EduPage MCP Server
PYPI · EDUPAGE-MCP-FULL · 2 COMPONENTS · SCANNED SEP 20
EduPage MCP: timetables, grades, homework, meals, messages, 2FA, multi-school, role-aware.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 0 of 33 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability70
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2738 tokens (~59/item across 46 items; 46 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "send_message" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 46 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the EduPage MCP Server server?
EduPage MCP Server runs locally as a PyPI package, launched with uvx edupage-mcp-full. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · edupage-mcp-full
claude mcp add oliverhruby-edupage-mcp -- uvx edupage-mcp-full
{
"mcpServers": {
"oliverhruby-edupage-mcp": {
"command": "uvx",
"args": [
"edupage-mcp-full"
]
}
}
} {
"servers": {
"oliverhruby-edupage-mcp": {
"command": "uvx",
"args": [
"edupage-mcp-full"
]
}
}
} codex mcp add oliverhruby-edupage-mcp -- uvx edupage-mcp-full
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"oliverhruby-edupage-mcp": {
"type": "local",
"command": [
"uvx",
"edupage-mcp-full"
],
"enabled": true
}
}
} openclaw mcp add oliverhruby-edupage-mcp --command uvx --arg edupage-mcp-full
mcp_servers:
oliverhruby-edupage-mcp:
command: "uvx"
args: ["edupage-mcp-full"] {
"McpServers": {
"oliverhruby-edupage-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"edupage-mcp-full"
]
}
}
} assistant mcp add oliverhruby-edupage-mcp -t stdio -c uvx -a edupage-mcp-full
{
"mcpServers": {
"oliverhruby-edupage-mcp": {
"command": "uvx",
"args": [
"edupage-mcp-full"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 −12
- Malware scan: pass → unverified ▼ security
- Security disclosure: fail → unverified ▼ functional
- Stability: unverified → 0.17 ▲ functional
- Package version: 0.4.6 → 0.4.11 functional
- 9 Sept 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/edupage-mcp-full@0.4.11
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 33 packages
| Packages resolved | 33 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
auth_status ~21
Show login status for all configured subdomains and the active one.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
choose_meal ~79
Order/choose a meal for a date. meal_type: 'snack'|'lunch'|'afternoon_snack'. number: 1-based menu choice among the chooseable menus.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | yes | – |
| meal_type | string | yes | – |
| number | integer | yes | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
clear_student_cache ~59
Force refresh of cached student data. Call this after students are added/removed from a school, or if scan_students/find_student returns stale results. Without a subdomain, clears the cache for ALL schools.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
custom_request ~73
Send a raw request to the Edupage server using the active session. method: 'GET'|'POST'. Returns status code and body text.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | – | – |
| headers | string | – | – |
| method | string | yes | – |
| subdomain | string | – | – |
| url | string | yes | – |
No output schema declared.
No examples provided.
find_student ~110
Look up a student by first/last/full name using tiered matching. Without a `subdomain`, searches ALL logged-in schools and returns one result per school where the student is found. Returns student info with match confidence tiers (1=exact, 2=first name, 3=last name, 4=substring). Use student_id from results with get_student_timetable for unambiguous lookups.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_absences ~27
Get the student's absence records from the timeline notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_all_students ~28
Get a short list of all students in the school.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_assignments ~34
Get all assignments (homework, tests, exams, projects) from the timeline.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_classes ~23
Get all classes in the school.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_classrooms ~24
Get all classrooms in the school.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_day_summary ~272
One-call daily school report for a date (default today): timetable, substitutions, missing teachers, grades received that day, meals, homework, assignments, absences, news, events, and timeline notifications. Composes the individual section tools so you don't need to fire 8-10 calls to answer "what happened yesterday at school" or "what's coming tomorrow". - If `name`/`student_id` is provided: report for that specific student (found across all schools unless `subdomain` scopes it). - If omitted: **discovery-first** — for a **parent** this returns a lightweight per-school index of the account's children (no per-child section fetching), so you can then call per child with `name`/`student_id`. Set `full=True` to instead build the full report for every child. - If omitted and logged in as student/teacher: report on the logged-in account. Every section is isolated — a failure in one section yields {"ok": false, "error": ...} without failing the report.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| full | boolean | – | – |
| name | string | – | – |
| student_id | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_grades ~70
Get grades. Optionally filter by `year` (school year start) and `term` ('FIRST' or 'SECOND'). Returns list of grades (subject, teacher, percent, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
| term | string | – | – |
| year | integer | – | – |
No output schema declared.
