Add an EWS connector type: on-premises Exchange mailboxes

Đang mở
  • Có gì không ổn?
#1,650 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
15/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
typescript
Lĩnh vực
authentication, backend

Hướng nghiên cứu

Start by reading how the EMAIL and ODATA connector types are wired: the ConnectorType enum, the migration 20261030100000_add_email_connector_type, and the engine that dispatches on type. Then check how fast-xml-parser and the outbound SSRF guard (SSRF_ALLOWED_HOSTS) are used. This is design work with an NTLMv2 implementation, so agree the scope with maintainers first. Done means an EWS type with the listed tools, passing the NTLM test vectors and the in-process EWS server tests.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Problem

The catalog cannot reach a mailbox on an on-premises Exchange server. The Outlook connector uses Microsoft Graph, which only exists for Microsoft 365 and Outlook.com. The Email (IMAP/SMTP) connector needs IMAP and SMTP to be enabled and reachable, cannot attach files to outgoing mail (so it cannot really forward), and on AnythingMCP Cloud its SMTP ports are blocked by the hosting network. Companies that run Exchange 2016, 2019 or Subscription Edition themselves, without Microsoft 365, have nothing to install.

Exchange Web Services (EWS) is on by default on those servers, because Outlook uses it. It runs over HTTPS on port 443, replies and forwards on the server (with the original's attachments), files sent mail itself and gives access to calendars and contacts later.

Microsoft is retiring EWS in Exchange Online (off by default since 1 October 2026, permanently on 1 April 2027) but not in Exchange Server. This connector is for on-premises Exchange; Exchange Online stays on the Outlook (Graph) connector.

Proposal

A new connector type EWS with its own engine and a fixed tool set, as the EMAIL and ODATA types have. The generic SOAP engine is not a fit: a WSDL import would make the model write nested EWS XML, and it has no NTLM.

Schema change
  • ConnectorType gains the value EWS.
  • Migration: ALTER TYPE "ConnectorType" ADD VALUE 'EWS'; in a new timestamped folder, same shape as 20261030100000_add_email_connector_type.
  • No new tables or columns, and no new AuthType. Non-secret settings live in connector.config.ews (server, auth method, domain, shared mailbox, certificate options); the username and password live in the encrypted authConfig (BASIC_AUTH).
Built-in tools

Prefixed per connector: list folders, search messages, get message, get attachment, set flags (read/unread, flagged), set categories, move messages, delete (to Deleted Items, never a hard delete), save draft (new, reply, reply all or forward), send message and send draft. Reads are annotated read-only, delete is destructive, the two sending tools are open-world. Delete and both sending tools are created switched off, and results that carry mail content say that it is untrusted text from the sender, as on the Email connector.

Authentication
  • NTLMv2 (what the EWS virtual directory offers by default) and Basic (only when an administrator enabled it), chosen from the server's WWW-Authenticate answer or fixed in the settings. Kerberos and OAuth are out of scope.
  • NTLM is implemented in the backend, with the message integrity code and the TLS channel binding that Extended Protection asks for. No maintained npm NTLM client supports channel binding, and Node's crypto no longer offers MD4.
  • No new runtime dependency: SOAP requests are templates, answers are parsed with the existing fast-xml-parser.
Behaviour in both deployment modes
  • Cloud: HTTPS only, the outbound SSRF guard applies (private, loopback and link-local addresses refused), the certificate must be valid. The Exchange server has to be reachable from the internet; the connector page shows the outbound address to allow.
  • Self-hosted: the same guard with the admin allowlist (SSRF_ALLOWED_HOSTS / Admin → Settings) for an internal server, and an opt-in "accept self-signed certificate" switch for an internal certificate authority.
  • One HTTPS connection per tool call, closed afterwards; connect and response timeouts and a response size cap. Credentials never reach a log line or an error message.
Tests

Unit tests against the published NTLM test vectors, request XML validated against Microsoft's EWS schemas, and an in-process EWS server (HTTPS, NTLM and Basic, in-memory mailbox) for the tool flows inside Jest. A live spec, gated behind RUN_EWS_LIVE=1, checks a real server read-only.

Catalog and docs

A catalog adapter "Exchange (EWS)" in category email with a setup guide (service account, shared mailbox rights, auth method, firewall), and docs/connectors/ews.md.

Later

Calendar (availability, events), contacts, Autodiscover.

Ngôn ngữ chính
TypeScript
Star
856
Fork
82
Merge trung bình
4 giờ 32 phút
Pull request đã merge (30 ngày)
468

Chuẩn bị môi trường

Dự án này không cung cấp dev container, Dockerfile hay hướng dẫn đóng góp, nên bạn cần tự thiết lập môi trường: hãy bắt đầu từ README và xem hướng dẫn đóng góp lần đầu của chúng tôi để biết các bước chung.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của HelpCode-ai/anythingmcp

Tất cả issue của HelpCode-ai/anythingmcp

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.