# WilmAI (npm · @wilm-ai/wilma-cli)

Finland's Wilma school system for parents and students: schedule, homework, exams and messages.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `@wilm-ai/wilma-cli`: 68/100 (this document), [markdown](https://verifymcp.io/servers/ai-wilm-wilma/wilm-ai-wilma-cli.md), [page](https://verifymcp.io/servers/ai-wilm-wilma/wilm-ai-wilma-cli)

## Channel facts

- Registry: `npm`
- Package: `@wilm-ai/wilma-cli`
- Version: `2.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 90/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects tmp 0.0.33, reached via @inquirer/prompts > @inquirer/editor > external-editor > tmp. A fixed version is available.
  - No install/post-install scripts declared.
  - 43 of 164 dependencies flagged as unhealthy (1 deprecated).
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2855 tokens (~142/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 96% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the WilmAI MCP server?

WilmAI runs locally as an npm package, launched with npx -y @wilm-ai/wilma-cli. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add ai-wilm-wilma -- npx -y @wilm-ai/wilma-cli
```

### Cursor

```json
{
  "mcpServers": {
    "ai-wilm-wilma": {
      "command": "npx",
      "args": [
        "-y",
        "@wilm-ai/wilma-cli"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ai-wilm-wilma": {
      "command": "npx",
      "args": [
        "-y",
        "@wilm-ai/wilma-cli"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add ai-wilm-wilma -- npx -y @wilm-ai/wilma-cli
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-wilm-wilma": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@wilm-ai/wilma-cli"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-wilm-wilma --command npx --arg -y --arg @wilm-ai/wilma-cli
```

### Hermes

```yaml
mcp_servers:
  ai-wilm-wilma:
    command: "npx"
    args: ["-y", "@wilm-ai/wilma-cli"]
```

### Netclaw

```json
{
  "McpServers": {
    "ai-wilm-wilma": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@wilm-ai/wilma-cli"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add ai-wilm-wilma -t stdio -c npx -a -y @wilm-ai/wilma-cli
```

### Other

```json
{
  "mcpServers": {
    "ai-wilm-wilma": {
      "command": "npx",
      "args": [
        "-y",
        "@wilm-ai/wilma-cli"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 68, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-11-03 (score 52, 0)

- [functional regression] Schema quality: 106 → 142
- [functional improvement] Tool coverage: 87% → 96%
- [functional improvement] Stability: unverified → 0.03
- [functional] Schema quality: good → excellent
- [functional] Package version: 2.3.2 → 2.4.0

### 2026-11-02 (score 52)

First indexed and scored.

## MCP tools (20)

### `wilma_summary` (~192 tokens)

School summary

Daily briefing per child: today's and the next school day's lessons, upcoming exams (with start times when given), recent homework, lesson notes since the previous school day (teachers' feedback and absences), recent bulletins, and recent and unread messages (ids, unread, replyCount; event invitations with invitationStatus, as in wilma_list_messages). What Wilma didn't give is listed in unavailable ("news": this Wilma doesn't show this account its bulletins). The best starting point for any question about school.

Input parameters:

- `days` (integer): How many days back to include news and messages (default 7).
- `since` (string): Only what is new from this day on (YYYY-MM-DD or 'yesterday'): bulletins, messages, homework, lesson notes. For daily runs.
- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_schedule` (~263 tokens)

Lesson schedule

List each child's lessons for one day or a school week: today, the next school day, this or next week (Monday to Friday), a date, or the next given weekday; or any other week or period with from/to (e.g. a week further ahead, or several weeks to see the usual school days). Lessons come in time order with the date, start and end time, subject, teacher and room (when Wilma gives one); a day without school has no lessons. Exams and homework are in wilma_upcoming_exams and wilma_homework.

Input parameters:

- `date` (string): A specific date, YYYY-MM-DD. Overrides 'when'.
- `from` (string): Start of a period, YYYY-MM-DD. Overrides 'when'.
- `student` (string): Child's name or student number. Omit to include every child on the account.
- `to` (string): End of the period, YYYY-MM-DD (default: the Friday of from's week). At most 31 days.
- `weekday` (string): Next occurrence of a weekday: mon..sun (Finnish ma..su also work). Overrides 'when'.
- `when` (string): Default: week. 'tomorrow' means the next school day.

### `wilma_homework` (~108 tokens)

Homework

List the homework teachers have entered for each child, newest first: the date, subject, teacher and what to do. It reads the homework Wilma's front page lists (Wilma decides how far back that goes). wilma_summary already includes the last few days' homework.

