I Rewrote a OneNote MCP Server in TypeScript — Here's What I Learned About Microsoft Graph Auth

Short summary

The author rewrote a OneNote MCP server in TypeScript after hitting a 401 error caused by requesting application-level .All scopes that personal Microsoft accounts cannot consent to. The fix was switching to resource-qualified delegated scopes. The rewrite also replaced 10 standalone scripts with a clean modular structure, added Zod-typed tool schemas, removed unnecessary dependencies, and used stderr-only logging to keep stdout clean for JSON-RPC. Practical lessons on MCP architecture and Microsoft Graph authentication.

• •Personal Microsoft accounts silently fail with .All scopes — use delegated scopes instead
• •Rewrote 10 standalone JS scripts into a clean TypeScript MCP server with Zod schemas
• •stderr-only logging is critical since stdout carries JSON-RPC for MCP

Generated with AI, which can make mistakes.