CourseCode Framework
NPM · COURSECODE
Preview, screenshot, lint, and test SCORM, cmi5, and LTI courses built with CourseCode Framework.
Available components
Last scanned (21 hours ago)
Scores higher than 40% of npm servers
Category Education and Research
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security93
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects minimatch 10.2.6, reached via archiver > readdir-glob > minimatch. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 78 of 236 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 4 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3310 tokens (~206/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management20
- Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +14
- CVE-2026-118764 affects this package: medium ▼ security
- Known CVEs: pass → fail ▼ security
- Malware scan: unverified → pass ▲ security
- 30 Oct 26 +1
- Malware scan: unverified → pass ▲ security
- Stability: unverified → 0.03 ▲ functional
- Package version: 0.4.3 → 0.4.4 functional
- 29 Oct 26 54
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/coursecode@0.4.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-g3hv-75wg-m249 | CVE-2026-118764 | medium | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 236 packages
| Packages resolved | 236 |
|---|---|
| Stale | 78 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
coursecode_assessment ~305
Read or drive the assessment (graded quiz) on the current slide by pressing the same buttons a learner would. Without 'action': returns the assessment state. With 'action': presses that button, waits for the assessment to update, and returns the new state. State: {id, view ('intro' | 'question' | 'review' | 'results'), questionIndex, question ({id, type, hasResponse} while a question shows), actions (buttons available now), modalOpen, attempts, lastResults} Typical run: 1. coursecode_navigate to the assessment slide 2. action 'start' 3. For each question: coursecode_interact with question.id from this state, then action 'next' 4. On the review screen: action 'submit' (if an unanswered-questions dialog opens, use 'confirm-unanswered-submit' or 'dismiss-unanswered-modal') 5. Read lastResults here and the LMS score/success in coursecode_state Other actions: 'prev', 'jump-to-review', 'review-question' (with questionIndex), 'back-to-questions', 'retake', 'go-to-remedial', 'restart-course'. An unavailable action returns an error listing the available ones. Requires preview server to be running.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Button to press. Omit to read the current assessment state. |
| questionIndex | number | – | 0-based question to edit; required for 'review-question' |
No output schema declared.
No examples provided.
coursecode_build ~112
Build the course for deployment. Runs the Vite production build. Returns: - success: boolean - format: LMS format used - outputDir: path to built output - errors: any build errors - warnings: any build warnings - duration: build time Use in Stage 5 when the course is ready for export.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | LMS format: cmi5, scorm2004, scorm1.2, or lti (default: cmi5) |
No output schema declared.
No examples provided.
coursecode_component_catalog ~111
Get UI component information. Without 'type': returns compact list of all components (name + description + engagement tracking type). With 'type': returns full schema, metadata, and HTML usage template for that specific component. Components are declarative HTML (data-component attributes). No imports needed—just use the HTML patterns in your slide template. Use to discover available components before authoring slides.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | – | Optional component type to get full details for (e.g., "tabs", "accordion") |
No output schema declared.
No examples provided.
coursecode_css_catalog ~205
Browse or search CSS classes available for slide authoring. Three modes: - No args: compact table of contents (category names + class counts) - category: full class list with abbreviated declarations for one category - search: find classes by name across all categories Author-facing categories (layout, utilities, common components) shown by default. Framework-internal categories (interactions, accessibility, app shell) hidden — set includeInternal: true to include them. Use to discover available CSS classes before authoring slides. Lint catches invalid classes with fix suggestions.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Get full class details for this category (e.g., "utilities/spacing", "layout", "components/cards") |
| includeInternal | boolean | – | Include framework-internal categories (interactions, accessibility, app shell). Default: false. |
| search | string | – | Search class names (e.g., "gap", "card", "text-"). Returns matching classes with declarations. |
No output schema declared.
No examples provided.
coursecode_errors ~185
Get all current live preview diagnostics without the heavyweight course state payload. This is the primary "what is broken right now?" tool after edits. It aggregates: - build: Vite/build-watch errors and warnings from the running preview server - runtime: stub LMS/debug-panel errors and warnings - framework: CourseCode logger warnings/errors - console: browser console warnings/errors This is different from coursecode_lint, which is a static/build-time linter and does not inspect the running preview. Returns: - build/runtime/framework/console: grouped diagnostics by source - issues/errors: flat list [{source, severity, isWarning, type, message, hint?}] for agents - count: total issue count - clean: true if no live issues were found - runtimeErrors/frameworkLogs/consoleLogs: source-specific aliases Requires preview server to be running.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
coursecode_icon_catalog ~94
Get icon information. Without 'name': returns all available icon names grouped by category, with counts and usage syntax. With 'name': returns the icon's SVG content, category, and usage examples (JS, config, HTML). Use to discover available icons before authoring slides or configuring menus.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Optional icon name to get full details for (e.g., "check", "book-open") |
No output schema declared.
