-Solutions-GmbH/mcp-microsoft-graph-auth/actions/workflows/ci.yml) [](https://pypi.org/project/mcp-microsoft-graph-auth/) [](LICENSE-MIT) ## Why this exists [`mcp-server-sharepoint`](https://github.com/XMV-Solutions-GmbH/sharepoint-mcp) and [`mcp-server-outlook`](https://github.com/XMV-Solutions-GmbH/outlook-mcp) (and likely future siblings — Teams, OneDrive, …) all need the same auth machinery against Microsoft Graph: OAuth Device Code flow, token cache with sensible storage backends, optional service-principal mode, multi-profile support. This library factors that machinery out so each MCP server adds only what's specific to its API surface (scopes + tool names), not yet another reimplementation of Device Code + token storage. ## What's in the box - **`device_code`** — primitives for the OAuth 2.0 Device Code flow against Microsoft Identity v2.0 (`request_device_code`, `poll_for_token`, `refresh_access_token`). - **`service_principal`** — client-credentials grant for unattended automation (CI runners, scheduled jobs). - **`token_store`** — three pluggable storage backends: - **OS keyring** (macOS Keychain / Windows Credential Locker / Linux Secret Service) when available. - **Plain file** mode 0600 (`~/.cache/<your-app>/<profile>/token.json`) — same c…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.