No examples provided.
get_homework ~26
Get homework assignments from the recent timeline notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_meals ~98
Get the meal menu for a date (default today). Always returns all five meal slots (breakfast, snack, lunch, afternoon_snack, dinner) — slots not published by the school are ``None``. Tries the personal meal-ordering endpoint first; when the school hasn't enabled it, falls back to the school's public canteen menu widget.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_missing_teachers ~36
Get teachers missing on a date (default today).
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_my_students ~72
Get students visible to the logged-in account: parent accounts see their linked children (parsed from the school homepage); student accounts see classmates. Uses cached data. Returns person_id, name, class_id — usable with switch_to_student and get_student_timetable.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_my_timetable ~45
Get the timetable for the logged-in user for a date (YYYY-MM-DD, default today).
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_news ~24
Get school news from the timeline notifications.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_next_ringing_time ~53
Get the type (break/lesson) and time of the next ringing for a given datetime (ISO, default now).
| Name | Type | Req | Description |
|---|---|---|---|
| date_time_str | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_next_week_timetable ~39
Get the Mon-Fri timetable for next week for the logged-in user, grouped by weekday.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_notification_history ~40
Get timeline notifications since a date (YYYY-MM-DD), including older ones.
| Name | Type | Req | Description |
|---|---|---|---|
| date_from | string | yes | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_notifications ~36
Get the list of available timeline notifications (homework, tests, messages, grades, events...).
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_periods ~35
Get the bell schedule (periods with start/end times) from the logged-in data.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_schools ~53
List all schools the server is logged into (from auto-discovery or login_all). Returns each subdomain with its login state, role (student/parent/teacher), 2FA pending status, and user id.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_student_timetable ~153
Get a student's timetable by first/last name OR person_id. Without a `subdomain`, searches every school in the discovery scope (the configured `EDUPAGE_SUBDOMAINS`, or all logged-in schools when unset) and returns one result per school where the student is found — so a student attending multiple schools yields separate per-school timetables. If logged in as a parent, this switches to (and back from) the student account for the lookup. Returns the student's lessons plus which student/account/school was used.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| name | string | – | – |
| student_id | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_students ~26
Get all students in the logged-in user's class.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_subjects ~24
Get all subjects in the school.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_teachers ~24
Get all teachers in the school.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_timetable ~76
Get the timetable for a teacher, student, class or classroom on a date. target_type: 'teacher' | 'student' | 'class' | 'classroom'.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| subdomain | string | – | – |
| target_id | string | yes | – |
| target_type | string | yes | – |
No output schema declared.
No examples provided.
get_timetable_changes ~38
Get substitution/timetable changes for a date (default today).
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
get_timetable_range ~118
Get timetable for a target (class, student, teacher, classroom) for every day between start_date and end_date (inclusive). Returns a dict keyed by date (YYYY‑MM‑DD) with each value being the result of `get_timetable` for that day. Days with no published data get an empty lessons list.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | yes | – |
| start_date | string | yes | – |
| subdomain | string | – | – |
| target_id | string | yes | – |
| target_type | string | yes | – |
No output schema declared.
No examples provided.
get_upcoming_events ~33
Get upcoming school events (trips, excursions, meetings, holidays...).
