MCP Server Example on MCP SDK by MehakBindra · Pull Request #534 · microsoft/teams.ts

MehakBindra · 2026-04-20T21:32:31Z

This pull request migrates and refactors the MCP (Model Context Protocol) Teams bot example from @examples/mcp to @examples/mcp-server, significantly expanding its functionality and improving its documentation and code structure. The new implementation provides a robust MCP server that exposes human-in-the-loop tools for Teams, including notification, question/answer, and approval flows.

Key changes include:

1. Migration and Renaming

The example is moved from @examples/mcp to @examples/mcp-server, with all related files and documentation updated to reflect the new name. (README.md, CHANGELOG.md, package.json, directory and file renames)

2. Major Feature Expansion

Implements a full-featured MCP server for Teams, supporting five tools: notify, ask, getReply, requestApproval, and getApproval. These tools allow agents or clients to interact with real users via Teams for notifications, Q&A, and approval workflows.

4. Removal of Old Implementation

Deletes the previous minimal MCP bot implementation and its associated files, including the old README.md, manifest.json, and TypeScript entry point, which are replaced with the new, more capable server.

Copilot

Pull request overview

This PR migrates the MCP Teams bot example from @examples/mcp to a new @examples/mcp-server workspace and expands it into a more complete MCP server that can message Teams users and support Q&A + approval flows via MCP tools.

Changes:

Replace the old minimal MCP bot example (examples/mcp) with a new MCP server implementation (examples/mcp-server) using @modelcontextprotocol/sdk’s McpServer + Streamable HTTP transport.
Add in-memory state + Teams handlers to support notify, ask/getReply, and requestApproval/getApproval tools.
Update repo docs/lockfile to reflect the new example package and dependency set.

Reviewed changes

Copilot reviewed 11 out of 19 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
package-lock.json	Updates workspace entries and adds new deps for the MCP server example (including MCP inspector).
examples/mcp/src/index.ts	Removes the previous minimal MCP bot implementation.
examples/mcp/appPackage/manifest.json	Removes the old Teams app manifest for the prior example.
examples/mcp/appPackage/outline.png	Removes old app package asset (example app icon).
examples/mcp/appPackage/color.png	Removes old app package asset (example app icon).
examples/mcp/README.md	Removes the old example documentation.
examples/mcp-server/turbo.json	Adds Turbo build config for the new example workspace.
examples/mcp-server/tsconfig.json	Adds TypeScript config for building the new example.
examples/mcp-server/src/state.ts	Adds in-memory state maps for conversation IDs, asks, and approvals.
examples/mcp-server/src/mcpTools.ts	Implements MCP tool registrations and proactive Teams messaging/approval cards.
examples/mcp-server/src/index.ts	Boots the app and mounts the MCP Streamable HTTP transport at `/mcp`.
examples/mcp-server/src/app.ts	Adds Teams `message` and `card.action` handlers to capture replies and approvals.
examples/mcp-server/package.json	Renames package and updates deps/devDeps/scripts for the new MCP server example.
examples/mcp-server/eslint.config.js	Adds ESLint configuration for the new workspace.
examples/mcp-server/README.md	Adds documentation for tools, layout, and run/inspector flow.
examples/mcp-server/CHANGELOG.md	Updates changelog header for the renamed example package.
examples/mcp-server/.gitignore	Adds workspace-local ignores (env, infra, node_modules, etc.).
README.md	Updates the root examples list to point to `@examples/mcp-server`.
.gitignore	Adds `.claude/settings.local.json` to ignored local files.

Comments suppressed due to low confidence (1)

examples/mcp-server/package.json:39

@modelcontextprotocol/inspector@^0.21.2 requires Node >=22.7.5 (per the lockfile), but the repo’s root package.json declares engines.node >=20. This can cause install-time engine warnings or failures in CI/dev environments pinned to Node 20. Consider pinning the inspector to a version that supports Node 20, or updating the repo/tooling Node requirement consistently.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-20T21:38:31Z

+  adapter.post(MCP_PATH, handle);
+  adapter.get(MCP_PATH, handle);
+  adapter.delete(MCP_PATH, handle);


The /mcp endpoint is mounted with no authentication/authorization, but the exposed tools can proactively message arbitrary userIds and record approvals. Even for an example, leaving this open on the network makes it easy to abuse (spam users, force approval state changes) if the port is reachable. Consider adding a simple guard (e.g., require a bearer token/shared secret in headers for /mcp, or restrict to localhost in dev) and document it in the README.

I think this is a real gap that at least needs to be addressed in the README as non-production code.

Copilot · 2026-04-20T21:38:32Z

+  const handle = async (req: any, res: any) => {
+    await transport.handleRequest(req, res, req.body);
+  };


handle uses req: any, res: any, which loses type safety and makes it easy to miss issues like missing body parsing. Since this file already depends on Express via ExpressAdapter, consider typing these as express.Request / express.Response (or at least unknown with narrowing) to catch integration mistakes at compile time.

