// SCAN REPORT

Outlook MCP Server

59 tools. 40 can modify or destroy data without limits.

7 destructive tools with no built-in limits. Policy required.

Last updated: 1 Jul 2026

40 can modify or destroy data

19 read-only

59 tools total

Community server · catalogue entry verified 01/07/2026

How to control Outlook MCP Server ↓

TOOL MAP

What Outlook MCP Server exposes to your agents

Read (19) Write / Execute (33) Destructive / Financial (7)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Outlook MCP Server tools

Destructive · High cancel-event Cancelling a calendar event is an irreversible action — it removes the event and typically sends cancellation notices to all attendees, which cannot be undone. Destructive · High delete-contact Deletion of contacts is an irreversible destructive action that cannot be undone. Destructive · High delete-email This tool irreversibly deletes user data (emails). Destructive · High delete-event Calendar events, once deleted, cannot be recovered through normal UI or API means without administrative intervention or backups.

40 of Outlook MCP Server's 59 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Outlook MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Outlook MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "cancel-event": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "about": {
    "limits": [
      {
        "counter": "about_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "check-auth-status": {
    "limits": [
      {
        "counter": "check-auth-status_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Outlook MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON OUTLOOK →

Instant setup, no code required.

FULL CATALOGUE

All 59 Outlook MCP Server tools

DESTRUCTIVE 7 tools

Destructive cancel-event Cancels a calendar event Destructive delete-contact Deletes a contact from the mailbox Destructive delete-email Deletes an email. By default, moves to Deleted Items (soft delete). Set permanent=true to permanently delete t Destructive delete-event Deletes a calendar event Destructive delete-folder Deletes a mail folder Destructive delete-rule Deletes an existing inbox rule Destructive delete-task Deletes a task from a To Do task list

WRITE 33 tools

Write about Returns information about this Outlook Assistant server Write accept-event Accepts a calendar event invitation Write add-attachment Adds a file attachment to an email message (typically a draft). Write archive-email Moves an email to the Archive folder. Write authenticate Authenticate with Microsoft Graph API to access Outlook data Write copy-email Copies an email to a specified folder. Write create-contact Creates a new contact in the mailbox Write create-draft Creates a new draft email in the Drafts folder. Write create-event Creates a new calendar event Write create-folder Creates a new mail folder Write create-rule Creates a new inbox rule Write create-task Creates a new task in a To Do task list Write create-task-list Creates a new To Do task list Write decline-event Declines a calendar event Write edit-rule-sequence Changes the execution order of an existing inbox rule Write flag-email Sets the flag status on an email. Can optionally set start and due dates for follow-up. Write forward-email Forwards an email to the specified recipients with an optional comment. Write forward-event Forwards a calendar event to specified recipients Write mark-as-read Marks an email as read or unread Write move-emails Moves emails from one folder to another Write rename-folder Renames an existing mail folder Write reply-all-email Replies to all recipients of an email. Write reply-email Replies to an email. Optionally override the reply-to recipients. Write send-draft Sends an existing draft email. Write send-email Composes and sends a new email Write set-email-categories Sets categories (color-coded labels) on a specific email. This replaces all existing categories on the email w Write tentatively-accept-event Tentatively accepts a calendar event invitation Write update-contact Updates an existing contact in the mailbox Write update-draft Updates an existing draft email with new field values. Only provided fields are updated. Write update-event Updates an existing calendar event Write update-out-of-office Updates out-of-office / automatic replies settings for a mailbox Write update-rule Updates an existing inbox rule Write update-task Updates an existing task in a To Do task list

READ 19 tools

Read check-auth-status Check the current authentication status with Microsoft Graph API Read get-attachment Retrieves a specific attachment from an email, including its base64 content. Read get-contact Gets the full details of a specific contact Read get-event Gets detailed information about a specific calendar event Read get-free-busy Gets free/busy schedule information for one or more people Read get-mail-tips Gets mail tips for one or more email addresses, including out-of-office status, mailbox full, delivery restric Read get-mailbox-settings Gets mailbox settings including timezone, language, working hours, and auto-reply status Read get-master-categories Gets the list of available categories (color-coded labels) for your mailbox. Use this to see what categories c Read get-task Gets the full details of a specific task Read list-attachments Lists all attachments on a specific email message. Read list-contacts Lists contacts from a mailbox Read list-emails Lists recent emails from your inbox Read list-events Lists upcoming events from your calendar Read list-folders Lists mail folders in your Outlook account Read list-rules Lists inbox rules in your Outlook account Read list-task-lists Lists all To Do task lists in the mailbox Read list-tasks Lists tasks from a specific To Do task list Read read-email Reads the content of a specific email Read search-emails Search for emails using various criteria

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Outlook MCP Server

Can an AI agent delete data through the Outlook MCP Server MCP server? +

Yes. The Outlook MCP Server server exposes 7 destructive tools including cancel-event, delete-contact, delete-email. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Outlook MCP Server? +

The Outlook MCP Server server has 33 write tools including about, accept-event, add-attachment. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Outlook MCP Server.

How many tools does the Outlook MCP Server MCP server expose? +

59 tools across 4 categories: Destructive, Execute, Read, Write. 19 are read-only. 40 can modify, create, or delete data.

How do I enforce a policy on Outlook MCP Server? +

Register the Outlook MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Outlook MCP Server tool call.

Deterministic rules across all 59 Outlook MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON OUTLOOK →

Instant setup, no code required.

59 Outlook MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.