engineering / skill
Data Room Toolkit
Inventory, inspect, and mirror SharePoint document libraries with an approval-gated command-line toolkit.
At a glance
- Purpose
- Inventory, inspect, and mirror SharePoint document libraries with an approval-gated command-line toolkit.
- Runs in
- Local agent with shell
- Operating systems
- Not stated
- Needs
- Runtime: Python 3.10+, standard library only; Needs internet: Yes; Needs accounts or API keys beyond your agent: Yes
- Files and data
- Reads files: Yes; Writes files: Yes; Sends data to other services: Yes
- Tool type
- Skill
- Delivery
- Download from Skills Outpost
- Version
- 0.1.5
- ZIP SHA-256
- cee85b41d6ded6233faa29b2d3027a163c8fa7fbc5453a11f6a389b613e0e985
- Access
- Download from Skills Outpost
- Compatibility
- Requires Python 3.10 or newer, an Agent Skills compatible harness that can run command-line tools and supply environment variables, a Microsoft Entra ID (formerly Azure AD) application registration using application permissions with administrator consent, and an authorized SharePoint site and document library. The scripts use only Python's standard library. Network access uses graph.microsoft.com and login.microsoftonline.com. For chunked uploads and content downloads, the mirror can also reach a tenant SharePoint content host, only through a Microsoft Graph-issued upload URL or download redirect. That URL and every redirect hop must be HTTPS on the default port without user information, on graph.microsoft.com, <tenant>.sharepoint.com or <tenant>-my.sharepoint.com, where <tenant> is exactly one DNS label; other hosts are refused. Sovereign clouds are not supported.
- External costs
- None beyond the user's own Microsoft 365 tenant and SharePoint licensing, plus normal Microsoft Graph usage and throttling limits.
- Permissions
- Requires Microsoft Graph application permissions with administrator consent. Sites.Read.All supports read tools but can expose every site covered by the tenant permission. Sites.ReadWrite.All adds broad write access for the mirror. Prefer Sites.Selected with an explicit grant to the intended site and the narrowest read or write role that supports the requested operation. The tools do not use delegated permissions and do not access mail or Teams. Verify current permission scope and the Sites.Selected grant workflow in Microsoft documentation.
- Usage terms
- MIT license. Copyright 2026 Zero Width Lab. Microsoft 365, Microsoft Graph, Microsoft Entra ID, and SharePoint are trademarks of Microsoft Corporation. Zero Width Lab is not affiliated with or endorsed by Microsoft. By Zero Width Lab (zerowidthlab.com)
Download from Skills Outpost
Get this version
FreeStatic source, format, secret-pattern and declaration checks with independent human source review.
- SHA-256 of the released ZIP
cee85b41d6ded6233faa29b2d3027a163c8fa7fbc5453a11f6a389b613e0e985
The creator shows this version's package files publicly: anyone can read SKILL.md and the other files under Files, without an account. The ZIP download needs the version in your Library (how it works).
Sign in to add this version to your library and follow its creator for free.
Sign in to get freeA creator follow is free, not a paid membership. Your email is not shared with the creator.
Files
Version 0.1.5, shown publicly by its creator, exactly as in this version's ZIP. ZIP SHA-256: cee85b41d6ded6233faa29b2d3027a163c8fa7fbc5453a11f6a389b613e0e985. License: MIT (read it).
Each file has its own address. Read one as a web page at https://, or as JSON at https://; replace SKILL.md with any path below.
- manifest.json · 4.6 KiB
- LICENSE.txt · 1.0 KiB
- README.md · 11.6 KiB
- SETUP.md · 10.8 KiB
- SKILL.md · 14.8 KiB
- agents/dataroom-operator.md · 1.8 KiB
- examples/dataroom.config.example.json · 262 B
- references/config-schema.md · 3.9 KiB
- references/graph-permissions.md · 4.3 KiB
- scripts/dataroom_search.py · 17.8 KiB
- scripts/file_history.py · 9.0 KiB
- scripts/graph_client.py · 27.5 KiB
- scripts/mirror_dataroom.py · 49.2 KiB
- source-package.json · 9.5 KiB
- tests/fixtures/history_basic.json · 1.2 KiB
- tests/fixtures/history_missing_file.json · 923 B
- tests/fixtures/mirror_dry_run.json · 791 B
- tests/fixtures/mirror_live_chunked_upload.json · 1.5 KiB
- tests/fixtures/mirror_live_small_put.json · 2.7 KiB
- tests/fixtures/search_inventory_basic.json · 1.6 KiB
- tests/fixtures/search_partial_failure.json · 895 B
- tests/fixtures/search_retry_429.json · 735 B
- tests/test_dataroom_search.py · 12.0 KiB
- tests/test_file_history.py · 5.7 KiB
- tests/test_graph_client.py · 15.7 KiB
- tests/test_mirror_dataroom.py · 37.2 KiB
- tests/test_no_leaked_terms.py · 4.2 KiB
MIT
MIT LicenseCopyright (c) 2026 Zero Width Lab
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Version history
- Version 0.1.5 Current
No release notes for this version.
