# EduPage MCP Server (pypi · edupage-mcp-full)

EduPage MCP: timetables, grades, homework, meals, messages, 2FA, multi-school, role-aware.

- Trust score: 71/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `ghcr.io`: 25/100, [markdown](https://verifymcp.io/servers/oliverhruby-edupage-mcp/oliverhruby-edupage-mcp-latest.md), [page](https://verifymcp.io/servers/oliverhruby-edupage-mcp/oliverhruby-edupage-mcp-latest)
- pypi · `edupage-mcp-full`: 71/100 (this document), [markdown](https://verifymcp.io/servers/oliverhruby-edupage-mcp/edupage-mcp-full.md), [page](https://verifymcp.io/servers/oliverhruby-edupage-mcp/edupage-mcp-full)

## Channel facts

- Registry: `pypi`
- Package: `edupage-mcp-full`
- Version: `0.4.11`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it.
  - 0 of 33 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2738 tokens (~59/item across 46 items; 46 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "send_message" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 46 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the EduPage MCP Server server?

EduPage MCP Server runs locally as a PyPI package, launched with uvx edupage-mcp-full. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add oliverhruby-edupage-mcp -- uvx edupage-mcp-full
```

### Cursor

```json
{
  "mcpServers": {
    "oliverhruby-edupage-mcp": {
      "command": "uvx",
      "args": [
        "edupage-mcp-full"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "oliverhruby-edupage-mcp": {
      "command": "uvx",
      "args": [
        "edupage-mcp-full"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add oliverhruby-edupage-mcp -- uvx edupage-mcp-full
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "oliverhruby-edupage-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "edupage-mcp-full"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add oliverhruby-edupage-mcp --command uvx --arg edupage-mcp-full
```

### Hermes

```yaml
mcp_servers:
  oliverhruby-edupage-mcp:
    command: "uvx"
    args: ["edupage-mcp-full"]
```

### Netclaw

```json
{
  "McpServers": {
    "oliverhruby-edupage-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "edupage-mcp-full"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add oliverhruby-edupage-mcp -t stdio -c uvx -a edupage-mcp-full
```

### Other

```json
{
  "mcpServers": {
    "oliverhruby-edupage-mcp": {
      "command": "uvx",
      "args": [
        "edupage-mcp-full"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 68, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-14 (score 53, −12)

- [security regression] Malware scan: pass → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Stability: unverified → 0.17
- [functional] Package version: 0.4.6 → 0.4.11

### 2026-09-09 (score 65)

First indexed and scored.

## MCP tools (46)

### `login` (~121 tokens)

Log in to Edupage for a subdomain. If username/password/subdomain are
omitted, env vars EDUPAGE_USERNAME, EDUPAGE_PASSWORD, EDUPAGE_SUBDOMAINS are used.
Multiple schools are supported: each `login` call adds/replaces that subdomain's
session (see `login_all`). If 2FA is enabled, returns instructions to call
\`two_factor_check_confirmed` / `two_factor_finish`.

Input parameters:

- `password` (string)
- `subdomain` (string)
- `username` (string)

### `login_all` (~99 tokens)

Log in to one or more schools using multiple subdomains in a single call.
Pass comma-separated values: `subdomains="school1,school2"`,
\`usernames="u1,u2"`, `passwords="p1,p2"` (or pairs with one shared username/
password). Uses env vars for anything not provided.

Input parameters:

- `passwords` (string)
- `subdomains` (string)
- `usernames` (string)

### `login_auto` (~65 tokens)

Log in to Edupage via the portal (auto-detect school). Optionally tag the
resulting session with `subdomain` so multi-school tools can reference it.

Input parameters:

- `password` (string)
- `subdomain` (string)
- `username` (string)

### `login_from_session` (~47 tokens)

Create a logged-in Edupage instance from an existing PHPSESSID cookie.

