OWA Exchange MCP Server

OWA Exchange MCP Server

MCP (Model Context Protocol) server for any Microsoft Exchange / OWA (Outlook Web Access) deployment. Gives LLM agents access to email, calendar, directory search, folders, availability, and meeting analytics via 30 tools.

Works with any on-premise or hosted Exchange server that exposes OWA.

Quick Start

# Copy and edit the MCP config with your OWA URL

cp .mcp.json.example .mcp.json

One-time: set up encrypted credentials

python3 login.py --setup

Login (opens headless browser, 2FA approval required)

python3 login.py

Install the MCP server

pip install -e .

Install

Add to your MCP client config. Replace https://owa.example.com with your OWA URL.

Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):

{

"mcpServers": { "exchange": { "command": "uvx", "args": ["exchange-mcp-server"], "env": { "EXCHANGE_OWA_URL": "https://owa.example.com" } } } }

Cursor (.cursor/mcp.json):

{

"mcpServers": { "exchange": { "command": "uvx", "args": ["exchange-mcp-server"], "env": { "EXCHANGE_OWA_URL": "https://owa.example.com" } } } }

Claude Code (.mcp.json):

{

"mcpServers": { "exchange": { "command": "uvx", "args": ["exchange-mcp-server"], "env": { "EXCHANGE_OWA_URL": "https://owa.example.com" } } } }

Configuration

Login

Option A: Via MCP tool (recommended)

The login tool handles credential setup and authentication within the MCP session — no separate terminal needed.

First time (setup + login):

login(master_password="...", username="user@example.com", password="...")

Subsequent logins (decrypts stored credentials):

login(master_password="...")

Option B: Via CLI

python3 login.py --setup   # First time: save encrypted credentials

python3 login.py # Login with 2FA

Both methods:

1. Open a headless browser to your OWA URL
2. Submit credentials
3. Wait for 2FA approval (up to 90 seconds)
4. Save encrypted session cookies to session-cookies.txt

Credentials and session cookies are encrypted at rest with AES-256 (PBKDF2 key derivation, 480k iterations).

Tools (30)

Email (10)

Calendar (7)

Directory (1)

Folders (7)

Availability (2)

Analytics (2)

Auth (1)

Files

login.py                  # Browser-based 2FA login (standalone CLI)

exchange_mcp/ server.py # FastMCP server entry point owa_client.py # OWA HTTP client auth.py # Async login logic (shared by MCP tool) tools/ email.py # Email tools calendar.py # Calendar tools people.py # Directory search folders.py # Folder management & session check availability.py # Free time / meeting time analytics.py # Meeting stats & contacts auth.py # Login tool pyproject.toml # Package config

Warning

Every Exchange / OWA deployment has its own authentication setup — some require 2FA (push notifications, TOTP, SMS), others use single-factor login or SSO. The login logic in this project (login.py and exchange_mcp/auth.py) is written for a specific 2FA flow (mobile push approval). If your OWA server uses a different 2FA method or no 2FA at all, you will need to modify or remove the login logic to match your environment.

Security

• Credentials and session cookies encrypted with AES-256-Fernet
• Master password never stored
• PBKDF2 with 480,000 iterations for key derivation
• Credential and cookie files have 0600 permissions
• Cookies decrypted into memory only — never written to disk as plaintext (via MCP tool)
• Session cookies never transmitted except to your OWA server