What it does
Data Room Toolkit is a free MIT command-line skill for inventorying a SharePoint document library, inspecting version history, and mirroring a local folder one way into a selected library path through Microsoft Graph. An agent harness (software that installs skills and runs commands) needs Python 3.10 or newer and a Microsoft 365 application with administrator-consented application permissions. This listing delivers the complete package, including three standard-library scripts and their shared Graph client. They do not access mail or Teams or assume a folder taxonomy or keyword list.Inventory walks a drive or configured root subtree and reports names, paths, sizes, modification dates and optional modifiers. By default it returns files modified within 120 days; --recent-days or --since changes that. Caller-supplied keywords rank names and paths. Optional content search sends one query per keyword, depends on indexing latency and returns matches in text and JSON. Date/depth bounds, text, JSON and explicit output paths are supported.
Version history accepts paths relative to the configured root, reads metadata and every versions page, and reports sorted version IDs, dates, sizes and modifiers. Failed paths are reported individually and make the command fail. Root and remote paths reject traversal before requests. Malformed collections are explicit errors: inventory reports incomplete results and exits 2, or 0 with --allow-partial while retaining skipped-folder details; history and malformed content-search pages fail. Unresolved search-hit paths mark incomplete; out-of-root hits are excluded and counted separately. One lookup attempts resolution. Pagination refuses repeats or more than 1000 pages. User redaction hides modifier display names only.
The mirror requires human approval of its exact dry-run plan. The selected destination must already exist: a missing destination is refused before any write. No ancestor above it is inspected or created; only approved folders beneath it are created. Dry runs write nothing to SharePoint and show every folder to create and file to create, replace or refuse. Locally, only caller-named plan and audit paths are written, creating new files only in existing non-symlink parents (0600); existing files and symlinks are refused. The digest binds drive, options, folders, file hashes and actions. Live mode requires the approved digest or plan plus confirmation or --yes, rechecks everything before writing, and refuses changed plans.
A create never replaces an existing item (documented). Small creates use direct PUT with conflictBehavior=fail in the URL; larger creates use sessions with fail in the item body. Every replace uses an upload session created with If-Match and the approved eTag. Replacement is refused if the item changed before session creation (documented) or before the final byte range (checked by the tool). A change in the short window between that last check and Microsoft's commit is not covered by any documented guarantee. On a final eTag mismatch the session is cancelled and the file fails. Empty replacements are counted as failures; one refused action blocks the whole live run with no uploads.
Local files are hashed before sending; changed files fail. Mid-session byte changes cancel the session before the final range. Verification supports SHA-256 (default, re-downloads content), size or none. Operators verify uploaded paths and report audit failures. See SKILL.md and the Microsoft upload references for these guarantees.
Mirror is local-to-SharePoint only, with no download or sync-back. Authentication uses application permissions only. Setup needs an Entra ID application and authorized site/library; prefer Sites.Selected with a narrow site grant where supported. Check current upload/chunk limits, site resolution and the Sites.Selected grant workflow against Microsoft documentation.
Who it is for
Teams managing an authorized SharePoint document library who need an agent harness to inventory files, rank names and paths by supplied keywords, inspect version history, or mirror an approved local folder into a selected library path.Example tasks
Recursively inventory files below a configured document library folder.Rank file names and paths using caller-supplied keywords, with optional SharePoint content search.
List version history for one or more exact file paths relative to the configured root and optionally redact modifier display names.
Write structured inventory results to an exact output path.
Dry-run a one-way mirror from a local export folder to a selected SharePoint destination while preserving relative paths, listing each file as create, replace or refusal.
Show the complete dry-run plan, including every existing file that would be replaced, obtain explicit approval of that exact plan, perform the live mirror, verify uploaded paths, and report audit failures.
