io.github.chrischall/gogcli-mcp-classroom

Authorize a Google account via browser-based OAuth. Opens a browser window where the user must sign in and grant access. Blocks for up to 5 minutes waiting for the user to complete authorization. If the browser does not open automatically, a fallback URL is included in the response. Use gog_auth_list to check which accounts are already configured.

Complete REMOTE/headless Google authorization (step 2 of 2). Takes the full redirected localhost URL the user copied after finishing gog_auth_add_url, exchanges it for a refresh token, and stores it. Use the SAME `services` value you passed to gog_auth_add_url. Must run within 10 minutes of step 1 and against the same gogcli host.

Begin REMOTE/headless Google authorization (step 1 of 2). Returns a sign-in URL to open in any browser — no local server or terminal on the gogcli host is needed, so this works on a hosted deployment where the interactive gog_auth_add cannot. Hand the URL to the user; after they sign in, the browser is redirected to a localhost URL that fails to load — that is expected. They copy that full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to gog_auth_add_complete or the second step will not match this one.

Check the LIVE health of each stored Google account. Unlike gog_auth_status (which only reports keyring/config setup), this performs a real token refresh against Google, so it detects expired or revoked (invalid_grant) refresh tokens — the account-wide sign-out that blocks every service. Reports per account: whether the token is currently valid, the mapped cause when it is not, how long ago it was authorized, and a warning as it approaches the 7-day refresh-token limit that applies to OAuth apps whose consent screen is still in "Testing" mode. Run it proactively to re-authorize on your own schedule instead of mid-task. On a hosted deployment this is the ONLY check that measures Google: a connector showing "connected" or "refreshed" has verified the client's connection to the MCP host, and nothing else — the Google credential lives in gog's keyring on that host and can be dead while the connection looks perfectly healthy.

List the Google accounts stored in gogcli, with their scopes. This reads local configuration only — it does not contact Google and does NOT tell you whether an account still works: a signed-out account whose refresh token expired or was revoked is listed here exactly like a healthy one, scopes and all. Use gog_auth_health to check whether an account can actually authenticate.

Run any gog auth subcommand not covered by the other tools. Run `gog auth --help` for the full list of subcommands, or `gog auth <subcommand> --help` for flags on a specific subcommand. Only these subcommands are available: list, status, services, alias. Flags that override server safety controls (--readonly, --enable-commands, --disable-commands, --account, --access-token, --home, --client, --gmail-no-send, --no-input) and a bare "--" are refused. Local file paths (--out, --out-dir, --attach, --file, --*-file, @file JSON) must be inside GOG_FILE_ROOTS; subcommands that take a local path positionally (e.g. drive upload) are refused in favour of their dedicated tools. For browser-based authorization, use gog_auth_add instead.

List all Google services supported by gogcli and the OAuth scopes each requires.

Show gogcli auth CONFIGURATION: keyring backend, credential files, and auth setup. Despite the name this is not a health check — it reads local setup and does not contact Google, so it says nothing about whether an account can still authenticate. Use gog_auth_health for that.

Create an announcement in a Google Classroom course. Unless state is DRAFT with no scheduled time (which students cannot see; a scheduled draft publishes itself), this reads the course and asks the MCP host to show the user a confirmation prompt with the class, the full text and when it publishes; nothing is posted unless they accept. To stage one without asking, pass state DRAFT and no scheduled time. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Delete an announcement.

Get a single announcement by ID.

List announcements in a Google Classroom course.

Update an existing announcement. Publishing it (state PUBLISHED, or a scheduled time) reads the course and the item and asks the MCP host to show the user a confirmation prompt with the class and what students will see; nothing is published unless they accept. Other edits, and a return to DRAFT, need no confirmation. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Archive a Google Classroom course.

Create a new Google Classroom course.

Delete a Google Classroom course — its coursework, submissions and grades go with it, for good. Reads the course and asks the MCP host to show the user a confirmation prompt naming it first; nothing is deleted unless they accept. gog_classroom_courses_archive is the reversible alternative. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Get a single Google Classroom course by ID.

List Google Classroom courses.

Unarchive a Google Classroom course (restore to ACTIVE).

