Microsoft Planner

io.github.mspstackPublished by GitHub account mspstackv0.4.0Updated Oct 24, 2026

Microsoft Planner MCP server — plans, buckets, tasks via Microsoft Graph, ETags handled

The publisher's own server: Microsoft Learn MCP

Overview

AI-generated overview

Lets an assistant manage Microsoft Planner plans, buckets and tasks through Microsoft Graph, with ETag concurrency handled automatically.

What you can do
Wraps the Microsoft Graph Planner surface: search Microsoft 365 groups and users, list plans and buckets, and list tasks by plan, bucket or assignee. It can create, update, assign, complete and permanently delete tasks, including descriptions and checklist items. An optional advanced toolset adds a read-only Graph GET escape hatch limited to /planner, /groups and /users paths.
When to use it
Use it when an assistant should work with Microsoft Planner task boards inside a Microsoft 365 tenant — looking up plans and assignments, or creating and updating tasks on a team's behalf. It suits teams already using Planner who want task management driven from an AI client rather than the Planner UI.
Requirements
Runs locally over stdio via npx (Node.js), or in HTTP mode on a port. Needs an Entra ID app registration with application permissions Tasks.ReadWrite.All, GroupMember.Read.All and User.Read.All plus admin consent, and the environment variables MS_TENANT_ID, MS_CLIENT_ID and MS_CLIENT_SECRET. Delegated mode instead uses a public client registration and MS_REFRESH_TOKEN. Desktop only.
Before you install
MS_CLIENT_SECRET is a secret and the app registration's Graph permissions are the only access control, so a broad registration grants broad reach. Tasks can be created, changed and permanently deleted, and writes are attributed to the app or, in delegated mode, to the signed-in user. MS_REFRESH_TOKEN acts as that user and stays valid about 90 days past last use. HTTP mode accepts per-request credentials via x-ms-tenant-id, x-ms-client-id, x-ms-client-secret or x-ms-refresh-token headers.

Installation

In SourceWeft

  1. Open Microsoft Planner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-planner

MCP server for Microsoft Planner via the Microsoft Graph API. Find groups and plans, list buckets and tasks, and create, update, assign, complete, or delete tasks — including descriptions and checklists — with Planner's ETag concurrency handled automatically.

Sibling project to mcp-itglue and mcp-connectwise-psa — same architecture.

Tools

ToolDescription
planner_search_groupsFind Microsoft 365 groups (Teams) by name → group ID
planner_find_userFind a user by name/UPN → user ID for assignments
planner_list_plansList plans owned by a group
planner_get_planPlan + its buckets
planner_create_bucketCreate a bucket in a plan
planner_list_tasksTasks in a plan or bucket (filter by assignee, open/completed)
planner_list_user_tasksAll tasks assigned to a user, across plans
planner_get_taskTask with description and checklist
planner_create_taskCreate task (bucket, due date, priority, assignees, description)
planner_update_taskUpdate title/bucket/due/priority/progress/assignees
planner_update_task_detailsUpdate description; add or (un)check checklist items
planner_delete_taskPermanently delete a task
graph_find_endpoint †Search a curated catalog of the /planner, /groups, /users Graph surface
graph_get †Read-only GET for any Graph v1.0 path under /planner, /groups, /users

† Advanced toolset (opt-in, off by default) — an escape hatch for Graph surface the curated tools don't wrap. Enable with PLANNER_ADVANCED_TOOLSET=true or --advanced. graph_get is verb-locked to GET, rejects /beta, and only reaches the three path prefixes above, so a shared app registration's other permissions (e.g. mail) stay out of reach.

Setup

1. Entra ID app registration

  1. Entra admin center → App registrations → New registration
  2. API permissions → Application permissions → add Tasks.ReadWrite.All, GroupMember.Read.All, User.Read.All → Grant admin consent
  3. Certificates & secrets → New client secret — note the value

2. Run

bash
MS_TENANT_ID=<tenant> MS_CLIENT_ID=<client-id> MS_CLIENT_SECRET=<secret> npx -y mcp-planner

Claude Code:

bash
claude mcp add planner --env MS_TENANT_ID=<tenant> --env MS_CLIENT_ID=<client-id> --env MS_CLIENT_SECRET=<secret> -- npx -y mcp-planner

HTTP mode

bash
npx -y mcp-planner --transport http --port 3000

Sessions authenticate per-request (BYOK) with x-ms-tenant-id + x-ms-client-id plus either x-ms-client-secret (app-only) or x-ms-refresh-token (delegated — see below), or fall back to the MS_* environment credentials when set. When both a secret and a refresh token arrive, the refresh token wins (header-overlay proxies can add but not remove headers). Health probe at GET /health.

Delegated mode — act as the signed-in user

App-only sessions act as the app registration; delegated sessions act as a user: their Planner permissions apply and every write is attributed to them.

  1. A separate, public app registration: Authentication → Allow public client flows → Yes; API permissions → Delegated Tasks.ReadWrite, Group.Read.All, User.ReadBasic.All (+ admin consent where the tenant requires it).
  2. Each user signs in once via the device-code helper and keeps the printed refresh token:
bash
node scripts/device-login.mjs --tenant <tenant-id> --client <public-client-id>
  1. Use MS_REFRESH_TOKEN instead of MS_CLIENT_SECRET (stdio), or the x-ms-refresh-token header (HTTP). Behind the MCP gateway, register it as a personal credential (field x-ms-refresh-token).

The refresh token is a secret — it acts as you — and stays valid ~90 days past its last use; re-run the helper when it expires.

Docker

bash
docker build -t mcp-planner .docker run -p 3000:3000 -e MS_TENANT_ID=... -e MS_CLIENT_ID=... -e MS_CLIENT_SECRET=... mcp-planner

Access model

No MCP-level role gating: the Entra app registration's granted Graph permissions are the access control. Point sessions at different app registrations (BYOK headers) to scope what they can do.

Notes

  • Planner requires an If-Match ETag on every update/delete — the tools fetch the current resource and pass its ETag automatically. On a 412 (concurrent change), just retry.
  • Priority mapping: urgent=1, important=3, medium=5, low=9 (Graph uses 0–10).
  • Progress: not started (0), in progress (50), completed (100).

Development

bash
npm installnpm run dev        # stdionpm run dev:http   # httpnpm testnpm run buildnpm run bundle     # Claude Desktop .mcpb

License

MIT

Source: README.md at commit 0d89d41

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.4.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Microsoft integrations