Back to Browse

Planner MCP Server

by Selic
Developer ToolsLow Risk10.0MCP RegistryLocal
Free

Server data from the Official MCP Registry

Microsoft Planner MCP server — plans, buckets, tasks via Microsoft Graph, ETags handled

About

Microsoft Planner MCP server — plans, buckets, tasks via Microsoft Graph, ETags handled

Security Report

10.0
Low Risk10.0Low Risk

Valid MCP server (2 strong, 1 medium validity signals). No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry. Trust signals: trusted author (3/3 approved).

8 files analyzed · 1 issue found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

What You'll Need

Set these up before or after installing:

Microsoft Entra ID tenant id (GUID or domain)Optional

Environment variable: MS_TENANT_ID

Entra app registration client idOptional

Environment variable: MS_CLIENT_ID

Entra app registration client secret (app needs Tasks.ReadWrite.All, GroupMember.Read.All, User.Read.All application permissions)Required

Environment variable: MS_CLIENT_SECRET

true/1 registers the advanced toolset (graph_get, graph_find_endpoint) — a read-only escape hatch limited to /planner, /groups, /usersOptional

Environment variable: PLANNER_ADVANCED_TOOLSET

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-selic-mcp-planner": {
      "env": {
        "MS_CLIENT_ID": "your-ms-client-id-here",
        "MS_TENANT_ID": "your-ms-tenant-id-here",
        "MS_CLIENT_SECRET": "your-ms-client-secret-here",
        "PLANNER_ADVANCED_TOOLSET": "your-planner-advanced-toolset-here"
      },
      "args": [
        "-y",
        "mcp-planner"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

mcp-planner

MCP server for Microsoft Planner via the Microsoft Graph API. Find groups and plans, list buckets and tasks, and create, update, assign, complete, or delete tasks — including descriptions and checklists — with Planner's ETag concurrency handled automatically.

Sibling project to mcp-itglue and mcp-connectwise-psa — same architecture.

Tools

ToolDescription
planner_search_groupsFind Microsoft 365 groups (Teams) by name → group ID
planner_find_userFind a user by name/UPN → user ID for assignments
planner_list_plansList plans owned by a group
planner_get_planPlan + its buckets
planner_create_bucketCreate a bucket in a plan
planner_list_tasksTasks in a plan or bucket (filter by assignee, open/completed)
planner_list_user_tasksAll tasks assigned to a user, across plans
planner_get_taskTask with description and checklist
planner_create_taskCreate task (bucket, due date, priority, assignees, description)
planner_update_taskUpdate title/bucket/due/priority/progress/assignees
planner_update_task_detailsUpdate description; add or (un)check checklist items
planner_delete_taskPermanently delete a task
graph_find_endpointSearch a curated catalog of the /planner, /groups, /users Graph surface
graph_getRead-only GET for any Graph v1.0 path under /planner, /groups, /users

† Advanced toolset (opt-in, off by default) — an escape hatch for Graph surface the curated tools don't wrap. Enable with PLANNER_ADVANCED_TOOLSET=true or --advanced. graph_get is verb-locked to GET, rejects /beta, and only reaches the three path prefixes above, so a shared app registration's other permissions (e.g. mail) stay out of reach.

Setup

1. Entra ID app registration

  1. Entra admin center → App registrations → New registration
  2. API permissions → Application permissions → add Tasks.ReadWrite.All, GroupMember.Read.All, User.Read.AllGrant admin consent
  3. Certificates & secrets → New client secret — note the value

2. Run

MS_TENANT_ID=<tenant> MS_CLIENT_ID=<client-id> MS_CLIENT_SECRET=<secret> npx -y mcp-planner

Claude Code:

claude mcp add planner --env MS_TENANT_ID=<tenant> --env MS_CLIENT_ID=<client-id> --env MS_CLIENT_SECRET=<secret> -- npx -y mcp-planner

HTTP mode

npx -y mcp-planner --transport http --port 3000

Sessions authenticate per-request (BYOK) with x-ms-tenant-id + x-ms-client-id plus either x-ms-client-secret (app-only) or x-ms-refresh-token (delegated — see below), or fall back to the MS_* environment credentials when set. When both a secret and a refresh token arrive, the refresh token wins (header-overlay proxies can add but not remove headers). Health probe at GET /health.

Delegated mode — act as the signed-in user

App-only sessions act as the app registration; delegated sessions act as a user: their Planner permissions apply and every write is attributed to them.

  1. A separate, public app registration: Authentication → Allow public client flows → Yes; API permissions → Delegated Tasks.ReadWrite, Group.Read.All, User.ReadBasic.All (+ admin consent where the tenant requires it).
  2. Each user signs in once via the device-code helper and keeps the printed refresh token:
node scripts/device-login.mjs --tenant <tenant-id> --client <public-client-id>
  1. Use MS_REFRESH_TOKEN instead of MS_CLIENT_SECRET (stdio), or the x-ms-refresh-token header (HTTP). Behind the MCP gateway, register it as a personal credential (field x-ms-refresh-token).

The refresh token is a secret — it acts as you — and stays valid ~90 days past its last use; re-run the helper when it expires.

Docker

docker build -t mcp-planner .
docker run -p 3000:3000 -e MS_TENANT_ID=... -e MS_CLIENT_ID=... -e MS_CLIENT_SECRET=... mcp-planner

Access model

No MCP-level role gating: the Entra app registration's granted Graph permissions are the access control. Point sessions at different app registrations (BYOK headers) to scope what they can do.

Notes

  • Planner requires an If-Match ETag on every update/delete — the tools fetch the current resource and pass its ETag automatically. On a 412 (concurrent change), just retry.
  • Priority mapping: urgent=1, important=3, medium=5, low=9 (Graph uses 0–10).
  • Progress: not started (0), in progress (50), completed (100).

Development

npm install
npm run dev        # stdio
npm run dev:http   # http
npm test
npm run build
npm run bundle     # Claude Desktop .mcpb

License

MIT

Reviews

No reviews yet

Be the first to review this server!