SCORM Packager (HTML → SCORM 2004)
NPM · SCORM-MCP-SERVER · 2 COMPONENTS · SCANNED SEP 20
Turn HTML or mobile-learning exports into SCORM 2004/1.2 packages, and validate any SCORM zip.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 42 of 130 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 25 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability59
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2042 tokens (~680/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the SCORM Packager (HTML → SCORM 2004) MCP server?
SCORM Packager (HTML → SCORM 2004) runs locally as an npm package, launched with npx -y scorm-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · scorm-mcp-server
claude mcp add giacomomaria81-scorm-mcp-server -- npx -y scorm-mcp-server
{
"mcpServers": {
"giacomomaria81-scorm-mcp-server": {
"command": "npx",
"args": [
"-y",
"scorm-mcp-server"
]
}
}
} {
"servers": {
"giacomomaria81-scorm-mcp-server": {
"command": "npx",
"args": [
"-y",
"scorm-mcp-server"
]
}
}
} codex mcp add giacomomaria81-scorm-mcp-server -- npx -y scorm-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"giacomomaria81-scorm-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"scorm-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add giacomomaria81-scorm-mcp-server --command npx --arg -y --arg scorm-mcp-server
mcp_servers:
giacomomaria81-scorm-mcp-server:
command: "npx"
args: ["-y", "scorm-mcp-server"] {
"McpServers": {
"giacomomaria81-scorm-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"scorm-mcp-server"
]
}
}
} assistant mcp add giacomomaria81-scorm-mcp-server -t stdio -c npx -a -y scorm-mcp-server
{
"mcpServers": {
"giacomomaria81-scorm-mcp-server": {
"command": "npx",
"args": [
"-y",
"scorm-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −2
- Stability: pass → 0.87 functional
- 19 Sept 26 0
- Stability: 0.97 → pass security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
- 12 Sept 26 0
- Stability: 0.97 → pass security
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/scorm-mcp-server@2.3.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 130 packages
| Packages resolved | 130 |
|---|---|
| Deprecated | 1 |
| Stale | 42 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
scorm_package Package HTML as SCORM (2004 or 1.2) ~1,619
Convert a self-contained HTML document, a folder, a .zip, a Claude Design (.dc) bundle OR a mobile-learning platform content export (Excel activity templates + media) into a SCORM package (.zip) — SCORM 2004 4th Edition by default, or SCORM 1.2 for legacy LMSs. Use this to turn a finished learning module (for example HTML produced by Claude Design) into a file that any SCORM-compliant LMS can import. The conversion is faithful: the HTML is preserved, external assets are inlined as data URIs so the package runs 100% offline, and a small runtime is injected to report completion and progress. MIGRATION FROM MOBILE-LEARNING PLATFORMS: if the input zip/folder contains Excel activity templates (mobile course cards, quiz games...) plus a media folder — the format produced by the platform's content export — the tool rebuilds an interactive HTML course from them (info/transition/flash cards, scored quizzes reporting cmi.score, media embedded, the platform's layout codes rendered) and packages it. No title needed: it is derived from the template file names. Combined with batch mode this migrates a whole course catalogue in one call. PROGRESS / COMPLETION MODEL (milestones): The author can mark meaningful steps with data-jalon + optional data-trigger: - <section data-jalon="histoire-produit" data-trigger="view"> ... </section> (counts when scrolled into view; "view" is the default) - <button data-jalon="argumentaire" data-trigger="click">J'ai lu</button> (counts on click) - <video data-jalon="geste" data-trigger="ended"> ... </video> (counts when playback ends) AUTOMATIC FALLBACK: if the HTML declares NO milestone, they are generated automatically from the document structure (sections → articles → h2 → h3, capped at 8, trigger "view"). So plain HTML "just works" with meaningful progress — you do NOT need to ask the author to add attributes first. Explicit data-jalon attributes always take precedence (recommended for click/video steps). The ru…
| Name | Type | Req | Description |
|---|---|---|---|
| auto_milestones | boolean | – | When the HTML declares no [data-jalon] milestone, auto-generate 'view' milestones from the document structure (sections, then articles, then headings; max 8). Default: true. |
| base_url | string | – | Base URL to resolve relative/root-relative asset references over the network (only needed if the HTML uses relative URLs and no input_path is given). |
| batch | boolean | – | Treat input_path as a DIRECTORY containing several courses (each sub-directory, .zip or .html file = one course). Produces one package per course plus a consolidated report. Course titles default to… |
