Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

WilmAI

NPM · @WILM-AI/WILMA-CLI

Finland's Wilma school system for parents and students: schedule, homework, exams and messages.

Available components

68 Trust /100

Last scanned (23 hours ago)

Scores higher than 35% of npm servers

Category Education and Research

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security90
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects tmp 0.0.33, reached via @inquirer/prompts > @inquirer/editor > external-editor > tmp. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 43 of 164 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability70
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2855 tokens (~142/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
  • Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 96% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +16
    • Malware scan: unverified → pass ▲ security
  • 3 Nov 26 0
    • Schema quality: 106 → 142 ▼ functional
    • Tool coverage: 87% → 96% ▲ functional
    • Stability: unverified → 0.03 ▲ functional
    • Schema quality: good → excellent functional
    • Package version: 2.3.2 → 2.4.0 functional
  • 2 Nov 26 52

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@wilm-ai/wilma-cli@2.4.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-52f5-9888-hmc6 CVE-2025-54798 low CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N yes
GHSA-ph9p-34f9-6g65 CVE-2026-44705 high yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 164 packages
Packages resolved 164
Deprecated 1
Stale 43
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 20 exposed · ~2,505 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
wilma_account ~131

Which Wilma logins are connected: each one's Wilma, username, role ("guardian", or "student" for a student's own login) and the children it lists. Families with children on different Wilmas connect one login per Wilma (wilma_login adds another). When two logins on one Wilma list the same child (a parent's and the child's own), tools read that child through the guardian's login, and the other login's entry for the child says readVia. A child unticked on the login page (a profile Wilma lists twice) has hidden: true and isn't read.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wilma_contacts ~114

Each child's class (e.g. 9A), class teacher and other supervisors with their role as Wilma names it (e.g. Luokanvalvoja), and the child's own teachers as Wilma's message recipients list them, with the subjects each teaches the child in this and next week's timetable (empty when none). Other school staff aren't included. Lessons with times and rooms are in wilma_schedule.

NameTypeReqDescription
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_find_school ~115

Search Finland's Wilma addresses by city or by school or organisation name. Most city schools share their city's Wilma (big cities don't list each school), while many colleges, private schools and small municipalities' schools have their own. Use it to help the user pick their Wilma, e.g. when setting WILMA_TENANT; several can serve one city, so ask which is theirs.

NameTypeReqDescription
querystringyesCity, municipality or school name, e.g. Tampere or Kalevan lukio.

No output schema declared.

No examples provided.

wilma_get_news_attachment ~149

Fetch a file linked from a bulletin (e.g. a PDF letter or menu) so you can read it. Returns the file content when it is a file, or 'not_a_file' with the URL when the link is a web page. Set save=true to also save it to the user's Downloads folder.

NameTypeReqDescription
news_idintegeryes–
resource_idstringyesResource id from wilma_read_news, e.g. resource-1 (or just 1).
saveboolean–Also save the file to ~/Downloads/WilmAI.
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_get_printout ~83

Fetch one printout PDF so you can read it. Set save=true to also save it to the user's Downloads folder.

NameTypeReqDescription
idstringyesPrintout id from wilma_list_printouts.
saveboolean–Also save the file to ~/Downloads/WilmAI.
studentstring–The student the printout was listed under.

No output schema declared.

No examples provided.

wilma_gradebook ~98

Get each child's gradebook (Suoritukset): completed courses and their grades, grouped by subject (subject > syllabus > course), with course codes, credits and completion dates, plus term and school-year (report card) grades. Use it for course and report-card grades; single exam grades are in wilma_grades.

NameTypeReqDescription
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_grades ~224

List each child's graded exams, newest first: the date, exam name, subject, grade as Wilma shows it (e.g. 8+, 9½, S), the teacher's notes and when a guardian marked it seen. It reads the exams Wilma's front page lists (Wilma decides how far back that goes); with from, Wilma's list of past exams for that period instead, as far back as the school keeps them, including exams still waiting for a grade (grade: null). For course, term and report-card grades use wilma_gradebook.

NameTypeReqDescription
fromstring–YYYY-MM-DD: past exams from this day on, e.g. 1 August for this school year.
limitinteger–How many grades per child, newest first (default 20; with from, every exam of the period).
studentstring–Child's name or student number. Omit to include every child on the account.
tostring–YYYY-MM-DD, with from. Default: today.

No output schema declared.

No examples provided.

wilma_homework ~108

List the homework teachers have entered for each child, newest first: the date, subject, teacher and what to do. It reads the homework Wilma's front page lists (Wilma decides how far back that goes). wilma_summary already includes the last few days' homework.

NameTypeReqDescription
limitinteger–How many entries per child, newest first (default 10).
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_lesson_notes ~183

Lesson notes (merkinnät) teachers logged: absences, lateness, and feedback such as praise or missing books or homework, with the teacher's own words when given. One day (default today), the last N days, or a period with from/to, which can reach ahead (a teacher may note a make-up exam on a coming lesson).

NameTypeReqDescription
datestring–YYYY-MM-DD, default today.
daysinteger–The last N days up to today, instead of one date.
fromstring–Start of a period, YYYY-MM-DD, instead of a date or days.
studentstring–Child's name or student number. Omit to include every child on the account.
tostring–End of the period, YYYY-MM-DD (default today; may be after today).

No output schema declared.

No examples provided.

wilma_lesson_notes_summary ~108

Lesson notes counted by kind (e.g. absences for health reasons, unexplained absences, lateness, praise, missing study materials): this school year by default, or from a date.