Input parameters:

- `session_id` (string, required)
- `subdomain` (string, required)
- `username` (string, required)

### `two_factor_check_confirmed` (~51 tokens)

After a login that required 2FA, check whether the confirmation has been
approved on a device. Returns True when safe to call `two_factor_finish`.

Input parameters:

- `subdomain` (string)

### `two_factor_finish` (~63 tokens)

Finish 2FA authentication. If `code` is provided it is used as an email/app
code; otherwise the device-confirmation flow is used (call two_factor_check_confirmed first).

Input parameters:

- `code` (string)
- `subdomain` (string)

### `auth_status` (~21 tokens)

Show login status for all configured subdomains and the active one.

### `user_id` (~26 tokens)

Return the logged-in user's Edupage user id.

Input parameters:

- `subdomain` (string)

### `school_year` (~25 tokens)

Return the current school year (starting year).

Input parameters:

- `subdomain` (string)

### `get_my_timetable` (~45 tokens)

Get the timetable for the logged-in user for a date (YYYY-MM-DD, default today).

Input parameters:

- `date_str` (string)
- `subdomain` (string)

### `get_student_timetable` (~153 tokens)

Get a student's timetable by first/last name OR person_id.
Without a `subdomain`, searches every school in the discovery scope (the
configured `EDUPAGE_SUBDOMAINS`, or all logged-in schools when unset) and
returns one result per school where the student is found — so a student
attending multiple schools yields separate per-school timetables. If logged
in as a parent, this switches to (and back from) the student account for the lookup.
Returns the student's lessons plus which student/account/school was used.

Input parameters:

- `date_str` (string)
- `name` (string)
- `student_id` (string)
- `subdomain` (string)

### `get_timetable` (~76 tokens)

Get the timetable for a teacher, student, class or classroom on a date.
target_type: 'teacher' | 'student' | 'class' | 'classroom'.

Input parameters:

- `date_str` (string)
- `subdomain` (string)
- `target_id` (string, required)
- `target_type` (string, required)

### `get_next_ringing_time` (~53 tokens)

Get the type (break/lesson) and time of the next ringing for a given datetime
(ISO, default now).

Input parameters:

- `date_time_str` (string)
- `subdomain` (string)

### `get_next_week_timetable` (~39 tokens)

Get the Mon-Fri timetable for next week for the logged-in user,
grouped by weekday.

Input parameters:

- `subdomain` (string)

### `get_timetable_range` (~118 tokens)

Get timetable for a target (class, student, teacher, classroom) for every day
between start_date and end_date (inclusive). Returns a dict keyed by date
(YYYY‑MM‑DD) with each value being the result of `get_timetable` for that day.
Days with no published data get an empty lessons list.

Input parameters:

- `end_date` (string, required)
- `start_date` (string, required)
- `subdomain` (string)
- `target_id` (string, required)
- `target_type` (string, required)

### `get_periods` (~35 tokens)

Get the bell schedule (periods with start/end times) from the logged-in data.

Input parameters:

- `subdomain` (string)

### `get_grades` (~70 tokens)

Get grades. Optionally filter by `year` (school year start) and `term`
('FIRST' or 'SECOND'). Returns list of grades (subject, teacher, percent, etc.).

Input parameters:

- `subdomain` (string)
- `term` (string)
- `year` (integer)

### `get_notifications` (~36 tokens)

Get the list of available timeline notifications (homework, tests, messages,
grades, events...).

Input parameters:

- `subdomain` (string)

### `get_notification_history` (~40 tokens)

Get timeline notifications since a date (YYYY-MM-DD), including older ones.

Input parameters:

- `date_from` (string, required)
- `subdomain` (string)

### `get_homework` (~26 tokens)

Get homework assignments from the recent timeline notifications.

Input parameters:

- `subdomain` (string)

### `get_assignments` (~34 tokens)

Get all assignments (homework, tests, exams, projects) from the timeline.

Input parameters:

- `subdomain` (string)

### `get_absences` (~27 tokens)

Get the student's absence records from the timeline notifications.

