
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
m365-roadmap-mcp
Advanced tools
A Python-based MCP (Model Context Protocol) server that enables AI agents to query the Microsoft 365 Roadmap programmatically.
For organizations relying on Microsoft 365, Teams, or SharePoint, the "Roadmap" is the single source of truth for upcoming changes. However, navigating the roadmap website manually is cumbersome and disconnected from technical planning workflows. "When is Copilot coming to GCC High?" is a question that affects multi-million dollar contracts and deployment schedules.
Existing research indicates that while RSS feeds exist, there is no tool that allows an AI agent to structurally query this data to answer complex filtering questions. A "Roadmap Scout" MCP server empowers the Agent to act as a release manager, proactively identifying features that enable new capabilities or threaten existing customizations.
Once connected to an MCP client, you can ask questions like:
Using uvx (requires uv):
uvx m365-roadmap-mcp
To update to the latest version:
uvx m365-roadmap-mcp@latest
Install uv if you don't have it:
# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
# Windows (PowerShell)
irm https://astral.sh/uv/install.ps1 | iex
Or install with pip (no uv required):
pip install m365-roadmap-mcp
# Update to latest
pip install --upgrade m365-roadmap-mcp
One-click install: Click VS Code badge for automatic setup (requires
uvinstalled) Manual install: See instructions below for Cursor, Claude Code, Copilot CLI, or Claude Desktop
uvx m365-roadmap-mcp
Or if installed with pip:
m365-roadmap-mcp
Add to your Claude Desktop MCP config:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonUsing uvx (recommended)
{
"mcpServers": {
"m365-roadmap": {
"command": "uvx",
"args": ["m365-roadmap-mcp"]
}
}
}
Using installed package
{
"mcpServers": {
"m365-roadmap": {
"command": "m365-roadmap-mcp"
}
}
}
Option 1: One-Click Install (Recommended)
cursor://anysphere.cursor-deeplink/mcp/install?name=m365-roadmap-mcp&config=eyJjb21tYW5kIjogInV2eCIsICJhcmdzIjogWyJtMzY1LXJvYWRtYXAtbWNwIl19
Option 2: Manual Configuration
Add to your Cursor MCP config:
~/Library/Application Support/Cursor/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json%APPDATA%\Cursor\User\globalStorage\saoudrizwan.claude-dev\settings\cline_mcp_settings.jsonclaude mcp add --transport stdio m365-roadmap -- uvx m365-roadmap-mcp
Add to ~/.copilot/mcp-config.json:
{
"mcpServers": {
"m365-roadmap": {
"type": "stdio",
"command": "uvx",
"args": ["m365-roadmap-mcp"]
}
}
}
Provides a single search_roadmap tool that handles all M365 roadmap queries. Combine any filters:
This MCP server pulls data from Microsoft's public roadmap API:
https://www.microsoft.com/releasecommunications/api/v2/m365https://www.microsoft.com/microsoft-365/RoadmapFeatureRSS (same data, RSS format)This is the same data that powers the Microsoft 365 Roadmap website. The legacy endpoint (roadmap-api.azurewebsites.net) was retired in March 2025.
The API returns approximately 1,900 active features -- those currently In Development, Rolling Out, or recently Launched. This is a hard cap; older or retired features age out of the API and are no longer returned. The roadmap website may display historical features that are no longer present in the API.
MIT
FAQs
MCP server for querying the Microsoft 365 Roadmap
We found that m365-roadmap-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.