No examples provided.
coursecode_interact ~200
Set a response for an interaction AND evaluate it in one call. Returns: - correct: boolean - score: 0-1 - feedback: feedback message if any - state: updated course state Response format depends on interaction type: - multiple-choice: 'a', 'b', 'c', etc. - true-false: true or false - fill-in-blank: {blankId: 'answer'} - drag-drop: {itemId: 'zoneId'} - numeric: number - sequencing: ['id1', 'id2', 'id3'] Assessment questions (see coursecode_assessment) are only saved here: the result is {answered, gradedOn: 'submit', assessment}, and the score comes from submitting the assessment. Requires preview server to be running.
| Name | Type | Req | Description |
|---|---|---|---|
| interactionId | string | yes | The interaction ID to answer |
| response | – | yes | The response value (format depends on interaction type) |
No output schema declared.
No examples provided.
coursecode_interaction_catalog ~115
Get interaction type information. Without 'type': returns compact list of all interaction types (name + description). With 'type': returns full schema, properties, and factory name for that specific interaction. Interactions use factory functions from the global CourseCode object (e.g., const { createMultipleChoiceQuestion } = CourseCode). No import statements needed. Use to discover available interactions before creating assessments.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | – | Optional interaction type to get full details for (e.g., "multiple-choice", "drag-drop") |
No output schema declared.
No examples provided.
coursecode_lint ~244
Run the static course linter and get structured results. This is a preflight/static validation tool for config, source structure, CSS class names, and schema rules. It does NOT inspect the running preview and does NOT include live runtime, browser console, or Vite build-watch diagnostics. Use coursecode_errors for the live "what is broken right now?" view when preview is running. Returns: - errors: [{slideId?, rule, message, severity, hint?}] - warnings: [{slideId?, rule, message, severity, hint?}] - passed: boolean Static rules (always checked): - undefined-css-class: hallucinated or stale class names (with fix suggestions) - unknown-component: unregistered data-component types - requirement-missing-component: engagement requirement without matching component - missing-slide-file: slide references non-existent file - slide-id-filename-mismatch: slide ID doesn't match component filename - assessment-id-mismatch: config ID doesn't match assessment ID - invalid-gating: bad gating condition configuration Use after making source/config changes as a fast static check. Then use coursecode_errors against the running preview for live diagnostics.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
coursecode_narration ~429
Generate (or dry-run) audio narration for slides via the configured TTS provider. Reads `export const narration = ...` from each slide file, hashes text+voice settings, and only regenerates audio whose hash changed since the last run (cache: .narration-cache.json). MP3 files are written to course/assets/audio/. Provider selection follows the same rules as the CLI: TTS_PROVIDER env var, or auto-detect from API keys, default deepgram. The .env file at the project root supplies API keys. USE WHEN: - The lint reports stale narration warnings ("narration audio is stale..."). - You added or modified narration text in a slide. - You want to confirm what would be generated (use dryRun: true — no API calls, no audio written). APPROVAL: - Real generation (dryRun omitted or false) calls a TTS provider and writes MP3 files, so it requires explicit user approval before running. - Use dryRun: true first when you only need to inspect what would be regenerated. Returns: - success, summary (e.g. "3 generated, 5 unchanged") - generated, skipped, noNarration counts - errors[], warnings[] - output: tail of the generator's console output for debugging - dryRun: echoes the input flag NOT idempotent: real runs call paid TTS APIs and write files. Prefer dryRun first.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | Show what would be generated without calling TTS or writing files (default: false). |
| force | boolean | – | Regenerate every narration item, ignoring the cache (default: false). Use sparingly — costs API credits. |
| rebuildCache | boolean | – | Rebuild .narration-cache.json from existing audio files without calling TTS (default: false). Use after a fresh clone or when the cache is missing but audio is committed. Free; no API calls. |
| slide | string | – | Optional slide ID filter (e.g. "intro"). Only narration for this slide is processed. |
No output schema declared.
No examples provided.
coursecode_navigate ~166
Navigate to a specific slide by ID. Returns: - slide: current slide ID - interactions: interactions on the new slide [{id, type, hasResponse, isChecked}] - engagement: slide engagement {complete, percentage, requirements} - accessibility: current accessibility state {theme, highContrast, largeFont, reducedMotion} Optionally set theme or highContrast before navigating. Use this to toggle dark mode for visual inspection. Use coursecode_state first to get the structure and find valid slide IDs. Requires preview server to be running.
| Name | Type | Req | Description |
|---|---|---|---|
| highContrast | boolean | – | Enable or disable high contrast mode before navigating |
| slideId | string | yes | The slide ID to navigate to |
| theme | string | – | Set theme before navigating: "light" or "dark" |
No output schema declared.
