fix: respect an explicitly provided Accept header (#656)

* fix: respect an explicitly provided Accept header

Header parameters are copied into the request headers, but the acceptType
configured in endpoints.json then overwrote the entry unconditionally. An
Accept header passed by the caller never reached Graph.

This made the alternate representation of a resource unreachable even when
Graph explicitly asked the client to retry with a different Accept value.
For get-meeting-transcript-content (acceptType text/vtt), a tenant with
speaker attribution disabled returns 403 SpeakerAttributionNotAllowed and
names application/vnd.microsoft.graph.transcript+text as the format to
retry with. Retrying returned the identical 403, because text/vtt was put
back in place of the requested format.

Treat acceptType as a default instead of an override, so callers that send
nothing keep the previous behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: expose Accept so the acceptType default can be overridden

The generated client declares no Accept header on any endpoint, so guarding the
configured acceptType against an existing headers['Accept'] was unreachable on
its own: nothing could ever put a value there. Add a synthetic, optional Accept
param to every tool whose endpoint declares acceptType — the same shape the
existing fetchAllPages/timezone synthetic params use — and forward it in
executeGraphTool, where it lands in the fallback chain because the generated
client has no parameter definition for it.

describeToolSchema mirrors the param so --discovery mode does not drift, and the
tool-schema tests assert it against the real generated client rather than a mock,
so a future regression to dead code fails the suite.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test: cover the Accept override end-to-end against the real generated client

The mocked accept-header test originally passed only because the mock invented
an Accept header param the generated client never declares. These two tests
register the real endpoints and assert both acceptType tools
(get-meeting-transcript-content, get-mail-message-mime) apply their configured
default and forward an explicit Accept all the way into graphRequest — so a
regression back to dead code cannot hide behind a mock again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: jshtk

src/graph-tools.ts

@@ -52,6 +52,7 @@ import {
   CONFIRM_PARAM_DESCRIPTION,
   TIMEZONE_PARAM_DESCRIPTION,
   EXPAND_EXTENDED_PROPERTIES_PARAM_DESCRIPTION,
+  getAcceptParamDescription,
   getAccountParamDescription,
   getFetchAllPagesParamDescription,
 } from './lib/param-descriptions.js';
@@ -1524,6 +1525,11 @@ async function executeGraphTool(
           .replace(`{${camelCaseParamName}}`, encodedValue)
           .replace(`:${camelCaseParamName}`, encodedValue);
         logger.info(`Path param fallback: replaced :${camelCaseParamName} with encoded value`);
+      } else if (paramName.toLowerCase() === 'accept' && config?.acceptType) {
+        // The synthetic Accept param added for acceptType endpoints. It has no entry in
+        // the generated client's parameter list, so it lands here rather than in the
+        // 'Header' case above.
+        headers['Accept'] = `${paramValue}`;
       } else if (isOdataParam) {
         // Fallback: OData param recognised by name but absent from generated client's parameter
         // list — forward it as a query param rather than silently dropping it.
@@ -1656,7 +1662,7 @@ async function executeGraphTool(
       logger.info(`Setting custom Content-Type: ${config.contentType}`);
     }
 
-    if (config?.acceptType) {
+    if (config?.acceptType && !headers['Accept']) {
       headers['Accept'] = config.acceptType;
       logger.info(`Setting custom Accept: ${config.acceptType}`);
     }
@@ -2028,6 +2034,17 @@ export function registerGraphTools(
       }
     }
 
+    // Endpoints with a configured acceptType get a synthetic, optional `Accept` param.
+    // The generated client declares no Accept header anywhere, so without this the
+    // caller has no way to reach the alternate representation of the resource — the
+    // configured default would be the only value the server can ever send.
+    if (endpointConfig?.acceptType && paramSchema['Accept'] === undefined) {
+      paramSchema['Accept'] = z
+        .string()
+        .describe(getAcceptParamDescription(endpointConfig.acceptType))
+        .optional();
+    }
+
     if (isFetchAllPagesApplicable(tool)) {
       const maxPages = getMaxPages();
       paramSchema['fetchAllPages'] = z

src/lib/param-descriptions.ts

@@ -108,6 +108,14 @@ export const TIMEZONE_PARAM_DESCRIPTION =
 export const EXPAND_EXTENDED_PROPERTIES_PARAM_DESCRIPTION =
   'When true, expands singleValueExtendedProperties on each event. Use this to retrieve custom extended properties (e.g., sync metadata) stored on calendar events.';
 