Input parameters:

- `subdomain` (string)

### `get_upcoming_events` (~33 tokens)

Get upcoming school events (trips, excursions, meetings, holidays...).

Input parameters:

- `subdomain` (string)

### `get_news` (~24 tokens)

Get school news from the timeline notifications.

Input parameters:

- `subdomain` (string)

### `get_timetable_changes` (~38 tokens)

Get substitution/timetable changes for a date (default today).

Input parameters:

- `date_str` (string)
- `subdomain` (string)

### `get_missing_teachers` (~36 tokens)

Get teachers missing on a date (default today).

Input parameters:

- `date_str` (string)
- `subdomain` (string)

### `get_meals` (~98 tokens)

Get the meal menu for a date (default today). Always returns all five
meal slots (breakfast, snack, lunch, afternoon_snack, dinner) — slots not
published by the school are ``None``.

Tries the personal meal-ordering endpoint first; when the school hasn't
enabled it, falls back to the school's public canteen menu widget.

Input parameters:

- `date_str` (string)
- `subdomain` (string)

### `choose_meal` (~79 tokens)

Order/choose a meal for a date. meal_type: 'snack'|'lunch'|'afternoon_snack'.
number: 1-based menu choice among the chooseable menus.

Input parameters:

- `date_str` (string, required)
- `meal_type` (string, required)
- `number` (integer, required)
- `subdomain` (string)

### `sign_off_meal` (~59 tokens)

Cancel an ordered meal for a date. meal_type: 'snack'|'lunch'|'afternoon_snack'.

Input parameters:

- `date_str` (string, required)
- `meal_type` (string, required)
- `subdomain` (string)

### `rate_meal` (~65 tokens)

Rate a meal (1-5 quality and quantity) for a date and meal type.

Input parameters:

- `date_str` (string, required)
- `meal_type` (string, required)
- `quality` (integer, required)
- `quantity` (integer, required)
- `subdomain` (string)

### `get_day_summary` (~272 tokens)

One-call daily school report for a date (default today): timetable,
substitutions, missing teachers, grades received that day, meals, homework,
assignments, absences, news, events, and timeline notifications.

Composes the individual section tools so you don't need to fire 8-10 calls
to answer "what happened yesterday at school" or "what's coming tomorrow".
\- If `name`/`student_id` is provided: report for that specific student
  (found across all schools unless `subdomain` scopes it).
\- If omitted: **discovery-first** — for a **parent** this returns a
  lightweight per-school index of the account's children (no per-child
  section fetching), so you can then call per child with `name`/`student_id`.
  Set `full=True` to instead build the full report for every child.
\- If omitted and logged in as student/teacher: report on the logged-in account.
Every section is isolated — a failure in one section yields {"ok": false, "error": ...}
without failing the report.

Input parameters:

- `date_str` (string)
- `full` (boolean)
- `name` (string)
- `student_id` (string)
- `subdomain` (string)

### `get_students` (~26 tokens)

Get all students in the logged-in user's class.

Input parameters:

- `subdomain` (string)

### `get_all_students` (~28 tokens)

Get a short list of all students in the school.

Input parameters:

- `subdomain` (string)

### `get_teachers` (~24 tokens)

Get all teachers in the school.

Input parameters:

- `subdomain` (string)

### `get_classes` (~23 tokens)

Get all classes in the school.

Input parameters:

- `subdomain` (string)

### `get_classrooms` (~24 tokens)

Get all classrooms in the school.

Input parameters:

- `subdomain` (string)

### `get_subjects` (~24 tokens)

Get all subjects in the school.

Input parameters:

- `subdomain` (string)

### `send_message` (~65 tokens)

Send a message to a recipient. recipient_id is an edupage id like
'Student123' or 'Teacher456' (see get_students/get_teachers).

