I Rewrote a OneNote MCP Server in TypeScript — Here's What I Learned About Microsoft Graph Auth

Short summary

A developer shares lessons from rewriting a OneNote MCP (Model Context Protocol) server in TypeScript, focusing on a critical Microsoft Graph auth bug: personal Microsoft accounts silently fail with .All application-level scopes, returning 401 errors despite successful authentication. The fix is using resource-qualified delegated scopes. The rewrite also replaced 10 standalone scripts with a clean modular structure, added Zod schemas for tool parameters, and removed unnecessary dependencies like jsdom and node-fetch.

• •Personal Microsoft accounts cannot consent to .All application scopes — use delegated scopes like Notes.Read instead
• •MCP servers communicate over stdio with JSON-RPC on stdout and diagnostics on stderr
• •Rewrite added Zod-typed tool schemas, modular architecture, and removed unnecessary dependencies

Generated with AI, which can make mistakes.