The SharePoint MCP runs as a **local stdio server** that connects to your SharePoint site via Azure AD: - **Azure AD Authentication**: Requires registering an app in Azure AD with appropriate SharePoint permissions - **Credential Storage**: Client ID and secret are stored as environment variables on your local machine - **Permission Scope**: Access is limited to the configured document library path - **Read/Write Access**: The server supports both read and write operations—configure app permissions accordingly **Security best practices**: Use the principle of least privilege when configuring Azure AD app permissions. Store credentials securely in environment variables, never in code. Consider using read-only permissions if write access isn't needed.

Getting started requires Azure AD app registration: 1. **Register Azure AD App**: Create an app registration in Azure Portal with SharePoint API permissions 2. **Get Credentials**: Obtain your client ID, client secret, and tenant ID from the app registration 3. **Identify SharePoint Site**: Note your SharePoint site URL and document library path 4. **Configure Environment Variables**: Set `SHP_ID_APP`, `SHP_ID_APP_SECRET`, `SHP_SITE_URL`, `SHP_DOC_LIBRARY`, and `SHP_TENANT_ID` 5. **Install & Run**: Use `uvx mcp-sharepoint` or `pip install mcp-sharepoint-server` **Example prompts**: - "List all folders in my SharePoint document library" - "Upload this report to the Q4 Reports folder" - "Extract the text content from the latest budget spreadsheet" - "Show me the folder tree structure of my SharePoint site"