Copilot · 2026-04-20T21:38:32Z

+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: () => randomUUID(),
+  });
+  await mcpServer.connect(transport);
+
+  const handle = async (req: any, res: any) => {
+    await transport.handleRequest(req, res, req.body);
+  };
+  adapter.post(MCP_PATH, handle);
+  adapter.get(MCP_PATH, handle);
+  adapter.delete(MCP_PATH, handle);


adapter.post(MCP_PATH, handle) is mounting the MCP endpoint without any JSON body parsing middleware. ExpressAdapter.registerRoute() adds express.json() for the Teams messaging endpoint, but routes added via adapter.post() here won’t get that automatically, so req.body will usually be undefined and transport.handleRequest(req, res, req.body) can fail to parse requests. Add express.json() (or equivalent) for the /mcp routes (e.g., adapter.use(express.json()) before registering, or pass the middleware just for these routes).

heyitsaamir · 2026-04-21T18:01:36Z

+  await send('Hi! Will let you know if I need anything.');
+});
+
+app.on('card.action', async ({ activity }) => {


teams.ts/examples/cards/src/index.ts

Line 318 in a2dd14b

app.on('card.action.submit_form', async ({ activity, send }) => {

can you use this pattern?

app.on('card.action.approval_response', ...)

heyitsaamir · 2026-04-21T18:02:18Z

+  return {
+    statusCode: 200,
+    type: 'application/vnd.microsoft.activity.message',
+    value: 'Response recorded',


I believe just returning 'Response recorded' should be enough

heyitsaamir · 2026-04-21T18:04:35Z

+  // Initialize first so /api/messages is registered before we mount /mcp.
+  await app.initialize();
+
+  const adapter = app.server.adapter;


I would recommend managing express outside yourself.

See the http adapter example on how that works

corinagum

This sample won't start without TENANT_ID in env vars; I think in another sample either in TS or PY we started getting more explicit about tenant id. Here it should be added to the README as a pre-req.

corinagum · 2026-04-21T17:56:54Z

+    await app.send(conversationId, question);
+    state.pendingAsks.set(requestId, { userId, status: 'pending' });
+    state.userPendingAsk.set(userId, requestId);
+    return { requestId };


Should probably note in the README that there's only one ask per user.

corinagum · 2026-04-21T18:01:04Z

+  adapter.post(MCP_PATH, handle);
+  adapter.get(MCP_PATH, handle);
+  adapter.delete(MCP_PATH, handle);


I think this is a real gap that at least needs to be addressed in the README as non-production code.

rido-min

still trying to get the sample running

rido-min · 2026-04-21T17:52:13Z

@rajan-chari this is another proof of why we should have State in the SDK, so samples like these can benefit of that abstraction

rido-min · 2026-04-21T17:52:42Z

can we use the .gitignore at the root?

rido-min · 2026-04-21T17:54:33Z

@@ -0,0 +1,164 @@
+import { randomUUID } from 'crypto';
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';


why the .js? I think we can avoid it by customizing the tsconfig

rido-min · 2026-04-21T17:56:28Z

@@ -16,22 +16,22 @@
    "build": "npx tsc",


if tsc is installed from package.json we dont need npx

rido-min · 2026-04-21T17:56:45Z

@@ -16,22 +16,22 @@
    "build": "npx tsc",
    "start": "node -r dotenv/config .",


can we use --env-file instead of dotenv/config ?

rido-min · 2026-04-21T17:57:41Z

    "@modelcontextprotocol/sdk": "^1.25.2",
    "zod": "^3.24.3"
  },
  "devDependencies": {


add typescript

rido-min · 2026-04-21T17:57:56Z

-    "inspect": "npx cross-env SERVER_PORT=9000 npx @modelcontextprotocol/inspector -e NODE_NO_WARNINGS=1 -e PORT=3978 node -r dotenv/config .",
+    "inspect": "npx cross-env SERVER_PORT=9000 npx @modelcontextprotocol/inspector",
    "dev:teamsfx": "NODE_OPTIONS='--inspect=9239' npx env-cmd -f .env npm run dev",
    "dev:teamsfx:testtool": "NODE_OPTIONS='--inspect=9239' npx env-cmd -f .env npm run dev",


why teamsfx?

rido-min · 2026-04-21T17:58:46Z

I'm missing a note on how to configure this sample

rido-min · 2026-04-21T18:12:58Z

there are some vulns, we should update the lock

17 vulnerabilities (7 low, 6 moderate, 3 high, 1 critical)

rido-min · 2026-04-21T18:22:51Z

 {
-  "name": "@examples/mcp",
+  "name": "@examples/mcp-server",
  "version": "0.0.6",


what means this vesion?

mcp-server sample

b8c06be

Copilot AI review requested due to automatic review settings April 20, 2026 21:32

Merge branch 'main' into mehak/mcp-server

9e14340

Copilot started reviewing on behalf of MehakBindra April 20, 2026 21:33 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Merge branch 'main' into mehak/mcp-server

5954a04

heyitsaamir reviewed Apr 21, 2026

View reviewed changes

corinagum requested changes Apr 21, 2026

View reviewed changes

rido-min reviewed Apr 21, 2026

View reviewed changes

		@@ -0,0 +1,164 @@
		import { randomUUID } from 'crypto';

		import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

		@@ -16,22 +16,22 @@
		"build": "npx tsc",
		"start": "node -r dotenv/config .",

Conversation

MehakBindra commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1. Migration and Renaming

2. Major Feature Expansion

4. Removal of Old Implementation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

corinagum left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rido-min left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

MehakBindra commented Apr 20, 2026 •

edited

Loading