+export function getAcceptParamDescription(acceptType: string): string {
+  return (
+    `Accept header for the response representation. Defaults to "${acceptType}". ` +
+    'Only set this when Graph asks for a different format — e.g. a 403 SpeakerAttributionNotAllowed ' +
+    'on transcript content names the media type to retry with.'
+  );
+}
+
 /**
  * Layer 2 of multi-account support: account names are surfaced in the description
  * (not as a strict enum) so the LLM sees available accounts upfront without a

src/lib/tool-schema.ts

@@ -12,6 +12,7 @@ import {
   CONFIRM_PARAM_DESCRIPTION,
   TIMEZONE_PARAM_DESCRIPTION,
   EXPAND_EXTENDED_PROPERTIES_PARAM_DESCRIPTION,
+  getAcceptParamDescription,
 } from './param-descriptions.js';
 
 type ToolEndpoint = (typeof api.endpoints)[number];
@@ -26,6 +27,7 @@ export interface ToolSchemaConfig extends DestructiveCheckConfig {
   descriptionOverride?: string;
   supportsTimezone?: boolean;
   supportsExpandExtendedProperties?: boolean;
+  acceptType?: string;
 }
 
 /**
@@ -167,6 +169,19 @@ export function describeToolSchema(
     });
   }
 
+  // Mirrors registerGraphTools: endpoints with a configured acceptType get a
+  // synthetic, optional `Accept` header param so the configured default can be
+  // overridden when Graph asks for a different representation.
+  if (config?.acceptType && !params.some((p) => p.name.toLowerCase() === 'accept')) {
+    params.push({
+      name: 'Accept',
+      in: 'Header',
+      required: false,
+      description: getAcceptParamDescription(config.acceptType),
+      schema: { type: 'string' },
+    });
+  }
+
   const llmTip = config?.llmTip;
   return {
     name: tool.alias,

test/accept-header-override.test.ts

@@ -0,0 +1,102 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { z } from 'zod';
+import { registerGraphTools } from '../src/graph-tools.js';
+import type { GraphClient } from '../src/graph-client.js';
+
+vi.mock('../src/logger.js', () => ({
+  default: {
+    info: vi.fn(),
+    error: vi.fn(),
+    warn: vi.fn(),
+  },
+}));
+
+vi.mock('../src/generated/client-beta.js', () => ({ api: { endpoints: [] } }));
+vi.mock('../src/generated/client.js', () => ({
+  api: {
+    endpoints: [
+      {
+        // endpoints.json configures acceptType 'text/vtt' for this tool
+        alias: 'get-meeting-transcript-content',
+        method: 'get',
+        path: '/me/onlineMeetings/:onlineMeetingId/transcripts/:callTranscriptId/content',
+        description: 'Transcript content.',
+        parameters: [
+          { name: 'onlineMeetingId', type: 'Path', schema: z.string() },
+          { name: 'callTranscriptId', type: 'Path', schema: z.string() },
+        ],
+      },
+    ],
+  },
+}));
+
+describe('explicit Accept header', () => {
+  let mockServer: { tool: ReturnType<typeof vi.fn>; registerTool: ReturnType<typeof vi.fn> };
+  let mockGraphClient: GraphClient;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockServer = { tool: vi.fn(), registerTool: vi.fn() };
+    mockGraphClient = {
+      graphRequest: vi.fn().mockResolvedValue({
+        content: [{ type: 'text', text: 'WEBVTT' }],
+      }),
+    } as unknown as GraphClient;
+  });
+
+  function getRegistration(toolName: string) {
+    // transcript tools are work-scoped only, so they need org mode to register
+    registerGraphTools(mockServer, mockGraphClient, false, undefined, true);
+    const call = mockServer.registerTool.mock.calls.find((c: unknown[]) => c[0] === toolName);
+    expect(call).toBeDefined();
+    return call!;
+  }
+
+  function getToolHandler(toolName: string) {
+    const call = getRegistration(toolName);
+    return call[call.length - 1] as (params: Record<string, unknown>) => Promise<unknown>;
+  }
+
+  function getParamSchema(toolName: string) {
+    const call = getRegistration(toolName);
+    const { inputSchema } = call[1] as { inputSchema: z.ZodObject<z.ZodRawShape> };
+    return inputSchema.shape;
+  }
+
+  function sentHeaders() {
+    const call = (mockGraphClient.graphRequest as ReturnType<typeof vi.fn>).mock.calls[0];
+    return (call[1] as { headers: Record<string, string> }).headers;
+  }
+
+  it('exposes an Accept param for tools with a configured acceptType', () => {
+    // The generated client declares no Accept header on any endpoint, so without the
+    // synthetic param the caller has no way to send one and the override is unreachable.
+    const schema = getParamSchema('get-meeting-transcript-content');
+
+    expect(schema['Accept']).toBeDefined();
+    expect(schema['Accept'].isOptional()).toBe(true);
+  });
+
+  it('falls back to the configured acceptType when the caller sends none', async () => {
+    const handler = getToolHandler('get-meeting-transcript-content');
+
+    await handler({ onlineMeetingId: 'meeting-1', callTranscriptId: 'transcript-1' });
+
+    expect(sentHeaders()['Accept']).toBe('text/vtt');
+  });
+
+  it('keeps an explicitly provided Accept header instead of overwriting it', async () => {
+    const handler = getToolHandler('get-meeting-transcript-content');
+
+    // Graph asks for this format when speaker-attributed transcripts are
+    // disabled for the tenant (403 SpeakerAttributionNotAllowed). Overwriting
+    // it with the configured acceptType made that retry impossible.
+    await handler({
+      onlineMeetingId: 'meeting-1',
+      callTranscriptId: 'transcript-1',
+      Accept: 'application/vnd.microsoft.graph.transcript+text',
+    });
+
+    expect(sentHeaders()['Accept']).toBe('application/vnd.microsoft.graph.transcript+text');
+  });
+});