| format | string | – | Input format. 'auto' (default) detects Claude Design .dc bundles by signature; override to force a pipeline. |
| html | string | – | Raw HTML content to convert (e.g. the output of Claude Design). Provide this OR input_path. |
| identifier | string | – | Manifest identifier. Auto-generated from the title if omitted. |
| input_path | string | – | Absolute path to an HTML file on disk. Its folder is used to resolve relative assets. Provide this OR html. |
| language | string | – | Content language tag (BCP-47), e.g. 'fr-FR', 'en-US', 'it-IT'. Default: 'fr-FR'. Applied as <html lang> when the source declares none. |
| mastery_score | number | – | Pass threshold 0..1. Enables score-based success (passed/failed from cmi.score.scaled) and adds sequencing objectives to the manifest. Content reports the score via window.SCORM2004.score(raw,min,max… |
| output_dir | string | – | Directory to write the .zip package into. Defaults to $SCORM_OUTPUT_DIR or ~/scorm-packages. |
| scorm_version | string | – | SCORM edition of the produced package. '2004' (default, 4th Edition) or '1.2' for legacy LMSs. The injected runtime is adaptive and works with both LMS APIs; this choice controls the manifest and bun… |
| success_on_completion | boolean | – | Also report cmi.success_status='passed' when the module completes (equivalent to adding data-scorm-success="on-completion"). Default: false. |
| title | string | – | Course / module title, used as the manifest, organization and item title shown in the LMS. Required for HTML inputs; optional for a mobile-learning Excel export, where it is derived from the template… |
| vendor_cdn | boolean | – | For Claude Design (.dc) bundles: download CDN libs (React/Babel…) into the package so it runs offline (via window.__resources, no source patch). Default: true. |
No output schema declared.
No examples provided.
scorm_selftest SCORM packager self-test ~65
Diagnostic tool with NO arguments: packages a constant built-in HTML and reports version, duration and output path. Distinguishes 'server broken' from 'input problem' in one second. Writes one small file (selftest-scorm2004.zip) into the output directory.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
scorm_validate Validate an existing SCORM package ~358
Check whether an EXISTING SCORM .zip (made by this tool or by ANY other authoring tool) is conformant and will import into an LMS — and if not, explain exactly why. Use this when an LMS rejects a package, before uploading a package to production, or to audit a batch of courses received from a vendor. The input is never modified. Checks performed: - the archive is a readable zip with imsmanifest.xml at its ROOT (detects the classic "zipped the folder instead of its contents" mistake and says how to fix it) - the manifest is well-formed XML and the SCORM edition is identified (2004 or 1.2) - an <organization> with a launchable <item> exists, resolving to a scormType="sco" <resource> with an href - the launch file and every <file href> listed in the manifest actually exist in the archive (case-only mismatches are flagged: they work on Windows but fail on the Linux servers most LMSs run on) - the manifest validates against the official ADL XSD schemas (XSDs bundled in the package are used first; missing ones are supplied from the copies embedded in this tool, so packages that ship without schemas can still be validated). Requires xmllint; skipped with a warning otherwise. Args: - input_path (string, required): path to the .zip to validate. Returns JSON: { ok, scorm_version, title, entry_href, files_in_zip, checks: [{id, label, ok, detail}], errors, warnings, schema_validation }
| Name | Type | Req | Description |
|---|---|---|---|
| input_path | string | yes | Path to the SCORM .zip file to validate. |
No output schema declared.
No examples provided.
What is the SCORM Packager (HTML → SCORM 2004) MCP server?
SCORM Packager (HTML → SCORM 2004) is an MCP server listed in the public MCP registry as io.github.giacomomaria81/scorm-mcp-server. Turn HTML or mobile-learning exports into SCORM 2004/1.2 packages, and validate any SCORM zip. This page covers its npm package (scorm-mcp-server).
Is the SCORM Packager (HTML → SCORM 2004) MCP server safe to use?
SCORM Packager (HTML → SCORM 2004) scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SCORM Packager (HTML → SCORM 2004) MCP server expose?
SCORM Packager (HTML → SCORM 2004) exposes 3 tools: scorm_package, scorm_validate, scorm_selftest. Their descriptions and schemas cost roughly 2,042 tokens of context every time the server is loaded.
Is the SCORM Packager (HTML → SCORM 2004) MCP server still maintained?
SCORM Packager (HTML → SCORM 2004) is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SCORM Packager (HTML → SCORM 2004) MCP server under?
SCORM Packager (HTML → SCORM 2004) declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.