Graph Excel

io.github.mickey-ichiPublished by GitHub account mickey-ichiv0.5.2Updated Nov 7, 2026

Read and edit Excel workbooks on SharePoint/OneDrive via Microsoft Graph, with verified writes.

VerifiedSTDIODesktop onlyProductivity & WorkflowCloud & InfrastructureFiles & Storage

Overview

AI-generated overview

Reads and edits Excel workbooks on SharePoint, OneDrive or Teams via Microsoft Graph, with dry-run writes and read-back verification.

What you can do
  • Sign in and check the Microsoft Graph token, and resolve workbook aliases to drive and item ids with sheet ranges
  • Read cell values with per-cell hashes, and search cell text across sheets by substring or regex
  • Write value blocks with a base check and read-back verification, and append or replace update sections under existing cell text
  • Set or clear fill colors and apply formatting such as bold, font, wrap, alignment and number format
  • Add, rename and insert or append rows and sheets, all as dry runs until explicitly sent
When to use it
Useful when an assistant needs to inspect or update shared Excel workbooks in Microsoft 365 without a browser, especially sheets that several people edit at once and where overwriting someone else's change must be avoided.
Requirements
Runs locally over stdio via npx with Node 18 or later. Requires a Microsoft sign-in through a device code using the Graph PowerShell public client with the delegated Files.ReadWrite.All scope; a tenant admin may need to approve that client. The refresh token and workbook aliases are stored in a folder set by GRAPH_EXCEL_HOME, defaulting to ~/.graph-excel. Network access to Microsoft login and Graph endpoints is needed.
Before you install
The stored refresh token in token.json grants read and write access to the user's files, so protect that folder and the GRAPH_EXCEL_HOME location. Writes change real shared workbooks; they are dry runs until send is set to true, and nothing deletes sheets, rows or cells. Cell contents are sent to the assistant when requested, and all traffic goes to Microsoft Graph.

Installation

In SourceWeft

  1. Open Graph Excel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[Image]

graph-excel-mcp

Read and edit Excel workbooks on SharePoint and OneDrive from AI agents — without overwriting anyone’s edits.

[npm] [downloads] [CI] [provenance] [license]

npm · Claude Desktop extension · Releases

MCP server for reading and editing Excel workbooks on SharePoint, OneDrive or Teams through Microsoft Graph, without a browser. It is written in TypeScript, has no runtime dependencies, and runs on Node 18 or later.

It is built for workbooks that several people edit at once:

  • Every write starts as a dry run.
  • Before writing, it checks the cells' current content against the version you read, so it won't overwrite someone else's edit.
  • After writing, it reads the cells back to confirm the change.

Install

Claude Code / any MCP host (stdio):

bash
claude mcp add --scope user graph-excel -- npx -y graph-excel-mcp
json
{ "mcpServers": { "graph-excel": { "command": "npx", "args": ["-y", "graph-excel-mcp"] } } }

Claude Desktop extension: download graph-excel-mcp-<version>.mcpb from the latest release and open it. One install covers both Chat and Cowork in Claude Desktop.

Claude plugin (Cowork, Claude Code): install the plugin/ folder of this repo. It contains the server and a graph-excel skill.

Sign in

Call the login_status tool, or run npx graph-excel-mcp login, then enter the code it shows at https://login.microsoft.com/device. The refresh token is saved in ~/.graph-excel/token.json with mode 600. Set GRAPH_EXCEL_HOME to keep it somewhere else.

Sign-in uses the Microsoft Graph PowerShell public client with the delegated scope Files.ReadWrite.All, so you don't need to register an app. If your tenant blocks user consent, an admin has to approve that client once.

Workbook aliases

Instead of pasting the SharePoint URL every time, you can add aliases to ~/.graph-excel/workbooks.json (see workbooks.example.json). The resolve tool returns the driveId and itemId you need for an alias.

Tools

ToolWhat it does
login_statusChecks the token, or starts a device code login
resolveReturns drive/item ids, last modified, and the sheets with their used ranges
read_rangeReturns values plus a sha256: hash per cell, and fills on request
write_valuesWrites blocks of values with a base check (expected) and read-back verification
append_updateAdds or replaces a 「-----update-----」 section under a cell's existing text, keeping the original part byte-identical, and can fill the row with a color
set_fillSets or clears the fill color of one or more ranges in a single batch
findSearches cell text across all sheets (or one), substring or regex, and returns addresses with hashes
add_sheetAdds an empty sheet (Excel name rules, no duplicates), optionally at a position
rename_sheetRenames a sheet
insert_rowsInserts empty rows above a row and verifies the shifted row moved intact
append_rowsAppends rows below the last used row; the target cells must still be empty
set_formatBold, italic, font color and size, wrap, alignment and number format for one or more ranges

Every tool that changes the workbook is a dry run until send: true. Nothing deletes sheets, rows or cells.

Notes

  • Every call runs inside a workbook session. Sessionless calls on large workbooks can time out with a 504 even though the write was applied.
  • Line breaks are sent as \n, which Excel stores as \r\n. If you write \r\n directly, the cell ends up with a stray _x000D_.

Development

Development needs Node 22.18 or later, which runs the .ts sources directly.

CommandWhat it does
npm run mcp / npm run loginRuns the server or the terminal sign-in from src/
npm run typecheckRuns tsc in strict mode with no emit
npm testRuns offline tests: range parsing, update composition, and the MCP handshake on src/ and dist/
npm run buildCompiles src/ to dist/, which is what npm, the .mcpb and the plugin run
npm run packBuilds, then writes build/*.mcpb (gitignored) and plugin/ (committed)

Layout:

PathContents
src/graph.tsAuth and the Graph client
src/excel.tsWorkbook operations
src/mcp.tsTools and the JSON-RPC server
src/cli.tsEntry point

Release

Bump version in package.json, run npm run pack, commit, then push a matching tag:

bash
git tag v0.3.1 && git push origin v0.3.1

The Publish workflow runs the tests, publishes to npm through trusted publishing (no token or OTP; provenance attached) and creates a GitHub release with the .mcpb attached.

Privacy

graph-excel-mcp has no server of its own and collects nothing. It signs in to Microsoft with a device code and keeps the refresh token only in ~/.graph-excel/token.json (mode 600) on your computer. It talks to Microsoft only — login.microsoftonline.com to sign in and graph.microsoft.com to read and write the workbooks you point it at. Cell contents go to Claude only when you ask for them, and are then handled under your Claude plan's terms. No telemetry, no third-party services.

Support

If graph-excel-mcp saves you time, you can support its development through GitHub Sponsors. Bug reports and pull requests are just as welcome.

License

MIT

Source: README.md at commit 7535b0a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.5.2LatestNov 7, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts