Merge Unified's SharePoint integration Merge Agent Handler's SharePoint MCP server

Connect your AI Agents to SharePoint in minutes

Merge lets you securely connect your agents to SharePoint and thousands of tools instantly

Start building for free

Read docs

SharePoint

Learn more about Merge Agent Handler

Available tools

files_list_drive_items

List all files and folders in a SharePoint document library folder. Requires driveId (from siteslistdrives). Defaults to root folder. Supports OData filter, orderby, and pagination via top/skip

files_get_drive_item

Get detailed information about a specific file or folder. Requires driveId (from siteslistdrives) and itemId. Use select for a lean response (comma-separated field names), and expand to include children, listItem, thumbnails, or analytics (comma-separated).

files_create_folder

Create a new folder in a SharePoint document library. Requires driveId (from siteslistdrives) and parentId

files_update_item

Update file or folder name or description. Requires driveId (from siteslistdrives) and itemId

files_delete_item

Delete a file or folder from a SharePoint document library. Requires driveId (from siteslistdrives) and itemId

files_search_drive_items

Search for files and folders in a SharePoint document library by query text. Requires driveId (from siteslistdrives) and query

files_search_all

Search for files across ALL SharePoint sites and OneDrive. Does not require a drive ID. Use for broad discovery queries like 'Q4 report'. Supports KQL syntax. Use fromindex for pagination. For authoritative file size and timestamps, fetch the item with filesgetdriveitem.

files_download_item

Download a file from SharePoint. Returns UTF-8 text or base64 content, capped at 10 MB. Set returndownloadurl=true for a short-lived download URL instead, which handles larger files. Provide: (1) driveid + itemid, (2) driveid + itempath relative to the drive root, e.g. 'report.docx' — do not prefix the library name, or (3) web_url from search/list results.

files_upload_item

Upload a new file to a SharePoint document library. Requires driveid (from siteslistdrives) and a filename. Provide content inline (text or base64, up to 10 MB) OR a filereference from the file upload API for larger files. Target the folder with parentid OR parentpath (defaults to the drive root). Use conflict_behavior to rename/replace/fail on name collisions.

list_items_get_all

Get all items from a SharePoint list. Requires siteId and listId. Use siteslistlists to find list IDs. Supports OData filter, expand, orderby, and pagination via top/skip. Filtering/sorting on a non-indexed column can intermittently fail on large lists rather than erroring consistently -- retry once before assuming the filter is invalid

list_items_get_by_id

Get a specific SharePoint list item by ID. Requires siteId, listId (from siteslistlists), and itemId

list_items_create

Create a new item in a SharePoint list. Requires siteId, listId (from siteslistlists), and fields object. Use listgetcolumns to discover available fields

list_items_update

Update an existing SharePoint list item. Requires siteId, listId (from siteslistlists), itemId, and fields to update

list_items_delete

Delete a SharePoint list item. Requires siteId, listId (from siteslistlists), and itemId

list_get_columns

Get all columns/fields for a SharePoint list. Requires siteId and listId (from siteslistlists). Use before listitemscreate to discover available fields

sites_create_list

Create a new SharePoint list. Requires siteid (from sitesgetroot or sitesgetbyhostname). Returns existing list info if a list with the same name already exists.

lists_get_by_id

Get a SharePoint list by ID. Requires siteId and listId (from siteslistlists)

lists_get_by_title

Get a SharePoint list by its display title. Requires siteId and listTitle

lists_update

Update a SharePoint list's display name or description. Requires siteId and listId (from siteslistlists)

lists_delete

Delete a SharePoint list and all its items. Requires siteId and listId (from siteslistlists)

lists_list_columns

List all columns in a SharePoint list. Requires siteId and listId (from siteslistlists). Use to discover field names before creating items

lists_create_column

Create a new column in a SharePoint list. Requires siteId, listId (from siteslistlists), column name, and column_type

lists_update_column

Update a column's display name, description, or required flag. Requires siteId, listId, and columnId (from listslistcolumns)

lists_delete_column

Delete a column from a SharePoint list. Requires siteId, listId, and columnId (from listslistcolumns)

sites_get_root

Get the organization's default SharePoint root site. Returns siteId needed by other tools. Call this first to discover available sites

sites_get_by_id

Get a specific SharePoint site by ID. Requires siteId (from sitesgetroot or sitesgetby_hostname)

sites_get_by_hostname

Get a SharePoint site by hostname (e.g. contoso.sharepoint.com). Returns siteId needed by other tools