test/accept-header-real-client.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it, vi } from 'vitest';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { registerGraphTools } from '../src/graph-tools.js';
+import type { GraphClient } from '../src/graph-client.js';
+
+// End-to-end smoke against the REAL generated client (no endpoint mocks):
+// both acceptType endpoints must expose Accept and forward it to graphRequest.
+describe('Accept override, real generated client', () => {
+  function setup() {
+    const server = new McpServer({ name: 't', version: '1' });
+    const calls: Array<[string, { headers: Record<string, string> }]> = [];
+    const graphClient = {
+      graphRequest: vi.fn(async (path: string, opts: { headers: Record<string, string> }) => {
+        calls.push([path, opts]);
+        return { content: [{ type: 'text', text: 'ok' }] };
+      }),
+    } as unknown as GraphClient;
+    const handlers = new Map<string, (p: Record<string, unknown>) => Promise<unknown>>();
+    vi.spyOn(server, 'registerTool').mockImplementation(((
+      name: string,
+      _cfg: unknown,
+      h: never
+    ) => {
+      handlers.set(name, h);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- registerTool() has many overloads
+    }) as any);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    vi.spyOn(server, 'tool').mockImplementation((() => {}) as any);
+    registerGraphTools(server, graphClient, false, undefined, true);
+    return { handlers, calls };
+  }
+
+  it('transcript content: default text/vtt, override survives', async () => {
+    const { handlers, calls } = setup();
+    const h = handlers.get('get-meeting-transcript-content')!;
+    expect(h).toBeDefined();
+    await h({ onlineMeetingId: 'm1', callTranscriptId: 't1' });
+    expect(calls[0][1].headers['Accept']).toBe('text/vtt');
+    await h({
+      onlineMeetingId: 'm1',
+      callTranscriptId: 't1',
+      Accept: 'application/vnd.microsoft.graph.transcript+text',
+    });
+    expect(calls[1][1].headers['Accept']).toBe('application/vnd.microsoft.graph.transcript+text');
+  });
+
+  it('mail mime: default text/plain, override survives', async () => {
+    const { handlers, calls } = setup();
+    const h = handlers.get('get-mail-message-mime')!;
+    expect(h).toBeDefined();
+    await h({ messageId: 'abc' });
+    expect(calls[0][1].headers['Accept']).toBe('text/plain');
+    await h({ messageId: 'abc', Accept: 'application/octet-stream' });
+    expect(calls[1][1].headers['Accept']).toBe('application/octet-stream');
+  });
+});

test/tool-schema.test.ts

@@ -218,6 +218,23 @@ describe('describeToolSchema parity with registerGraphTools (discovery-mode drif
     expect(discovery?.description).toBe(expected);
   });
 
+  it('matches Accept description exactly for an endpoint with a configured acceptType', () => {
+    const entry = registry.get('get-meeting-transcript-content');
+    if (!entry) throw new Error('registry missing get-meeting-transcript-content');
+    const s = describeToolSchema(entry.tool, entry.config);
+    const discovery = s.parameters.find((p) => p.name === 'Accept');
+    const expected = registeredDescription('get-meeting-transcript-content', 'Accept');
+    expect(expected).toBeDefined();
+    expect(discovery?.in).toBe('Header');
+    expect(discovery?.description).toBe(expected);
+  });
+
+  it('adds no Accept param to endpoints without a configured acceptType', () => {
+    const s = schemaFor('list-mail-messages');
+    expect(s.parameters.find((p) => p.name === 'Accept')).toBeUndefined();
+    expect(registered.get('list-mail-messages')).not.toHaveProperty('Accept');
+  });
+
   it('matches confirm description exactly (already shared logic, guarded against future drift)', () => {
     const entry = registry.get('delete-mail-message');
     if (!entry) throw new Error('registry missing delete-mail-message');