Input parameters:

- `limit` (integer): How many entries per child, newest first (default 10).
- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_upcoming_exams` (~108 tokens)

Upcoming exams

List each child's exams from today on that have no grade yet, soonest first: the date, start time (when the school gives one), exam name, subject, topic (what to study) and teacher. Graded exams are in wilma_grades.

Input parameters:

- `limit` (integer): How many exams per child, soonest first (default 20).
- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_grades` (~224 tokens)

Exam grades

List each child's graded exams, newest first: the date, exam name, subject, grade as Wilma shows it (e.g. 8+, 9½, S), the teacher's notes and when a guardian marked it seen. It reads the exams Wilma's front page lists (Wilma decides how far back that goes); with from, Wilma's list of past exams for that period instead, as far back as the school keeps them, including exams still waiting for a grade (grade: null). For course, term and report-card grades use wilma_gradebook.

Input parameters:

- `from` (string): YYYY-MM-DD: past exams from this day on, e.g. 1 August for this school year.
- `limit` (integer): How many grades per child, newest first (default 20; with from, every exam of the period).
- `student` (string): Child's name or student number. Omit to include every child on the account.
- `to` (string): YYYY-MM-DD, with from. Default: today.

### `wilma_lesson_notes` (~183 tokens)

Lesson notes and absences

Lesson notes (merkinnät) teachers logged: absences, lateness, and feedback such as praise or missing books or homework, with the teacher's own words when given. One day (default today), the last N days, or a period with from/to, which can reach ahead (a teacher may note a make-up exam on a coming lesson).

Input parameters:

- `date` (string): YYYY-MM-DD, default today.
- `days` (integer): The last N days up to today, instead of one date.
- `from` (string): Start of a period, YYYY-MM-DD, instead of a date or days.
- `student` (string): Child's name or student number. Omit to include every child on the account.
- `to` (string): End of the period, YYYY-MM-DD (default today; may be after today).

### `wilma_lesson_notes_summary` (~108 tokens)

Absences and feedback summary

Lesson notes counted by kind (e.g. absences for health reasons, unexplained absences, lateness, praise, missing study materials): this school year by default, or from a date.

Input parameters:

- `from` (string): YYYY-MM-DD. Default: the start of the school year.
- `student` (string): Child's name or student number. Omit to include every child on the account.
- `to` (string): YYYY-MM-DD. Default: today.

### `wilma_gradebook` (~98 tokens)

Gradebook

Get each child's gradebook (Suoritukset): completed courses and their grades, grouped by subject (subject > syllabus > course), with course codes, credits and completion dates, plus term and school-year (report card) grades. Use it for course and report-card grades; single exam grades are in wilma_grades.

Input parameters:

- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_contacts` (~114 tokens)

Class and teachers

Each child's class (e.g. 9A), class teacher and other supervisors with their role as Wilma names it (e.g. Luokanvalvoja), and the child's own teachers as Wilma's message recipients list them, with the subjects each teaches the child in this and next week's timetable (empty when none). Other school staff aren't included. Lessons with times and rooms are in wilma_schedule.

Input parameters:

- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_list_printouts` (~61 tokens)

List printouts

PDF documents the school offers (Tulosteet), such as report cards or absence reports. Fetch one with wilma_get_printout.

Input parameters:

- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_get_printout` (~83 tokens)

Get printout

Fetch one printout PDF so you can read it. Set save=true to also save it to the user's Downloads folder.

Input parameters:

- `id` (string, required): Printout id from wilma_list_printouts.
- `save` (boolean): Also save the file to ~/Downloads/WilmAI.
- `student` (string): The student the printout was listed under.

### `wilma_list_messages` (~140 tokens)

List messages

Wilma messages, newest first (subject, sender, date, id, unread, replyCount). The appointments folder holds event invitations (parents' evenings, learning discussions) with the family's answer as Wilma lists it: invitationStatus ("Applied": signed up, the time in invitationInfo; "ExpiredReg": sign-up closed; null: no answer shown). Use wilma_read_message for the full text, and for an invitation's time slots.

Input parameters:

- `folder` (string): Default: inbox.
- `limit` (integer)
- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_read_message` (~56 tokens)

Read message

Full text of one Wilma message, including thread replies.

Input parameters:

- `id` (integer, required): Message id from a list.
- `student` (string): The student the message was listed under (required when several Wilmas are connected).

