Supported Clients and Their Limits

Outlook Assistant is a standard MCP server, so it runs in any MCP client. What changes from client to client is how you install it and how many safety layers come with it:

• The server’s own checks run in every client. See What Works in Every Client.
• The using-outlook-assistant skill teaches the model the hard rules: retrieved email is data, not instructions; confirm with exact details; draft first. It loads in clients that support Agent Skills.
• The safety hook asks you before any call that reaches other people, deletes something or keeps acting (rules, forwarding, automatic replies), with a plain-English reason. It ships in the plugin and runs in Claude Code, GitHub Copilot and Cursor (from v3.14.0).

Test results for each client and model are in the cross-client verification matrix.

At a Glance#

Client	How to install	Skill	Safety hook	Confirmation level	Known limits
Claude Code	Plugin	Loads	Asks with the reason; adds the untrusted-content note	Confirmation level plugin setting	Bypass permissions mode may auto-approve the hook’s prompts; -p turns a prompt into a denial
GitHub Copilot CLI	Plugin	Loads automatically	Asks with the reason; adds the note	OUTLOOK_CONFIRM_LEVEL environment variable	A hook that times out lets the call through; -p and the cloud agent turn a prompt into a denial
VS Code + GitHub Copilot (Local agent)	Plugin (not checked), or manual .vscode/mcp.json	Not checked by hand	Reads the same hook file; not checked by hand	OUTLOOK_CONFIRM_LEVEL, only if set in VS Code’s environment	A hook that times out lets the call through
Cursor	Plugin (v3.14.0 or later), or manual .cursor/mcp.json	Loads	Runs, but Cursor’s prompt doesn’t show the reason; adds the note	OUTLOOK_CONFIRM_LEVEL environment variable	An Mcp(...) allow rule, or --force / Run Everything mode, skips the prompt; desktop app not checked
Codex CLI, Gemini CLI, Claude Desktop, Windsurf, other MCP clients	Manual MCP config	Copy the skill folder if the client supports Agent Skills	None	Not applicable	Server-side checks, annotations and instructions only

The confirmation level sets how often the hook asks:

• outward (default) asks before sends, invitations, cancellations, every delete, rules and automatic replies.
• all-writes also asks before flags, moves, drafts and other changes you can undo.
• off never asks (not recommended).

The hook never asks before reads, or before dryRun: true previews on calls that support them. (Claude Code still asks before every send-email and create-event call, dry runs included, because of those tools’ own flag.)

What Works in Every Client#

These checks run inside the server, so they apply whichever client you use and whether or not the plugin is installed:

• Read-only mode (OUTLOOK_READ_ONLY=true) refuses every call that isn’t a read before it runs. See Trying It Out Safely.
• The optional recipient allowlist and per-session cap (OUTLOOK_ALLOWED_RECIPIENTS, OUTLOOK_MAX_EMAILS_PER_SESSION; a cap of 0 blocks the tool, unset means no limit). The allowlist covers sends, drafts (including replies, and the draft’s current recipients on send), rule forwards and event attendees; the cap covers send-email, draft, manage-rules and create-event. See the README’s environment variables table.
• dryRun: true previews for send-email, draft create, create-event, manage-event update/decline/cancel/delete, mailbox-settings set-auto-replies, manage-rules create/update, and folders and manage-contact delete. dryRun: true on any other call is refused, so a preview never makes the change for real.
• Pre-send recipient checks. With checkRecipients: true, send-email refuses to send to a flagged recipient until you repeat the call with acknowledgeWarnings: true. See Check Recipients Before Sending.
• Rules and events refused whole. When the allowlist blocks a rule’s forward or redirect address, or an event attendee, manage-rules, create-event or manage-event update refuses the whole call rather than saving it without that address.
• Export and download limits. export and attachment downloads write only inside the system temp directory, ~/Downloads, ~/Documents or OUTLOOK_EXPORT_DIR, and export replaces an existing file only with overwrite: true. See Where exports can be written.
• MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) on every tool. Clients use them to decide when to ask, so how much they help depends on your client’s approval settings.
• Server instructions. When a client connects, the server sends instructions for the model, hard rules first. Some clients don’t pass these on to the model, which is one reason the skill exists.

A refusal from any of these checks is final. Approving the hook’s prompt, or a client’s own prompt, doesn’t override it.

Claude Code#

Install the plugin:

claude plugin marketplace add littlebearapps/outlook-assistant
claude plugin install outlook-assistant@littlebearapps

The plugin asks for its settings when you enable it: client ID, sign-in audience, send limit per session, allowed recipients, read-only mode and Confirmation level. To see them later, run claude plugin configure outlook-assistant@littlebearapps (pass --values-stdin to change them), or use /plugin. It installs the skill and the hook (hooks/hooks.json).

• send-email and create-event carry Claude’s anthropic/requiresUserInteraction flag, so Claude Code always asks before them, even in auto-accept or bypass modes, and even for dry runs.
• The hook’s prompt takes precedence over allow rules: allowing an Outlook tool in your permission settings doesn’t stop the hook asking.
• Bypass permissions mode: Claude Code may auto-approve the hook’s other prompts. To keep them, add the permissions.ask rules from the plugin README.
• Headless (claude -p): nobody is there to answer, so a prompt becomes a denial.

