WilmAI
NPM · @WILM-AI/WILMA-CLI
Finland's Wilma school system for parents and students: schedule, homework, exams and messages.
Available components
Last scanned (23 hours ago)
Scores higher than 35% of npm servers
Category Education and Research
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security90
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects tmp 0.0.33, reached via @inquirer/prompts > @inquirer/editor > external-editor > tmp. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 43 of 164 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2855 tokens (~142/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 96% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +16
- Malware scan: unverified → pass ▲ security
- 3 Nov 26 0
- Schema quality: 106 → 142 ▼ functional
- Tool coverage: 87% → 96% ▲ functional
- Stability: unverified → 0.03 ▲ functional
- Schema quality: good → excellent functional
- Package version: 2.3.2 → 2.4.0 functional
- 2 Nov 26 52
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@wilm-ai/wilma-cli@2.4.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-52f5-9888-hmc6 | CVE-2025-54798 | low | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N | yes |
| GHSA-ph9p-34f9-6g65 | CVE-2026-44705 | high | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 164 packages
| Packages resolved | 164 |
|---|---|
| Deprecated | 1 |
| Stale | 43 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
wilma_account Wilma account status ~131
Which Wilma logins are connected: each one's Wilma, username, role ("guardian", or "student" for a student's own login) and the children it lists. Families with children on different Wilmas connect one login per Wilma (wilma_login adds another). When two logins on one Wilma list the same child (a parent's and the child's own), tools read that child through the guardian's login, and the other login's entry for the child says readVia. A child unticked on the login page (a profile Wilma lists twice) has hidden: true and isn't read.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
wilma_contacts Class and teachers ~114
Each child's class (e.g. 9A), class teacher and other supervisors with their role as Wilma names it (e.g. Luokanvalvoja), and the child's own teachers as Wilma's message recipients list them, with the subjects each teaches the child in this and next week's timetable (empty when none). Other school staff aren't included. Lessons with times and rooms are in wilma_schedule.
| Name | Type | Req | Description |
|---|---|---|---|
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_find_school Find a school's Wilma ~115
Search Finland's Wilma addresses by city or by school or organisation name. Most city schools share their city's Wilma (big cities don't list each school), while many colleges, private schools and small municipalities' schools have their own. Use it to help the user pick their Wilma, e.g. when setting WILMA_TENANT; several can serve one city, so ask which is theirs.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | City, municipality or school name, e.g. Tampere or Kalevan lukio. |
No output schema declared.
No examples provided.
wilma_get_news_attachment Get bulletin attachment ~149
Fetch a file linked from a bulletin (e.g. a PDF letter or menu) so you can read it. Returns the file content when it is a file, or 'not_a_file' with the URL when the link is a web page. Set save=true to also save it to the user's Downloads folder.
| Name | Type | Req | Description |
|---|---|---|---|
| news_id | integer | yes | – |
| resource_id | string | yes | Resource id from wilma_read_news, e.g. resource-1 (or just 1). |
| save | boolean | – | Also save the file to ~/Downloads/WilmAI. |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_get_printout Get printout ~83
Fetch one printout PDF so you can read it. Set save=true to also save it to the user's Downloads folder.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Printout id from wilma_list_printouts. |
| save | boolean | – | Also save the file to ~/Downloads/WilmAI. |
| student | string | – | The student the printout was listed under. |
No output schema declared.
No examples provided.
wilma_gradebook Gradebook ~98
Get each child's gradebook (Suoritukset): completed courses and their grades, grouped by subject (subject > syllabus > course), with course codes, credits and completion dates, plus term and school-year (report card) grades. Use it for course and report-card grades; single exam grades are in wilma_grades.
| Name | Type | Req | Description |
|---|---|---|---|
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_grades Exam grades ~224
List each child's graded exams, newest first: the date, exam name, subject, grade as Wilma shows it (e.g. 8+, 9½, S), the teacher's notes and when a guardian marked it seen. It reads the exams Wilma's front page lists (Wilma decides how far back that goes); with from, Wilma's list of past exams for that period instead, as far back as the school keeps them, including exams still waiting for a grade (grade: null). For course, term and report-card grades use wilma_gradebook.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | YYYY-MM-DD: past exams from this day on, e.g. 1 August for this school year. |
| limit | integer | – | How many grades per child, newest first (default 20; with from, every exam of the period). |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
| to | string | – | YYYY-MM-DD, with from. Default: today. |
No output schema declared.
No examples provided.
wilma_homework Homework ~108
List the homework teachers have entered for each child, newest first: the date, subject, teacher and what to do. It reads the homework Wilma's front page lists (Wilma decides how far back that goes). wilma_summary already includes the last few days' homework.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many entries per child, newest first (default 10). |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_lesson_notes Lesson notes and absences ~183
Lesson notes (merkinnät) teachers logged: absences, lateness, and feedback such as praise or missing books or homework, with the teacher's own words when given. One day (default today), the last N days, or a period with from/to, which can reach ahead (a teacher may note a make-up exam on a coming lesson).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | YYYY-MM-DD, default today. |
| days | integer | – | The last N days up to today, instead of one date. |
| from | string | – | Start of a period, YYYY-MM-DD, instead of a date or days. |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
| to | string | – | End of the period, YYYY-MM-DD (default today; may be after today). |
No output schema declared.