NameTypeReqDescription
fromstring–YYYY-MM-DD. Default: the start of the school year.
studentstring–Child's name or student number. Omit to include every child on the account.
tostring–YYYY-MM-DD. Default: today.

No output schema declared.

No examples provided.

wilma_list_messages ~140

Wilma messages, newest first (subject, sender, date, id, unread, replyCount). The appointments folder holds event invitations (parents' evenings, learning discussions) with the family's answer as Wilma lists it: invitationStatus ("Applied": signed up, the time in invitationInfo; "ExpiredReg": sign-up closed; null: no answer shown). Use wilma_read_message for the full text, and for an invitation's time slots.

NameTypeReqDescription
folderstring–Default: inbox.
limitinteger––
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_list_news ~158

School bulletins (tiedotteet): the newest dated ones, then pinned ones (pinned: true, e.g. the school-year bulletin), and with include_older also older bulletins (archived: true). Use wilma_read_news for the full text and attachments. unavailable: ["news"] means this Wilma doesn't show this account its bulletins, which isn't the same as having none.

NameTypeReqDescription
include_olderboolean–Also list older bulletins (titles only until read).
limitinteger–How many dated bulletins (default 20). Pinned ones are always included.
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_list_printouts ~61

PDF documents the school offers (Tulosteet), such as report cards or absence reports. Fetch one with wilma_get_printout.

NameTypeReqDescription
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_login ~54

Open a login page in the user's browser to connect a Wilma account, or add another one (for a child at a school with a different Wilma). The password is entered on that page, never in the chat.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wilma_logout ~92

End WilmAI's Wilma session, as Wilma's own Log out does. Wilma allows one session per account, so use this when the user wants to use Wilma in their browser or asks to log out. The login stays saved: the next Wilma tool call logs in again, and that ends the user's session in the browser, so don't call other Wilma tools afterwards unless the user asks.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

wilma_read_message ~56

Full text of one Wilma message, including thread replies.

NameTypeReqDescription
idintegeryesMessage id from a list.
studentstring–The student the message was listed under (required when several Wilmas are connected).

No output schema declared.

No examples provided.

wilma_read_news ~68

Full text of one bulletin plus its linked resources (attachments and links). Fetch a resource with wilma_get_news_attachment.

NameTypeReqDescription
idintegeryesNews id from a list.
studentstring–The student the bulletin was listed under (required when several Wilmas are connected).

No output schema declared.

No examples provided.

wilma_schedule ~263

List each child's lessons for one day or a school week: today, the next school day, this or next week (Monday to Friday), a date, or the next given weekday; or any other week or period with from/to (e.g. a week further ahead, or several weeks to see the usual school days). Lessons come in time order with the date, start and end time, subject, teacher and room (when Wilma gives one); a day without school has no lessons. Exams and homework are in wilma_upcoming_exams and wilma_homework.

NameTypeReqDescription
datestring–A specific date, YYYY-MM-DD. Overrides 'when'.
fromstring–Start of a period, YYYY-MM-DD. Overrides 'when'.
studentstring–Child's name or student number. Omit to include every child on the account.
tostring–End of the period, YYYY-MM-DD (default: the Friday of from's week). At most 31 days.
weekdaystring–Next occurrence of a weekday: mon..sun (Finnish ma..su also work). Overrides 'when'.
whenstring–Default: week. 'tomorrow' means the next school day.

No output schema declared.

No examples provided.

wilma_summary ~192

Daily briefing per child: today's and the next school day's lessons, upcoming exams (with start times when given), recent homework, lesson notes since the previous school day (teachers' feedback and absences), recent bulletins, and recent and unread messages (ids, unread, replyCount; event invitations with invitationStatus, as in wilma_list_messages). What Wilma didn't give is listed in unavailable ("news": this Wilma doesn't show this account its bulletins). The best starting point for any question about school.

NameTypeReqDescription
daysinteger–How many days back to include news and messages (default 7).
sincestring–Only what is new from this day on (YYYY-MM-DD or 'yesterday'): bulletins, messages, homework, lesson notes. For daily runs.
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

wilma_upcoming_exams ~108

List each child's exams from today on that have no grade yet, soonest first: the date, start time (when the school gives one), exam name, subject, topic (what to study) and teacher. Graded exams are in wilma_grades.

NameTypeReqDescription
limitinteger–How many exams per child, soonest first (default 20).
studentstring–Child's name or student number. Omit to include every child on the account.

No output schema declared.

No examples provided.

Install

How do I install the WilmAI MCP server?

WilmAI runs locally as an npm package, launched with npx -y @wilm-ai/wilma-cli. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @wilm-ai/wilma-cli

# add to Claude Code
claude mcp add ai-wilm-wilma -- npx -y @wilm-ai/wilma-cli
Common questions

What is the WilmAI MCP server?

WilmAI is an MCP server listed in the public MCP registry as ai.wilm/wilma. Finland's Wilma school system for parents and students: schedule, homework, exams and messages. This page covers its npm package (@wilm-ai/wilma-cli).

Is the WilmAI MCP server safe to use?

WilmAI scores 68 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the WilmAI MCP server expose?

WilmAI exposes 20 tools: wilma_summary, wilma_schedule, wilma_homework, wilma_upcoming_exams, wilma_grades, and 15 more. Their descriptions and schemas cost roughly 2,505 tokens of context every time the server is loaded.

Is the WilmAI MCP server still maintained?

WilmAI is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the WilmAI MCP server under?

WilmAI declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.