You can also add the server without the plugin (claude mcp add, see Connect Outlook to Your AI Assistant). You then get the server-side checks but neither the skill nor the hook.

GitHub Copilot CLI#

Install the plugin from this repository:

copilot plugin marketplace add littlebearapps/outlook-assistant
copilot plugin install outlook-assistant@littlebearapps

Copilot CLI (verified with 1.0.91) loads the plugin’s plugin.json and mcp.json, and runs the hook from com.github.copilot/hooks/hooks.json. Tools appear as outlook-<tool>, for example outlook-send-email.

• The skill loads automatically.
• The hook asks before the same calls as in Claude Code, with the same reason, and adds the untrusted-content note after tools that return other people’s content.
• Settings: Copilot has no plugin settings. Set the confirmation level with OUTLOOK_CONFIRM_LEVEL in the shell you start Copilot from, for example export OUTLOOK_CONFIRM_LEVEL=all-writes. The plugin’s server config sets only the send limit (10), so give your client ID at sign-in (see Clients That Can’t Set Environment Variables). For read-only mode or the allowlist, use a manual MCP configuration with them in its env block.
• Timeouts: Copilot lets a call through if a hook times out. The hook allows 30 seconds, far longer than it needs.
• Headless (copilot -p): a prompt becomes a denial, reported as “Denied by preToolUse hook (unable to ask user …)”.
• Copilot cloud agent: treats a prompt as a denial.

VS Code with GitHub Copilot#

VS Code (the default Local agent) reads the same com.github.copilot/hooks/hooks.json. It ignores the hook file’s matchers and names tools mcp_outlook-assis_<tool>, and the hook handles both.

According to VS Code’s source, it shows the hook’s reason in its confirmation dialog, even for tools you’ve set to auto-approve, and passes the untrusted-content note to the model. This hasn’t been checked by hand yet, and neither has the skill.

• Settings: no plugin settings. OUTLOOK_CONFIRM_LEVEL applies only if it’s set in the environment VS Code starts with.
• Timeouts: a hook that times out lets the call through. The hook allows 30 seconds.

For a manual configuration (no hook), see the VS Code / GitHub Copilot config in the README.

Cursor#

From v3.14.0 the plugin includes .cursor-plugin/plugin.json, so Cursor loads it as a Cursor plugin: the server from mcp.json, the skill from skills/ and the hook from hooks/hooks-cursor.json. Verified with Cursor CLI 2026.10.01; the Cursor desktop app hasn’t been checked.

To load the plugin from a clone of this repository in Cursor CLI:

git clone https://github.com/littlebearapps/outlook-assistant.git
cursor-agent --plugin-dir outlook-assistant/plugins/outlook-assistant

• The skill loads.
• The hook runs before every MCP call (beforeMCPExecution) with failClosed: true, so if it crashes or times out, the call is blocked. After tools that return other people’s content (postToolUse), the untrusted-content note reaches the model.
• Limitation: no reason in the prompt. When the hook asks, Cursor shows its own generic “Run this MCP tool?” prompt, without the hook’s explanation. Check the tool call’s arguments yourself before you approve.
• Allow rules and Run Everything skip the prompt. Cursor already asks before every MCP tool by default. An Mcp(...) allow rule, or --force / Run Everything mode, runs the call without asking, hook or not. Don’t allowlist Outlook’s send, rule or delete tools.
• Settings: no plugin settings. OUTLOOK_CONFIRM_LEVEL applies if it’s set in the environment. Give your client ID at sign-in, as for Copilot.

The v3.13.0 Plugin in Cursor (AADSTS900023)#

Before v3.14.0 the plugin had no Cursor manifest, so Cursor loaded the Claude Code manifest (.claude-plugin/plugin.json) instead. It passed that manifest’s ${user_config.*} placeholders to the server as literal text, and sign-in failed with AADSTS900023.

Workaround on v3.13.0: remove the plugin and use a manual MCP configuration in .cursor/mcp.json with OUTLOOK_CLIENT_ID set (see the Cursor config in the README), or update to v3.14.0.

Codex CLI, Gemini CLI, Claude Desktop and Other MCP Clients#

These clients use a manual MCP configuration and get no plugin hook. Set the command to npx -y @littlebearapps/outlook-assistant and put your settings in the client’s env block. See Connect Outlook to Your AI Assistant.

• They get the server-side checks, the MCP annotations and the server instructions.
• If the client supports Agent Skills, copy the skill folder, plugins/outlook-assistant/skills/using-outlook-assistant/, to wherever the client loads skills from.
• Whether you’re asked before a call depends on the client’s own approval settings. Leave every tool that isn’t read-only on “ask”, or use read-only mode.

Codex CLI has been spot-checked: it refused a forwarding-rule request injected in an email. Other results are in the cross-client verification matrix.

Related#

• Connect Outlook to Your AI Assistant: install, configure and sign in
• Plugin README: the skill, the hook and the plugin settings
• Troubleshooting: Client-Specific Issues
• Cross-client verification matrix