sites_get_by_path

Get a SharePoint site by hostname and server-relative path. Returns siteId needed by other tools

sites_get_group_root

Get a Microsoft 365 group's team site. Requires groupId. Returns siteId needed by other tools

sites_update

Update a SharePoint site's display name or description. Requires siteId (from sitesgetroot or sitesgetby_hostname)

sites_list_drives

List all document libraries (drives) for a SharePoint site. Requires siteId. Returns driveId values needed by files_* tools

sites_list_lists

List all lists in a SharePoint site. Requires siteId. Returns listId values needed by listitems* and listgetcolumns tools

sites_list_columns

List site-level columns for a SharePoint site. Requires siteId (from sitesgetroot or sitesgetby_hostname)

validate_credential

Validate SharePoint credentials. Verifies credentials during setup.

View all tools by creating a free account See more tools

How to set up Merge Agent Handler

In an mcp.json file, add the configuration below, and restart Cursor.

Learn more in the official documentation ↗

1{
2  "mcpServers": {
3    "agent-handler": {
4      "url": "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
5      "headers": {
6        "Authorization": "Bearer yMt*****"
7      }
8    }
9  }
10}
11

Copy Code

Open your Claude Desktop configuration file and add the server configuration below. You'll also need to restart the application for the changes to take effect.

Make sure Claude is using the Node v20+.

Learn more in the official documentation ↗

1{
2  "mcpServers": {
3    "agent-handler": {
4      "command": "npx",
5      "args": [
6        "-y",
7        "mcp-remote@latest",
8        "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
9        "--header",
10        "Authorization: Bearer ${AUTH_TOKEN}"
11      ],
12      "env": {
13        "AUTH_TOKEN": "yMt*****"
14      }
15    }
16  }
17}

Copy Code

Open your Windsurf MCP configuration file and add the server configuration below.
Click on the refresh button in the top right of the Manage MCP server page or in the top right of the chat box in the box icon.

Learn more in the official documentation ↗

1{
2    "mcpServers": {
3      "agent-handler": {
4        "command": "npx",
5        "args": [
6          "-y",
7          "mcp-remote@latest",
8          "https://ah-api.merge.dev/api/v1/tool-packs/<tool-pack-id>/registered-users/<registered-user-id>/mcp",
9          "--header",
10          "Authorization: Bearer ${AUTH_TOKEN}"
11        ],
12        "env": {
13          "AUTH_TOKEN": "<ah-production-access-key>"
14        }
15      }
16    }
17  }

Copy Code

In Command Palette (Cmd+Shift+P on macOS, Ctrl+Shift+P on Windows), run "MCP: Open User Configuration".

You can then add the configuration below and press "start" right under servers. Enter the auth token when prompted.

Learn more in the official documentation ↗

1{
2  "inputs": [
3    {
4      "type": "promptString",
5      "id": "agent-handler-auth",
6      "description": "Agent Handler AUTH_TOKEN", // "yMt*****" when prompt
7      "password": true
8    }
9  ],
10  "servers": {
11    "agent-handler": {
12      "type": "stdio",
13      "command": "npx",
14      "args": [
15        "-y",
16        "mcp-remote@latest",
17        "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
18        "--header",
19        "Authorization: Bearer ${input:agent-handler-auth}"
20      ]
21    }
22  }
23}

Copy Code

FAQs on using Merge's SharePoint MCP server

How can I use the SharePoint MCP server?

Here are just a few agentic use cases you can implement:

Orphaned file cleanup: Your agent can identify files that haven't been accessed in months, check if they're referenced in active projects, and either archive them to cold storage or flag them for deletion to free up space

Version control management: Your agent can monitor critical documents for changes, automatically create major versions at key milestones (like contract signing or design approval), and notify stakeholders when files are reverted to previous versions

Storage optimization: Your agent can scan libraries for duplicate files, identify large media files that could be compressed or archived, and generate reports on storage consumption by team or project to help manage capacity

Knowledge base maintenance: Your agent can monitor support tickets and automatically update SharePoint wiki pages, FAQ lists, and documentation libraries with new troubleshooting steps, product updates, or commonly-asked questions

Site provisioning: Your agent can automatically create new SharePoint team sites or project workspaces when deals close or projects kick off, configure permissions groups, and populate them with standardized libraries and lists

What are popular tools for SharePoint’s MCP server?

