feat(microsoft-teams): new MCP — channel & chat messaging, meetings, triggers

[IgorFigueiredo28]

Summary

New Microsoft Teams MCP integrating with the Microsoft Graph API using deco's native delegated OAuth (Authorization Code + PKCE — users connect via the "Connect to Microsoft" button).

Capabilities

• Channel messaging: list teams/channels, send & reply, read history & threads, edit, react
• Private chats: find/search users (by email or name), open 1-on-1 & group chats, send & quote-reply, read history
• Meetings: create (with Teams join link), list, get, update, reschedule, cancel, and respond (accept/decline/tentative)
• Trigger: teams.message.received via Graph change notifications (subscribe/refresh/unsubscribe + event diagnostics)

Hardening

• Structured logger with per-request trace_id + timings
• Event deduplication for redelivered Graph notifications
• Centralized error formatting with machine codes + actionable hints

Note: Microsoft Teams APIs require a Microsoft 365 work/school account; personal accounts are not supported (Graph limitation).

---

Summary by cubic

Adds a new Microsoft Teams MCP for channel/chat messaging, meeting management, and a teams.message.received trigger. Runs on Cloudflare Workers with Workers KV for state and reliable trigger delivery, with security and correctness hardening.

• New Features

  • Channel messaging: list teams/channels; send/reply/edit/react; read history and threads.
  • Private chats: find users (email/name); create 1:1 or group chats; send and quote-reply; edit/react; read history.
  • Meetings: create (with Teams link); list/get; update/reschedule; cancel; respond (accept/decline/tentative).
  • Trigger: teams.message.received via Graph change notifications with tools to subscribe/list/refresh/unsubscribe (auto-renew near expiry).
  • Diagnostics: tools to list and clear recent webhook events (24h retention).
  • Auth: delegated OAuth via @decocms/runtime (“Connect to Microsoft”). Requires a Microsoft 365 work/school account.

• Refactors

  • Migrated to Cloudflare Workers; webhook routes handled in the Worker fetch path with crypto UUID clientState.
  • State moved to Workers KV (triggers, subscriptions, webhook token cache, dedup, recent events).
  • Trigger delivery made reliable by awaiting callback work with waitUntil() instead of fire-and-forget.
  • KV-based dedup for Graph retries; structured JSON logger with per-request trace_id and safe JSON; centralized error formatting with hints.
  • Graph client hardening: handle 202/204 empty responses; use /me/joinedTeams; reactions send proper emoji; avoid persisting empty refresh_token.
  • Added wrangler.toml (real KV namespace id), a deploy workflow, and updated scripts/types for Workers.

^{Written for commit 14c0725. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

11 issues found across 27 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="microsoft-teams/server/lib/graph-client.ts">

<violation number="1" location="microsoft-teams/server/lib/graph-client.ts:71">
P1: graphFetch only handles HTTP 204 as an empty-body success, but Microsoft Graph action endpoints (e.g., `POST /me/events/{id}/cancel`, `POST /me/events/{id}/accept`, `POST /me/events/{id}/decline`) return `202 Accepted` with an empty body. Calling `response.json()` on an empty body throws `SyntaxError: Unexpected end of JSON input`, causing successful API calls to be reported as errors.</violation>

<violation number="2" location="microsoft-teams/server/lib/graph-client.ts:304">
P2: Graph $search expression does not escape double quotes or backslashes in user-provided query, which can produce malformed search syntax per Microsoft Graph documentation.</violation>

<violation number="3" location="microsoft-teams/server/lib/graph-client.ts:568">
P1: `listJoinedTeams` calls the wrong Graph API endpoint. It uses `/teams` but should use `/me/joinedTeams` to list teams the authenticated user is a member of, matching the function's intent and the `LIST_TEAMS` tool description. The `/teams` endpoint does not support listing all joined teams without a group ID.</violation>
</file>

<file name="microsoft-teams/server/main.ts">

<violation number="1" location="microsoft-teams/server/main.ts:30">
P2: OAuth tenant defaults to `common`, allowing unsupported personal Microsoft accounts</violation>

<violation number="2" location="microsoft-teams/server/main.ts:83">
P2: Authorization code exchange coerces missing refresh_token to empty string, creating an invalid persisted token that breaks future refresh attempts.</violation>
</file>

<file name="microsoft-teams/server/tools/meetings.ts">

<violation number="1" location="microsoft-teams/server/tools/meetings.ts:512">
P2: DECLINE_MEETING and TENTATIVELY_ACCEPT_MEETING duplicate nearly identical schema definitions and execute logic. Extract a shared helper/factory for the common respond-to-invitation pattern to avoid future divergence.</violation>

<violation number="2" location="microsoft-teams/server/tools/meetings.ts:558">
P1: Partial proposed_start/proposed_end inputs are silently ignored in decline and tentative-accept meeting responses. Both fields are optionally declared, but the code only includes `proposedNewTime` when BOTH are present. If only one is provided, it is silently dropped and `{ success: true }` is returned, causing the organizer to never receive the proposed time with no feedback to the caller. This same bug exists in both `createDeclineMeetingTool` and `createTentativelyAcceptMeetingTool`.</violation>
</file>

<file name="microsoft-teams/server/tools/subscriptions.ts">

<violation number="1" location="microsoft-teams/server/tools/subscriptions.ts:57">
P1: `clientState` webhook secret is generated with non-cryptographic `Math.random()`, weakening the only verification mechanism for unauthenticated Graph webhook notifications.</violation>
</file>

<file name="microsoft-teams/server/lib/errors.ts">

<violation number="1" location="microsoft-teams/server/lib/errors.ts:101">
P2: Non-Error thrown values are normalized with unguarded `String(err)`, which loses object detail (produces `[object Object]`) and can throw on hostile values. Project feedback requires `JSON.stringify` with fallback.</violation>
</file>

<file name="microsoft-teams/server/lib/logger.ts">

<violation number="1" location="microsoft-teams/server/lib/logger.ts:47">
P1: Unguarded `JSON.stringify` in `emit` can throw and mask original errors when `ctx` contains circular references or throwing `toJSON`.</violation>
</file>

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

2 issues found across 15 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="microsoft-teams/server/lib/graph-client.ts">

<violation number="1" location="microsoft-teams/server/lib/graph-client.ts:304">
P2: Graph $search expression does not escape double quotes or backslashes in user-provided query, which can produce malformed search syntax per Microsoft Graph documentation.</violation>
</file>

<file name="microsoft-teams/server/main.ts">

<violation number="1" location="microsoft-teams/server/main.ts:30">
P2: OAuth tenant defaults to `common`, allowing unsupported personal Microsoft accounts</violation>
</file>

<file name="microsoft-teams/server/lib/errors.ts">

<violation number="1" location="microsoft-teams/server/lib/errors.ts:101">
P2: Non-Error thrown values are normalized with unguarded `String(err)`, which loses object detail (produces `[object Object]`) and can throw on hostile values. Project feedback requires `JSON.stringify` with fallback.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 7 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>