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
login ~121
Log in to Edupage for a subdomain. If username/password/subdomain are omitted, env vars EDUPAGE_USERNAME, EDUPAGE_PASSWORD, EDUPAGE_SUBDOMAINS are used. Multiple schools are supported: each `login` call adds/replaces that subdomain's session (see `login_all`). If 2FA is enabled, returns instructions to call `two_factor_check_confirmed` / `two_factor_finish`.
| Name | Type | Req | Description |
|---|---|---|---|
| password | string | – | – |
| subdomain | string | – | – |
| username | string | – | – |
No output schema declared.
No examples provided.
login_all ~99
Log in to one or more schools using multiple subdomains in a single call. Pass comma-separated values: `subdomains="school1,school2"`, `usernames="u1,u2"`, `passwords="p1,p2"` (or pairs with one shared username/ password). Uses env vars for anything not provided.
| Name | Type | Req | Description |
|---|---|---|---|
| passwords | string | – | – |
| subdomains | string | – | – |
| usernames | string | – | – |
No output schema declared.
No examples provided.
login_auto ~65
Log in to Edupage via the portal (auto-detect school). Optionally tag the resulting session with `subdomain` so multi-school tools can reference it.
| Name | Type | Req | Description |
|---|---|---|---|
| password | string | – | – |
| subdomain | string | – | – |
| username | string | – | – |
No output schema declared.
No examples provided.
login_from_session ~47
Create a logged-in Edupage instance from an existing PHPSESSID cookie.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | – |
| subdomain | string | yes | – |
| username | string | yes | – |
No output schema declared.
No examples provided.
rate_meal ~65
Rate a meal (1-5 quality and quantity) for a date and meal type.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | yes | – |
| meal_type | string | yes | – |
| quality | integer | yes | – |
| quantity | integer | yes | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
scan_students ~93
Discover all students visible to the logged-in account across the discovery scope (the configured `EDUPAGE_SUBDOMAINS`, or every school when unset). For a parent account: their linked children in each school. For a student account: classmates in each school. Returns one entry per student per school, so a multi-school student appears with separate per-school records. Uses cached data to avoid redundant API calls.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
school_year ~25
Return the current school year (starting year).
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
send_message ~65
Send a message to a recipient. recipient_id is an edupage id like 'Student123' or 'Teacher456' (see get_students/get_teachers).
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | – |
| recipient_id | string | yes | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
sign_off_meal ~59
Cancel an ordered meal for a date. meal_type: 'snack'|'lunch'|'afternoon_snack'.
| Name | Type | Req | Description |
|---|---|---|---|
| date_str | string | yes | – |
| meal_type | string | yes | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
switch_to_parent ~28
Switch back to the parent account (parent accounts only).
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
switch_to_student ~62
Switch to a student account (parent accounts only). Provide `student_id` (person_id) or `name` (first/last/full name).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | – |
| student_id | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
two_factor_check_confirmed ~51
After a login that required 2FA, check whether the confirmation has been approved on a device. Returns True when safe to call `two_factor_finish`.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
two_factor_finish ~63
Finish 2FA authentication. If `code` is provided it is used as an email/app code; otherwise the device-confirmation flow is used (call two_factor_check_confirmed first).
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | – |
| subdomain | string | – | – |
No output schema declared.
No examples provided.
user_id ~26
Return the logged-in user's Edupage user id.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | – | – |
No output schema declared.
No examples provided.
What is the EduPage MCP Server server?
EduPage MCP Server is listed in the public MCP registry as io.github.oliverhruby/edupage-mcp. EduPage MCP: timetables, grades, homework, meals, messages, 2FA, multi-school, role-aware. This page covers its PyPI package (edupage-mcp-full).
Is the EduPage MCP Server server safe to use?
EduPage MCP Server scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the EduPage MCP Server server expose?
EduPage MCP Server exposes 46 tools: login, login_all, login_auto, login_from_session, two_factor_check_confirmed, and 41 more. Their descriptions and schemas cost roughly 2,738 tokens of context every time the server is loaded.
Is the EduPage MCP Server server still maintained?
EduPage MCP Server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the EduPage MCP Server server under?
EduPage MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.