Here are some popular tools across data types:

Sites

<code class="blog_inline-code">sites_get_root</code>
<code class="blog_inline-code">sites_get_by_id</code>
<code class="blog_inline-code">sites_list_drives</code>
<code class="blog_inline-code">sites_list_columns</code>

Files

<code class="blog_inline-code">files_list_drive_items</code>
<code class="blog_inline-code">files_get_drive_item</code>
<code class="blog_inline-code">files_create_folder</code>
<code class="blog_inline-code">files_delete_item</code>

Lists

<code class="blog_inline-code">list_items_get_all</code>
<code class="blog_inline-code">list_items_create</code>
<code class="blog_inline-code">list_items_update</code>
<code class="blog_inline-code">list_items_delete</code>

What makes Merge Agent Handler’s SharePoint MCP server better than alternative SharePoint MCP servers?

Here are just a few reasons:

Authentication and credential management: Agent Handler supports dynamic authorization flows and manages credentials for third-party systems, reducing the need for custom auth logic in your agent

Enterprise-grade security and DLP: All tool inputs and outputs are scanned through a security gateway with data loss prevention rules that can block, redact, or mask sensitive data

Real-time observability and auditability: Every tool call is logged, with fully-searchable logs that allow teams to audit, debug, and optimize agent behavior across SharePoint interactions

Can I set custom security rules for SharePoint tool calls in Merge Agent Handler?

You can set a wide range of rules. Here are just a few examples:

Social security numbers: Block any <code class="blog_inline-code">create_list_item</code> or <code class="blog_inline-code">update_page</code> tool calls that contain SSN patterns in SharePoint list fields, page content, or metadata before they're written to your intranet

API keys and tokens: Prevent agents from uploading or updating SharePoint documents that contain API keys, OAuth tokens, or other credentials in code snippets or configuration files

Internal employee IDs: Mask employee identification numbers when agents read HR policy documents or personnel directories from SharePoint, showing only partial identifiers (e.g., EMP*789)

Salary and compensation data: Block or redact salary figures, bonus amounts, and compensation details when agents retrieve content from SharePoint HR libraries or financial planning sites

How can I start using Merge Agent Handler’s SharePoint MCP server?

Here are the steps you can take:

1. Sign up for Agent Handler. Create a free Merge Agent Handler account here.

2. Create a Tool Pack. A Tool Pack is a collection of connectors (like SharePoint, Slack, etc.) that your agent can access.

In the dashboard, go to Tool Packs. Click "Create New Tool Pack" and select the SharePoint connector from the available connectors. You can then name your Tool Pack (e.g., "SharePoint Access Pack")

3. Register a user and authenticate to SharePoint. Create a Registered User in Agent Handler (this represents an end user who will authenticate to SharePoint). You can provide an identifier for the user (e.g., email or user ID).

4. Collect your configuration details. You'll need three pieces of information to configure your MCP client:

Tool Pack ID: Found in your Tool Pack's URL or settings
Registered User ID: Found in the Registered Users section
API Key: Generate this from your Agent Handler account settings or API keys section (starts with something like "cx-" or similar)

5. Configure your IDE or AI platform. Choose the setup that matches your development environment.

6. Verify the connection. Open your AI assistant or agent interface. You should see the SharePoint tools available in the tools/context menu. And if you’re using an IDE like Cursor, you'll see "MCP Server: agent-handler" in the bottom right

7. Start using SharePoint tools. Try test prompts like:

"List the files in my SharePoint library"
"Search for documents containing 'Q4 budget' in SharePoint"
"Upload this report to the Marketing folder in SharePoint"
"Show me recent updates to the HR policies site"

Can employees use Merge Agent Handler to connect their AI tools to SharePoint?

Yes, Agent Handler for Employees lets your employees connect Claude, ChatGPT, Microsoft Copilot, Cursor, and other MCP-compatible AI tools to SharePoint without bypassing IT governance.

Instead of setting up direct connections with personal credentials that IT can't monitor or revoke, each employee authenticates through Agent Handler and gets individual credentials tied to their identity.

IT also provisions access by role or group via SCIM. A knowledge worker, for example, gets SharePoint access to search and retrieve internal documents, Google Drive to access shared files, and Slack to coordinate with teammates; while a legal team member gets SharePoint access to retrieve contracts and policies, Salesforce to track client records, and DocuSign to monitor signature status.

Every tool call an employee's AI makes to SharePoint is also inspected against your DLP rules and logged to a searchable audit trail, giving security teams full visibility into what data was accessed and by whom.