No examples provided.
wilma_lesson_notes_summary Absences and feedback summary ~108
Lesson notes counted by kind (e.g. absences for health reasons, unexplained absences, lateness, praise, missing study materials): this school year by default, or from a date.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | YYYY-MM-DD. Default: the start of the school year. |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
| to | string | – | YYYY-MM-DD. Default: today. |
No output schema declared.
No examples provided.
wilma_list_messages List messages ~140
Wilma messages, newest first (subject, sender, date, id, unread, replyCount). The appointments folder holds event invitations (parents' evenings, learning discussions) with the family's answer as Wilma lists it: invitationStatus ("Applied": signed up, the time in invitationInfo; "ExpiredReg": sign-up closed; null: no answer shown). Use wilma_read_message for the full text, and for an invitation's time slots.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Default: inbox. |
| limit | integer | – | – |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_list_news List school news ~158
School bulletins (tiedotteet): the newest dated ones, then pinned ones (pinned: true, e.g. the school-year bulletin), and with include_older also older bulletins (archived: true). Use wilma_read_news for the full text and attachments. unavailable: ["news"] means this Wilma doesn't show this account its bulletins, which isn't the same as having none.
| Name | Type | Req | Description |
|---|---|---|---|
| include_older | boolean | – | Also list older bulletins (titles only until read). |
| limit | integer | – | How many dated bulletins (default 20). Pinned ones are always included. |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_list_printouts List printouts ~61
PDF documents the school offers (Tulosteet), such as report cards or absence reports. Fetch one with wilma_get_printout.
| Name | Type | Req | Description |
|---|---|---|---|
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_login Log in to Wilma ~54
Open a login page in the user's browser to connect a Wilma account, or add another one (for a child at a school with a different Wilma). The password is entered on that page, never in the chat.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
wilma_logout Log out of Wilma ~92
End WilmAI's Wilma session, as Wilma's own Log out does. Wilma allows one session per account, so use this when the user wants to use Wilma in their browser or asks to log out. The login stays saved: the next Wilma tool call logs in again, and that ends the user's session in the browser, so don't call other Wilma tools afterwards unless the user asks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
wilma_read_message Read message ~56
Full text of one Wilma message, including thread replies.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Message id from a list. |
| student | string | – | The student the message was listed under (required when several Wilmas are connected). |
No output schema declared.
No examples provided.
wilma_read_news Read news bulletin ~68
Full text of one bulletin plus its linked resources (attachments and links). Fetch a resource with wilma_get_news_attachment.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | News id from a list. |
| student | string | – | The student the bulletin was listed under (required when several Wilmas are connected). |
No output schema declared.
No examples provided.
wilma_schedule Lesson schedule ~263
List each child's lessons for one day or a school week: today, the next school day, this or next week (Monday to Friday), a date, or the next given weekday; or any other week or period with from/to (e.g. a week further ahead, or several weeks to see the usual school days). Lessons come in time order with the date, start and end time, subject, teacher and room (when Wilma gives one); a day without school has no lessons. Exams and homework are in wilma_upcoming_exams and wilma_homework.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | A specific date, YYYY-MM-DD. Overrides 'when'. |
| from | string | – | Start of a period, YYYY-MM-DD. Overrides 'when'. |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
| to | string | – | End of the period, YYYY-MM-DD (default: the Friday of from's week). At most 31 days. |
| weekday | string | – | Next occurrence of a weekday: mon..sun (Finnish ma..su also work). Overrides 'when'. |
| when | string | – | Default: week. 'tomorrow' means the next school day. |
No output schema declared.
No examples provided.
wilma_summary School summary ~192
Daily briefing per child: today's and the next school day's lessons, upcoming exams (with start times when given), recent homework, lesson notes since the previous school day (teachers' feedback and absences), recent bulletins, and recent and unread messages (ids, unread, replyCount; event invitations with invitationStatus, as in wilma_list_messages). What Wilma didn't give is listed in unavailable ("news": this Wilma doesn't show this account its bulletins). The best starting point for any question about school.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | How many days back to include news and messages (default 7). |
| since | string | – | Only what is new from this day on (YYYY-MM-DD or 'yesterday'): bulletins, messages, homework, lesson notes. For daily runs. |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
wilma_upcoming_exams Upcoming exams ~108
List each child's exams from today on that have no grade yet, soonest first: the date, start time (when the school gives one), exam name, subject, topic (what to study) and teacher. Graded exams are in wilma_grades.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many exams per child, soonest first (default 20). |
| student | string | – | Child's name or student number. Omit to include every child on the account. |
No output schema declared.
No examples provided.
How do I install the WilmAI MCP server?
WilmAI runs locally as an npm package, launched with npx -y @wilm-ai/wilma-cli. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @wilm-ai/wilma-cli
claude mcp add ai-wilm-wilma -- npx -y @wilm-ai/wilma-cli
What is the WilmAI MCP server?
WilmAI is an MCP server listed in the public MCP registry as ai.wilm/wilma. Finland's Wilma school system for parents and students: schedule, homework, exams and messages. This page covers its npm package (@wilm-ai/wilma-cli).
Is the WilmAI MCP server safe to use?
WilmAI scores 68 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the WilmAI MCP server expose?
WilmAI exposes 20 tools: wilma_summary, wilma_schedule, wilma_homework, wilma_upcoming_exams, wilma_grades, and 15 more. Their descriptions and schemas cost roughly 2,505 tokens of context every time the server is loaded.
Is the WilmAI MCP server still maintained?
WilmAI is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the WilmAI MCP server under?
WilmAI declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.