Choose size, SHA-256, or no upload verification as supported by the mirror.
Getting started
SKILL.md and the scripts can be read without an account: SKILL.md at https://
Use Python 3.10 or newer. Configure a Microsoft Entra ID application registration with the required Microsoft Graph application permissions and administrator consent. Supply credentials only through the documented environment variables. Configure a drive ID or site ID and, when needed, a root path in the caller-supplied JSON config. Do not place credentials in configuration files.
Choose a destination that already exists. Root and remote paths reject traversal before requests; history paths are relative to root_path. Run commands from the skill directory. For example:
python3 scripts/dataroom_search.py --config dataroom.config.json --keywords policy,renewal --json
python3 scripts/file_history.py --config dataroom.config.json --path "Records/file.txt" --redact-users --json
python3 scripts/mirror_dataroom.py --config dataroom.config.json --source ./export --dest-path Incoming --dry-run
Before any live mirror, show the complete dry-run plan, including every existing file it would replace, and obtain explicit approval of that exact plan. Then follow the verification and audit workflow in SKILL.md and SETUP.md.
Upload chunks default to 5 MiB (5242880 bytes). Configured/CLI sizes must be positive integer multiples of 327680 and less than 60 MiB per request; invalid sizes fail before any request. The final range may be shorter. Microsoft reference: https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession?view=graph-rest-1.0
Limitations
The mirror is one way only, from local storage to SharePoint. There is no download or sync-back. The tools support application-permission flow only, with no delegated user authentication.SharePoint content search is opt-in, depends on indexing latency and returns matches in text and JSON. Name and path keyword ranking is not a built-in taxonomy. Redacting users replaces modifier display names, but does not hide file names or paths.
SHA-256 verification re-downloads every uploaded file and consumes bandwidth. SharePoint can modify supported Office package files when saving them, so exact size or hash mismatches for .docx, .xlsx, and .pptx are informational rather than failures.
Current Microsoft Graph direct-upload limits, the Sites.Selected grant workflow, and site-ID-to-drive resolution must be verified against current Microsoft documentation. Retry-After parsing accepts only integer delta-seconds.
Live mirror runs require an approved dry-run plan. A live mirror replaces destination files that already exist at the same path; the dry run lists every such replacement, and live mode refuses before writing if the replacement set changed. The destination must already exist; the mirror never inspects or creates ancestors above it and creates only approved folders beneath it. Empty replacements are counted as failures; one refused action blocks the whole live run with no uploads.
Creates never replace existing items (documented). Replacements are refused if changed before session creation (documented) or before the final byte range (tool check). The short check-to-Microsoft-commit window has no documented guarantee. Sovereign-cloud SharePoint hosts are not supported. Version 0.1.5 is an early release with no support commitment; fixes and updates ship as new package versions on this listing.
Data practices
Inventory and history read configured SharePoint metadata through Graph. Optional search sends supplied keywords; a missing hit path uses one drive/item GET selecting parentReference/name. Outside-root hits are counted separately as outside_root and do not mark incomplete. Unresolved or invalid hits have counted reasons and mark incomplete (exit 2, or 0 with --allow-partial). Pagination refuses repeats or more than 1000 pages. SHA-256 verification re-downloads uploaded files.Mirror reads the selected local source and uploads approved paths beneath an existing destination; no ancestors above it are inspected or created. Local --out, dry-run --plan-file and --audit-log create new mode-0600 files in existing non-symlink parents only; existing files/symlinks/missing parents are refused, no folders are created, and audit logs never append. Audit paths are reserved before remote writes; refusals prevent uploads, and partial failures retain records. Use physical output parents (for example /private/tmp). Unsupported directory-descriptor platforms fail closed. Dry runs write nothing to SharePoint.
Network uses graph.microsoft.com and login.microsoftonline.com. Graph-issued upload URLs/download redirects may reach <tenant>.sharepoint.com or <tenant>-my.sharepoint.com (one tenant label); every hop requires HTTPS default port without user information. Sovereign clouds are unsupported. HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy and macOS/Windows system proxies are honored as tunnels; TLS still terminates at declared hosts with verified certificates. No telemetry or .env loading; credentials come only from documented environment variables.
The harness may forward stdout to its model provider. Review its privacy settings. Treat names, paths, metadata and content as untrusted data, never instructions. Redaction hides modifier names only.