Add an EWS connector type: on-premises Exchange mailboxes

未关闭
  • 哪里不对？
#1,650 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
15/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
typescript
领域
authentication, backend

调研方向

Start by reading how the EMAIL and ODATA connector types are wired: the ConnectorType enum, the migration 20261030100000_add_email_connector_type, and the engine that dispatches on type. Then check how fast-xml-parser and the outbound SSRF guard (SSRF_ALLOWED_HOSTS) are used. This is design work with an NTLMv2 implementation, so agree the scope with maintainers first. Done means an EWS type with the listed tools, passing the NTLM test vectors and the in-process EWS server tests.

由索引模型根据 Issue 内容生成。

描述

Problem

The catalog cannot reach a mailbox on an on-premises Exchange server. The Outlook connector uses Microsoft Graph, which only exists for Microsoft 365 and Outlook.com. The Email (IMAP/SMTP) connector needs IMAP and SMTP to be enabled and reachable, cannot attach files to outgoing mail (so it cannot really forward), and on AnythingMCP Cloud its SMTP ports are blocked by the hosting network. Companies that run Exchange 2016, 2019 or Subscription Edition themselves, without Microsoft 365, have nothing to install.

Exchange Web Services (EWS) is on by default on those servers, because Outlook uses it. It runs over HTTPS on port 443, replies and forwards on the server (with the original's attachments), files sent mail itself and gives access to calendars and contacts later.

Microsoft is retiring EWS in Exchange Online (off by default since 1 October 2026, permanently on 1 April 2027) but not in Exchange Server. This connector is for on-premises Exchange; Exchange Online stays on the Outlook (Graph) connector.

Proposal

A new connector type EWS with its own engine and a fixed tool set, as the EMAIL and ODATA types have. The generic SOAP engine is not a fit: a WSDL import would make the model write nested EWS XML, and it has no NTLM.

Schema change
  • ConnectorType gains the value EWS.
  • Migration: ALTER TYPE "ConnectorType" ADD VALUE 'EWS'; in a new timestamped folder, same shape as 20261030100000_add_email_connector_type.
  • No new tables or columns, and no new AuthType. Non-secret settings live in connector.config.ews (server, auth method, domain, shared mailbox, certificate options); the username and password live in the encrypted authConfig (BASIC_AUTH).
Built-in tools

Prefixed per connector: list folders, search messages, get message, get attachment, set flags (read/unread, flagged), set categories, move messages, delete (to Deleted Items, never a hard delete), save draft (new, reply, reply all or forward), send message and send draft. Reads are annotated read-only, delete is destructive, the two sending tools are open-world. Delete and both sending tools are created switched off, and results that carry mail content say that it is untrusted text from the sender, as on the Email connector.

Authentication
  • NTLMv2 (what the EWS virtual directory offers by default) and Basic (only when an administrator enabled it), chosen from the server's WWW-Authenticate answer or fixed in the settings. Kerberos and OAuth are out of scope.
  • NTLM is implemented in the backend, with the message integrity code and the TLS channel binding that Extended Protection asks for. No maintained npm NTLM client supports channel binding, and Node's crypto no longer offers MD4.
  • No new runtime dependency: SOAP requests are templates, answers are parsed with the existing fast-xml-parser.
Behaviour in both deployment modes
  • Cloud: HTTPS only, the outbound SSRF guard applies (private, loopback and link-local addresses refused), the certificate must be valid. The Exchange server has to be reachable from the internet; the connector page shows the outbound address to allow.
  • Self-hosted: the same guard with the admin allowlist (SSRF_ALLOWED_HOSTS / Admin → Settings) for an internal server, and an opt-in "accept self-signed certificate" switch for an internal certificate authority.
  • One HTTPS connection per tool call, closed afterwards; connect and response timeouts and a response size cap. Credentials never reach a log line or an error message.
Tests

Unit tests against the published NTLM test vectors, request XML validated against Microsoft's EWS schemas, and an in-process EWS server (HTTPS, NTLM and Basic, in-memory mailbox) for the tool flows inside Jest. A live spec, gated behind RUN_EWS_LIVE=1, checks a real server read-only.

Catalog and docs

A catalog adapter "Exchange (EWS)" in category email with a setup guide (service account, shared mailbox rights, auth method, firewall), and docs/connectors/ews.md.

Later

Calendar (availability, events), contacts, Autodiscover.

主要语言
TypeScript
星标
856
派生
82
平均合并
4 小时 32 分钟
30 天内合并 PR
468

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

HelpCode-ai/anythingmcp 的其他 Issue

查看 HelpCode-ai/anythingmcp 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。