Update an existing Google Classroom course. Setting owner transfers ownership of the course to that user — an access grant like inviting an OWNER — so the tool reads the course and asks the MCP host to show the user a confirmation prompt naming it and the new owner first; nothing changes unless they accept. Updates that leave the owner alone run without a prompt. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Create a new coursework item (assignment, question, etc.) in a course. Unless state is DRAFT with no scheduled time (which students cannot see; a scheduled draft publishes itself), the class is notified, so this reads the course and asks the MCP host to show the user a confirmation prompt with the class, the title, the text, the due date and when it publishes; nothing is posted unless they accept. To stage one without asking, pass state DRAFT and no scheduled time. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Delete a coursework item — every student submission to it goes too, for good. Reads the course and the coursework and asks the MCP host to show the user a confirmation prompt naming both first; nothing is deleted unless they accept. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Get a single coursework item by ID.

List coursework (assignments, questions, materials) for a course.

Update an existing coursework item. Publishing it (state PUBLISHED, or a scheduled time) reads the course and the item and asks the MCP host to show the user a confirmation prompt with the class and what students will see; nothing is published unless they accept. Other edits, and a return to DRAFT, need no confirmation. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Accept a Google Classroom invitation.

Create an invitation to a Google Classroom course — Classroom emails the invitee. Reads the course and asks the MCP host to show the user a confirmation prompt with the class, the invitee and the role; nothing is sent unless they accept. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Delete (revoke) a Google Classroom invitation.

Get a single invitation by ID.

List Google Classroom invitations.

Get a Google Classroom user profile. Omit userId to fetch the authenticated user.

List the full roster (students and/or teachers) of a Google Classroom course. Omit both flags to return both groups.

Run any gog classroom subcommand not covered by the other tools. Run `gog classroom --help` for the full list of subcommands, or `gog classroom <subcommand> --help` for flags on a specific subcommand. Flags that override server safety controls (--readonly, --enable-commands, --disable-commands, --account, --access-token, --home, --client, --gmail-no-send, --no-input) and a bare "--" are refused. Local file paths (--out, --out-dir, --attach, --file, --*-file, @file JSON) must be inside GOG_FILE_ROOTS; subcommands that take a local path positionally (e.g. drive upload) are refused in favour of their dedicated tools. Covers anything not wrapped by the dedicated tools (guardians, guardian-invitations, materials, coursework assignees, announcement assignees, etc.).

Add a student to a Google Classroom course. Adding someone else gives them the class stream and materials, so this reads the course and asks the MCP host to show the user a confirmation prompt with the class and the student first; enrolling yourself ("me") does not ask. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Get a specific student enrolled in a course.

List students enrolled in a Google Classroom course.

Remove a student from a Google Classroom course.

Get a single submission by ID.

Grade a student submission. Set draft and/or assigned grade values.

List student submissions for a coursework item.

Reclaim a turned-in submission (student action to edit a submission).

Return a graded submission to the student, who is notified and sees the grade. Reads the course, the coursework and the submission and asks the MCP host to show the user a confirmation prompt with the class, the assignment, the student and the grade being returned; nothing is returned unless they accept. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Turn in a student submission (student action).

Add a teacher to a Google Classroom course. A co-teacher sees every student's work and grades, so this reads the course and asks the MCP host to show the user a confirmation prompt with the class and the teacher first; nothing changes unless they accept. If the client cannot show that prompt (no MCP elicitation, e.g. claude.ai), a two-step flow applies instead: call WITHOUT confirmToken and nothing is sent or changed — the result has status "confirmation-required", the full preview and a confirmToken. Follow its instruction (by default: show the preview to the user verbatim and only after they explicitly approve it in chat, call again with the SAME arguments plus confirmToken). The tool re-reads what it would act on and refuses (DRAFT_CHANGED, with a fresh preview and token) if it changed; TOKEN_EXPIRED / TOKEN_REUSED / TOKEN_INVALID also do nothing. A server set to MCP_CONFIRM_MODE=refuse refuses instead.

Get a specific teacher in a course.

List teachers in a Google Classroom course.

Remove a teacher from a Google Classroom course.

Create a topic in a Google Classroom course.

Delete a topic.

Get a single topic by ID.