### `wilma_list_news` (~158 tokens)

List school news

School bulletins (tiedotteet): the newest dated ones, then pinned ones (pinned: true, e.g. the school-year bulletin), and with include_older also older bulletins (archived: true). Use wilma_read_news for the full text and attachments. unavailable: ["news"] means this Wilma doesn't show this account its bulletins, which isn't the same as having none.

Input parameters:

- `include_older` (boolean): Also list older bulletins (titles only until read).
- `limit` (integer): How many dated bulletins (default 20). Pinned ones are always included.
- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_read_news` (~68 tokens)

Read news bulletin

Full text of one bulletin plus its linked resources (attachments and links). Fetch a resource with wilma_get_news_attachment.

Input parameters:

- `id` (integer, required): News id from a list.
- `student` (string): The student the bulletin was listed under (required when several Wilmas are connected).

### `wilma_get_news_attachment` (~149 tokens)

Get bulletin attachment

Fetch a file linked from a bulletin (e.g. a PDF letter or menu) so you can read it. Returns the file content when it is a file, or 'not_a_file' with the URL when the link is a web page. Set save=true to also save it to the user's Downloads folder.

Input parameters:

- `news_id` (integer, required)
- `resource_id` (string, required): Resource id from wilma_read_news, e.g. resource-1 (or just 1).
- `save` (boolean): Also save the file to ~/Downloads/WilmAI.
- `student` (string): Child's name or student number. Omit to include every child on the account.

### `wilma_account` (~131 tokens)

Wilma account status

Which Wilma logins are connected: each one's Wilma, username, role ("guardian", or "student" for a student's own login) and the children it lists. Families with children on different Wilmas connect one login per Wilma (wilma_login adds another). When two logins on one Wilma list the same child (a parent's and the child's own), tools read that child through the guardian's login, and the other login's entry for the child says readVia. A child unticked on the login page (a profile Wilma lists twice) has hidden: true and isn't read.

### `wilma_find_school` (~115 tokens)

Find a school's Wilma

Search Finland's Wilma addresses by city or by school or organisation name. Most city schools share their city's Wilma (big cities don't list each school), while many colleges, private schools and small municipalities' schools have their own. Use it to help the user pick their Wilma, e.g. when setting WILMA_TENANT; several can serve one city, so ask which is theirs.

Input parameters:

- `query` (string, required): City, municipality or school name, e.g. Tampere or Kalevan lukio.

### `wilma_login` (~54 tokens)

Log in to Wilma

Open a login page in the user's browser to connect a Wilma account, or add another one (for a child at a school with a different Wilma). The password is entered on that page, never in the chat.

### `wilma_logout` (~92 tokens)

Log out of Wilma

End WilmAI's Wilma session, as Wilma's own Log out does. Wilma allows one session per account, so use this when the user wants to use Wilma in their browser or asks to log out. The login stays saved: the next Wilma tool call logs in again, and that ends the user's session in the browser, so don't call other Wilma tools afterwards unless the user asks.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/ai-wilm-wilma/wilm-ai-wilma-cli#diagnostics

## Score history

- 2026-11-05: 68
- 2026-11-04: 68
- 2026-11-03: 52
- 2026-11-02: 52

## Common questions

### What is the WilmAI MCP server?

WilmAI is an MCP server listed in the public MCP registry as ai.wilm/wilma. Finland's Wilma school system for parents and students: schedule, homework, exams and messages. This page covers its npm package (@wilm-ai/wilma-cli).

### Is the WilmAI MCP server safe to use?

WilmAI scores 68 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the WilmAI MCP server expose?

WilmAI exposes 20 tools: wilma_summary, wilma_schedule, wilma_homework, wilma_upcoming_exams, wilma_grades, and 15 more. Their descriptions and schemas cost roughly 2,505 tokens of context every time the server is loaded.

### Is the WilmAI MCP server still maintained?

WilmAI is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the WilmAI MCP server under?

WilmAI declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@wilm-ai/wilma-cli
- Socket report: https://socket.dev/npm/package/@wilm-ai/wilma-cli
- Repository: https://github.com/aikarjal/wilmai
- Website: https://wilm.ai/
- Changelog RSS feed: https://verifymcp.io/servers/ai-wilm-wilma/wilm-ai-wilma-cli.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-wilm-wilma/wilm-ai-wilma-cli.json
- HTML version of this page: https://verifymcp.io/servers/ai-wilm-wilma/wilm-ai-wilma-cli