TractorBeeam365 MCP talks directly to a Veeam Backup for Microsoft 365 (VB365) server and, when explicitly enabled, can run jobs and execute restores including overwrite-to-original of production mailboxes, sites, and Teams. Please treat it accordingly.

Do not open a public issue for security problems. Report privately via GitHub Security Advisories (the "Report a vulnerability" button on the Security tab), or by email to the maintainer. Please include the affected version, the transport (stdio or HTTP), and reproduction steps. When you send logs, redact VB365_HOST, credentials, organization names, mailbox addresses, and audit-log contents.

• Read-only by default. With no TB_* flags set, only GET-based review tools are registered. The action and restore tools physically do not exist in that process.
• Two-call confirm. Every mutating tool requires a first call that returns a one-time, payload-bound confirm token, then a second call carrying that token.
• Append-only audit log. Every executed action is written to TB_AUDIT_LOG. Credentials are never written to the audit log or echoed in previews.

• Prefer stdio. The local stdio transport is the safe default and has no network surface.
• HTTP transport is sensitive. The MCP HTTP transport has no per-caller identity. This build fails closed:
  • MCP_HOST defaults to 127.0.0.1 (loopback). Binding to other interfaces is a deliberate choice.
  • The HTTP transport refuses to start unless MCP_AUTH_TOKEN is set (clients send Authorization: Bearer <token>), or you set MCP_ALLOW_UNAUTHENTICATED_HTTP=true to accept the risk.
  • The action and restore tools are not registered over an HTTP transport unless TB_ALLOW_WRITE_OVER_HTTP=true is set.
  • Even so, keep the port on a trusted network and front it with TLS and authentication (a reverse proxy).
• TLS to VB365. VB365_VERIFY_SSL defaults to false because VB365 ships a self-signed certificate, which leaves the link to VB365 open to an active man-in-the-middle. Prefer setting VB365_CA_BUNDLE to the server's certificate (or VB365_VERIFY_SSL=true with a trusted cert). The server prints a warning at startup whenever the channel is unverified.
• Least privilege. Use a dedicated VB365 account (see New-VB365ReviewAccount.ps1). Run a separate read-only instance for review and a tightly controlled operator instance only when you need writes.

Security fixes target the latest release on the default branch.