| TEAMS_WS_PORT | No | fetchproxy concentrator port used for the browser bridge. Defaults to 37149, the fleet-wide shared port. |
| FETCHPROXY_WS_HOST | No | Bind interface for the bridge (default 127.0.0.1; a literal IP only, anything else is ignored). Keep on loopback — it exists for ONE topology: a hosted child in its own network namespace. |
| FETCHPROXY_IDENTITY_DIR | No | Where to store the long-term fetchproxy identity keypair (default ~/.fetchproxy/identity/; an absolute path only, anything else is ignored). Exists for a host that runs a separate child per caller, so they can share one identity. |
| TEAMS_ACCESS_TOKEN | No | A pre-obtained Teams chat-service bearer token (the JWT itself). Leave blank to capture one from your signed-in Teams browser tab via the ContextMint Bridge extension. Secret. |
| TEAMS_DISABLE_FETCHPROXY | No | Set to true to never capture a token from the browser; then TEAMS_ACCESS_TOKEN is required. Leave blank. |
| TEAMS_CHATSVC_REGION | No | The Teams chat-service region in the API path. Defaults to amer. Leave blank unless your tenant lives elsewhere. |
| TEAMS_CHATSVC_BASE | No | Full override for the chat-service API base (default https://teams.cloud.microsoft/api/chatsvc/<region>/v1). Leave blank. |
| TEAMS_CAPTURE_TIMEOUT | No | Seconds to wait for the Teams tab to issue a chat-service request when capturing a token. Defaults to 30. |
| TEAMS_TOKEN_CACHE | No | Set to false to keep the captured token in memory only. Defaults to on: it is cached so a restart within its ~23h lifetime needs no browser. |
| TEAMS_TOKEN_FILE | No | Where the captured token is cached. Defaults to ~/.microsoft-teams-mcp/token.json. |
| TEAMS_SUBSTRATE_TOKEN_FILE | No | Where the captured Substrate search token is cached. Defaults to ~/.microsoft-teams-mcp/substrate-token.json. |
| TEAMS_SHAREPOINT_TOKEN_FILE | No | Where the captured SharePoint tokens are cached. Defaults to ~/.microsoft-teams-mcp/sharepoint-tokens.json. |
| TEAMS_TIME_ZONE | No | Default IANA time zone (e.g. America/New_York) for time_local on read results. Unset means UTC only. |
| MCP_CONFIRM_MODE | No | What the writes (teams_send_message, teams_react, teams_mark_read and the read tools' mark_read) do on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop): "ask-user" (default: the first call returns a preview and a confirmToken, and the model must get your approval in chat before using it), "auto" (the model may use the token after reviewing the preview itself) or "refuse". An unrecognised value is treated as refuse. |
| MCP_CONFIRM_ELICITATION | No | "off" never shows a confirmation prompt, so every client gets the MCP_CONFIRM_MODE flow. Set it for a client that says it can show prompts but never does. Defaults to on. |
| MCP_CONFIRM_TTL_SECONDS | No | How long a confirmToken stays valid, in seconds. Defaults to 600. |
| MCP_CONFIRM_SECRET | No | Signing key for confirmTokens. Random per process by default; set it only if tokens must survive a server restart. Secret. |