Field-by-field comparison
Compare the evidence before choosing an MCP.
Each signal stays separate, missing facts remain visible, and the column order follows your selection.
| Evidence field | Microsoft 365 MCP ServerShortlist candidate | Apify MCP ServerMCP100 Recommended |
|---|---|---|
| Task fit | ||
| Best for |
|
|
| Not ideal for |
|
|
| Avoid when |
|
|
| Provenance | ||
| Provenance details | Community implementation Softeria · Publisher source ↗ | Community implementation com.apify · Publisher source ↗ |
| Maintenance | ||
| Maintenance details | Repo: Aug 24, 2026 Package: Aug 24, 2026 | Repo: Sep 23, 2026 Package: Sep 21, 2026 |
| Popularity evidence | ||
| GitHub stars | 932 GitHub stars · checked 2026-08-24T12:00:00.000Z | 8,235 GitHub stars · checked 2026-09-24T04:14:39.546000Z |
| Package downloads / 30 days | 171,749 package downloads / 30 days · checked 2026-08-24T12:00:00.000Z | 103,470 package downloads / 30 days · checked 2026-09-24T04:23:13.539000Z |
| External adoption evidence |
| Not documented |
| Client coverage | ||
| Client coverage details | Not documented | Claude Code✓ Streamable HTTP Claude Desktop✓ Streamable HTTP Codex✓ Streamable HTTP VS Code✓ Streamable HTTP Cursor✓ Streamable HTTP OpenCode✓ Streamable HTTP |
| Client coverage note | Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server. | |
| Access and data | ||
| Authentication | The documented options include Device Code Flow for local stdio, OAuth Authorization Code Flow for HTTP, a caller-supplied MS365_MCP_OAUTH_TOKEN, and a custom Microsoft Entra application for organization or production deployment. Use a dedicated identity, restrict consented Graph scopes, remove the MCP entry and local credentials when access is no longer needed, and revoke Microsoft authorization or tokens through the applicable account or Entra controls. | Hosted mode supports OAuth or Authorization Bearer APIFY_TOKEN; local stdio uses APIFY_TOKEN. Discovery tools can be unauthenticated, and agentic payment tokens are additional alternatives. |
| Cost | The MIT-licensed npm package has no separate package purchase price documented. Access still depends on the Microsoft account, service access, licenses, tenant permissions, and admin consent required by the chosen workload; self-hosted HTTP deployments can also incur normal hosting, container, and secret-management costs. | Actor and platform usage is chargeable according to Actor pricing; even free Actors incur platform usage. x402, Skyfire, and AGI payment paths are documented; no fixed MCP fee is stated. |
| Permissions | The MCP can read and write Microsoft Graph resources including email, calendar, OneDrive files, SharePoint Sites and Lists, Teams/chats/meetings, contacts, users, OneNote, Planner, To Do, and Excel. Organization-mode SharePoint can request broad Sites.Read.All, Sites.ReadWrite.All, and Sites.Manage.All scopes; use --allowed-scopes, --enabled-tools, --read-only, and Sites.Selected where the documented operation supports them. | Dynamically exposes Apify Actors, including web, social, maps, and e-commerce scrapers, plus run, dataset, key-value-store, and documentation tools. call-actor executes external Actors. |
| Data handling | The local MCP handles Microsoft Graph request and response data. Documented local MSAL token caching is encrypted, while the headless fallback still depends on directory access controls. The HTTP deployment documents stateless per-request bearer-token Graph requests. Structured audit logging is enabled for Graph-reaching tool calls and can include principals, tool names, outcomes, resource identifiers, and recipient counts or domains; response bodies are not recorded by that structured log, and separate operational logging can record tool parameters. Token and PII redaction is documented as configurable rather than an absolute data-boundary guarantee. | Requests and Actor inputs are sent to Apify; run results can be stored in Apify datasets and key-value stores. Telemetry is enabled by default and stdio uses Sentry; detailed retention is not documented. |
| Limitations | ||
| Tradeoffs |
|
|
| Risk context | This broad Microsoft Graph MCP can expose sensitive business email, files, SharePoint content, Teams/chats/meetings, contacts, and tenant information, and it includes material write and delete operations. Destructive-operation confirmation is documented as off by default; default organization-mode SharePoint permissions can be broad, and HTTP Dynamic Client Registration is enabled by default unless disabled. Use read-only mode, presets/tool filtering, allowed scopes, Sites.Selected when applicable, dedicated identities, and explicit review before enabling writes or tenant-wide discovery. GHSA-9w34-3f56-vwmh affected versions through 0.136.0; reviewed version 0.146.1 is above the documented 0.137.0 fixed version. This patched advisory is not a general security certification. | Actor execution can scrape external sites, process personal or regulated data, incur spend, and return untrusted content. Restrict tools, use scoped tokens, review Actor pricing and terms, and control telemetry and storage. |
| Evidence date | ||
| Editorial review | 2026-08-24T12:00:00.000Z | 2026-08-11 |
| Candidate evidence | 2026-08-24T12:00:00.000Z | 2026-09-24T04:25:05.554391Z |
Popularity, maintenance, fit, permissions, and client support are independent evidence fields.
Read the evidence method →