Input parameters:

- `body` (string, required)
- `recipient_id` (string, required)
- `subdomain` (string)

### `get_my_students` (~72 tokens)

Get students visible to the logged-in account: parent accounts see their
linked children (parsed from the school homepage); student accounts see
classmates. Uses cached data. Returns person_id, name, class_id — usable
with switch_to_student and get_student_timetable.

Input parameters:

- `subdomain` (string)

### `switch_to_student` (~62 tokens)

Switch to a student account (parent accounts only). Provide `student_id` (person_id)
or `name` (first/last/full name).

Input parameters:

- `name` (string)
- `student_id` (string)
- `subdomain` (string)

### `find_student` (~110 tokens)

Look up a student by first/last/full name using tiered matching.
Without a `subdomain`, searches ALL logged-in schools and returns one result per
school where the student is found. Returns student info with match confidence
tiers (1=exact, 2=first name, 3=last name, 4=substring). Use student_id from
results with get_student_timetable for unambiguous lookups.

Input parameters:

- `name` (string, required)
- `subdomain` (string)

### `get_schools` (~53 tokens)

List all schools the server is logged into (from auto-discovery or login_all).
Returns each subdomain with its login state, role (student/parent/teacher),
2FA pending status, and user id.

### `clear_student_cache` (~59 tokens)

Force refresh of cached student data. Call this after students are added/removed
from a school, or if scan_students/find_student returns stale results.
Without a subdomain, clears the cache for ALL schools.

Input parameters:

- `subdomain` (string)

### `scan_students` (~93 tokens)

Discover all students visible to the logged-in account across the discovery
scope (the configured `EDUPAGE_SUBDOMAINS`, or every school when unset).
For a parent account: their linked children in each school. For a student
account: classmates in each school. Returns one entry per student per school,
so a multi-school student appears with separate per-school records. Uses cached
data to avoid redundant API calls.

### `switch_to_parent` (~28 tokens)

Switch back to the parent account (parent accounts only).

Input parameters:

- `subdomain` (string)

### `custom_request` (~73 tokens)

Send a raw request to the Edupage server using the active session.
method: 'GET'|'POST'. Returns status code and body text.

Input parameters:

- `data` (string)
- `headers` (string)
- `method` (string, required)
- `subdomain` (string)
- `url` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/oliverhruby-edupage-mcp/edupage-mcp-full#diagnostics

## Score history

- 2026-09-20: 71
- 2026-09-19: 70
- 2026-09-18: 70
- 2026-09-17: 69
- 2026-09-16: 69
- 2026-09-15: 68
- 2026-09-14: 53
- 2026-09-13: 65
- 2026-09-12: 65
- 2026-09-11: 65
- 2026-09-10: 65
- 2026-09-09: 65

## Common questions

### What is the EduPage MCP Server server?

EduPage MCP Server is listed in the public MCP registry as io.github.oliverhruby/edupage-mcp. EduPage MCP: timetables, grades, homework, meals, messages, 2FA, multi-school, role-aware. This page covers its PyPI package (edupage-mcp-full).

### Is the EduPage MCP Server server safe to use?

EduPage MCP Server scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the EduPage MCP Server server expose?

EduPage MCP Server exposes 46 tools: login, login_all, login_auto, login_from_session, two_factor_check_confirmed, and 41 more. Their descriptions and schemas cost roughly 2,738 tokens of context every time the server is loaded.

### Is the EduPage MCP Server server still maintained?

EduPage MCP Server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the EduPage MCP Server server under?

EduPage MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/edupage-mcp-full/
- Socket report: https://socket.dev/pypi/package/edupage-mcp-full
- Repository: https://github.com/oliverhruby/edupage-mcp
- Changelog RSS feed: https://verifymcp.io/servers/oliverhruby-edupage-mcp/edupage-mcp-full.xml
- Changelog JSON feed: https://verifymcp.io/servers/oliverhruby-edupage-mcp/edupage-mcp-full.json
- HTML version of this page: https://verifymcp.io/servers/oliverhruby-edupage-mcp/edupage-mcp-full