No examples provided.
coursecode_reset ~46
Clear learner state and restart the course. Use this to test from a fresh state. Clears localStorage and fully reloads the headless browser. Requires preview server to be running.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
coursecode_screenshot ~206
Take a screenshot of the course preview. Returns a JPEG image. Two quality modes (neither changes viewport): - normal (default): JPEG@50 (~20-40KB) — layout checks - detailed: JPEG@90 (~100-200KB) — close text/element inspection Captures at the current viewport size. Use coursecode_viewport to change viewport for responsive testing. Use scrollY to scroll course content before capturing (useful for long slides). fullPage captures the course iframe's full content area. Use to visually inspect slide layout, design, and component rendering. Requires preview server to be running.
| Name | Type | Req | Description |
|---|---|---|---|
| detailed | boolean | – | Higher JPEG quality for close inspection (does not change viewport) |
| fullPage | boolean | – | Capture full scrollable page instead of viewport |
| scrollY | number | – | Scroll course content to this Y position (pixels) before capturing |
| slideId | string | – | Navigate to this slide ID before taking screenshot |
No output schema declared.
No examples provided.
coursecode_state ~264
Get course state and live preview diagnostics in one call. Returns: - slide: current slide ID (string) - toc: course structure [{id, type, title, file?}] - interactions: interactions on current slide [{id, type, hasResponse, isChecked}] - engagement: slide engagement {complete, percentage, requirements} - lmsState: LMS data {score, completion, success, bookmark, format, objectives, state} - apiLog: last 20 LMS API calls [{timestamp, method, args, result}] - diagnostics: live issue rollup with build, runtime, framework, console, issues, count, clean - issues/errors: flat live issue list [{source, severity, isWarning, type, message, hint?}] - runtimeErrors: runtime/debug-panel errors and warnings only - buildErrors/buildWarnings: backward-compatible build-watch aliases - frameworkLogs: structured framework log events [{level, domain, operation, message, stack?, timestamp}] - consoleLogs: browser console warnings/errors [{type, text, time}] Use this first to understand the course state before taking actions. For checking what is broken after file edits, prefer coursecode_errors — same live diagnostic sources, smaller payload. Requires preview server to be running.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
coursecode_viewport ~238
Set the headless browser viewport size for responsive design testing. Two modes: - Breakpoint name: 'mobile-portrait', 'mobile-landscape', 'tablet-portrait', etc. Resolves width dynamically from the course's breakpoint manager (always in sync with CSS). Height follows the orientation: 16:9 for desktop and landscape, 9:16 for mobile-portrait, 3:4 for tablet-portrait. - Explicit dimensions: {width: 375, height: 812} for specific device sizes. The viewport PERSISTS until changed again. Call with 'desktop' or {width: 1280, height: 720} to reset. Returns the applied viewport dimensions and breakpoint name (if used). Use before coursecode_screenshot to test responsive layouts. Requires preview server to be running.
| Name | Type | Req | Description |
|---|---|---|---|
| breakpoint | string | – | Named breakpoint from the course (e.g., "mobile-portrait", "tablet-landscape", "desktop") |
| height | number | – | Explicit viewport height in pixels (use with width) |
| width | number | – | Explicit viewport width in pixels (use with height) |
No output schema declared.
No examples provided.
coursecode_workflow_status ~177
Detect the current authoring stage and get stage-specific instructions. Returns: - stage: human-readable stage name - stageNumber: 1-5 - checklist: {hasRawRefs, hasConvertedRefs, hasOutline, hasSlides, hasCourseConfig, previewRunning} - nextAction: recommended next step - recommendedTool: MCP tool to use next - instructions: detailed guidance for the current stage Stages: 1. Source Ingestion - create project and convert reference docs 2. Outline Creation - build COURSE_OUTLINE.md from references 3. Course Building - create slides and course-config.js 4. Preview & Polish - iterate on visual quality and correctness 5. Export Ready - lint passes, ready for LMS deployment Call this after completing a major milestone to get updated guidance for the next stage.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the CourseCode Framework MCP server?
CourseCode Framework runs locally as an npm package, launched with npx -y coursecode. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · coursecode
claude mcp add course-code-framework-coursecode -- npx -y coursecode
What is the CourseCode Framework MCP server?
CourseCode Framework is an MCP server listed in the public MCP registry as io.github.course-code-framework/coursecode. Preview, screenshot, lint, and test SCORM, cmi5, and LTI courses built with CourseCode Framework. This page covers its npm package (coursecode).
Is the CourseCode Framework MCP server safe to use?
CourseCode Framework scores 71 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CourseCode Framework MCP server expose?
CourseCode Framework exposes 16 tools: coursecode_state, coursecode_errors, coursecode_navigate, coursecode_interact, coursecode_assessment, and 11 more. Their descriptions and schemas cost roughly 3,097 tokens of context every time the server is loaded.
Is the CourseCode Framework MCP server still maintained?
CourseCode Framework is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the CourseCode Framework MCP server under?
CourseCode Framework declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.