# io.github.RohanMuppa/brightspace (npm · brightspace-mcp-server) D2L Brightspace MCP server: grades, due dates, assignments, announcements and files. Any school. - Trust score: 78/100 (medium) - Change this week: +1 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-11-05 ## Components - npm · `brightspace-mcp-server`: 78/100 (this document), [markdown](https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server.md), [page](https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server) ## Channel facts - Registry: `npm` - Package: `brightspace-mcp-server` - Version: `5.1.39` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-11-05. - **Supply Chain Security**: 42/100 - Malware scan not yet available for this package. - No known CVEs affecting this package version or its production dependencies. - Declares code that runs automatically (postinstall) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does. - 69 of 180 dependencies flagged as unhealthy. - **Provenance & Transparency**: 97/100 - Source repository is publicly reachable at the declared URL. - Cryptographically verified build provenance (signed, bound to RohanMuppa/brightspace-mcp-server). - Clear OSI-approved license (MIT). - Actively maintained (last published 0 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 80/100 - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name). - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 6108 tokens (~218/item across 28 items; 28 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 100/100 - No destabilizing schema changes in the last 30 days. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 28 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. ## Install ### How do I install the io.github.RohanMuppa/brightspace MCP server? io.github.RohanMuppa/brightspace runs locally as an npm package, launched with npx -y brightspace-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add rohanmuppa-brightspace -- npx -y brightspace-mcp-server ``` ### Cursor ```json { "mcpServers": { "rohanmuppa-brightspace": { "command": "npx", "args": [ "-y", "brightspace-mcp-server" ] } } } ``` ### VS Code ```json { "servers": { "rohanmuppa-brightspace": { "command": "npx", "args": [ "-y", "brightspace-mcp-server" ] } } } ``` ### Codex ```bash codex mcp add rohanmuppa-brightspace -- npx -y brightspace-mcp-server ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "rohanmuppa-brightspace": { "type": "local", "command": [ "npx", "-y", "brightspace-mcp-server" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add rohanmuppa-brightspace --command npx --arg -y --arg brightspace-mcp-server ``` ### Hermes ```yaml mcp_servers: rohanmuppa-brightspace: command: "npx" args: ["-y", "brightspace-mcp-server"] ``` ### Netclaw ```json { "McpServers": { "rohanmuppa-brightspace": { "Transport": "stdio", "Command": "npx", "Arguments": [ "-y", "brightspace-mcp-server" ] } } } ``` ### Vellum ```bash assistant mcp add rohanmuppa-brightspace -t stdio -c npx -a -y brightspace-mcp-server ``` ### Other ```json { "mcpServers": { "rohanmuppa-brightspace": { "command": "npx", "args": [ "-y", "brightspace-mcp-server" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-11-05 (score 78, −15) - [security regression] Malware scan: pass → unverified - [functional regression] Security disclosure: fail → unverified - [functional] Package version: 5.1.38 → 5.1.39 ### 2026-11-04 (score 93, +16) - [security regression] Stability: pass → unverified - [security regression] Tool safety: pass → unverified - [security improvement] CVE-2026-118764 no longer affects this package - [security improvement] Malware scan: unverified → pass - [security improvement] Known CVEs: fail → pass - [functional regression] Capabilities: pass → unverified - [functional regression] Tool coverage: 100 → unverified - [functional regression] Schema quality: 100 → unverified - [functional] Package version: 5.1.36 → 5.1.38 - [functional] Package version: 5.1.36 → 5.1.37 ### 2026-11-03 (score 77, 0) - [security improvement] Malware scan: unverified → pass - [functional] Package version: 5.1.33 → 5.1.36 ### 2026-11-02 (score 77, −14) - [security regression] Malware scan: pass → unverified - [security] Stability: 0.97 → pass - [functional] Package version: 5.1.32 → 5.1.33 ### 2026-11-01 (score 91, +15) - [security regression] Stability: 0.93 → unverified - [security regression] Tool safety: pass → unverified - [security improvement] Malware scan: unverified → pass - [functional regression] Capabilities: pass → unverified - [functional regression] Tool coverage: 100 → unverified - [functional regression] Schema quality: 100 → unverified - [functional] Package version: 5.1.31 → 5.1.32 ### 2026-10-31 (score 76, −1) - [security regression] CVE-2026-118764 affects this package: medium - [security regression] Known CVEs: pass → fail - [security improvement] Malware scan: unverified → pass - [functional regression] Security disclosure: unverified → fail - [functional] Package version: 5.1.30 → 5.1.31 ### 2026-10-30 (score 77, 0) - [security improvement] Malware scan: unverified → pass - [functional regression] Security disclosure: fail → unverified - [functional] Package version: 5.1.29 → 5.1.30 ### 2026-10-29 (score 77, −14) - [security regression] Malware scan: pass → unverified - [functional] Package version: 5.1.27 → 5.1.29 ## MCP tools (28) ### `get_my_courses` (~78 tokens) Get My Courses Fetch your enrolled Brightspace courses with names, codes, and IDs. Use this when the user asks about their courses, enrolled classes, what they're taking this semester, or needs a course ID for other queries. Input parameters: - `activeOnly` (boolean): Only return currently active courses. Defaults to the server's configured activeOnly setting (true unless overridden). ### `get_upcoming_due_dates` (~109 tokens) Get Upcoming Due Dates Fetch upcoming due dates across all your courses, derived from the due dates on assignments (dropbox folders), quizzes, and graded discussion topics themselves, plus course calendar events such as exams and labs (type: event). Use this when the user asks about deadlines, what's due, upcoming work, or what they need to do this week. Input parameters: - `courseId` (integer): Filter to a specific course ID - `daysAhead` (integer): Number of days ahead to look for due dates ### `get_calendar_events` (~232 tokens) Get Calendar Events Fetch course calendar events — exams, midterms, labs, recitations, review sessions, schedule changes, and deadlines instructors typed straight onto the calendar — across all your courses or one course, in a time window (default: the next 7 days). Use this when the user asks when an exam is, what's on their calendar, or what's happening this week. Input parameters: - `courseId` (integer): Course ID to get calendar events for. If omitted, returns events across all enrolled courses. - `from` (string): Start of the window, ISO 8601 (e.g. 2026-01-15T00:00:00Z). Defaults to now. - `includeGenerated` (boolean): Include the events Brightspace generates from assignment, quiz, and discussion due dates (marked with generatedFrom). Off by default because get_upcoming_due_dates and get_assignments already report… - `to` (string): End of the window, ISO 8601 (e.g. 2026-01-22T00:00:00Z). Defaults to 7 days after from. ### `get_my_grades` (~84 tokens) Get My Grades Fetch your grade breakdown for a specific course or all enrolled courses. Shows grade items with points, percentages, and comments. Use this when the user asks about grades, scores, marks, GPA, academic performance, or how they're doing in a class. Input parameters: - `courseId` (integer): Course ID to get grades for. If omitted, returns grades for all enrolled courses. ### `get_announcements` (~296 tokens) Get Announcements Fetch announcements from one course with courseId, or all courses when omitted, newest first. count is 1-50 per page. Each body is the full announcement text as markdown (links kept); pagination.truncated only means more announcements remain, never that a body was cut. Continue with offset= pagination.nextOffset until it is null. Pagination metadata is in a separate JSON text block for array responses, or the pagination field with modifiedSince. A false coverageComplete means some courses were not fetched: retry from offset 0 after recovery. Offsets reflect the current filtered list; new posts can shift pages. Attachments are listed per announcement; fetch them with download_file (newsId + fileId) or read them with get_announcement_files. Input parameters: - `count` (integer): Announcements per page: 1-50 (default 10). - `courseId` (integer): Course ID to get announcements for. If omitted, returns recent announcements across all courses. - `modifiedSince` (string): Only return announcements last modified at or after this ISO 8601 datetime (e.g. 2026-01-15T00:00:00Z). Announcements with no modified timestamp are always included. When set, the response reports ho… - `offset` (integer): Announcement offset after filtering and sorting. Continue with pagination.nextOffset; restart at 0 after a failed course becomes available. ### `get_assignments` (~411 tokens) Get Assignments Fetch assignments and quizzes for a specific course or all enrolled courses. Shows dropbox submissions and quizzes with due dates, status, and rubric info. Use this when the user asks about assignments, homework, what to submit, quizzes, or assignment details and rubrics. Read submissionStatus/attemptStatus, not just submission/attemptsUsed, to decide whether something was turned in: some tenants deny students access to submission or attempt data, in which case the status is "unknown" even though submission is null or attemptsUsed is 0. Never report an "unknown" item as missing, unsubmitted, or not attempted - say it could not be verified and point the user to Brightspace. Quizzes come from the quiz list, the course content, and the gradebook; each quiz row says which in source. A quiz with id null was found only as a content topic. A quiz row with detailsStatus "unavailable" was shown in the course content but Brightspace would not return its details (it may be closed, not yet open, or limited to certain students), so its dates and attempts may be missing: point the user to its link. availability (notYetOpen, open, closed) is worked out from the quiz's own start and end dates and is left out when it has none. exempt: true means Brightspace marks the user exempt from that quiz's topic; the quiz is still listed. Each course also carries quizCoverage. "complete" means every quiz source answered, not that every quiz is guaranteed to be listed; "incomplete" means a quiz source could not be read, so the course may have quizzes not listed. Never conclude that a quiz was missed or not taken because it is absent, and never present the listed quizzes as all of them. A gradeOnly row named like a quiz is a quiz whose details could not be read. Input parameters: - `courseId` (integer): Course ID to get assignments for. If omitted, returns assignments for all enrolled courses. ### `get_assignment_rubric` (~116 tokens) Get Assignment Rubric Fetch the full grading rubric for a dropbox assignment: every criteria group, criterion, and achievement level with its points and description, plus the student's own graded outcome per criterion once it has been released. Use this when the user asks what a rubric wants, how an assignment will be graded, or why they got a particular score on a criterion. Input parameters: - `assignmentId` (integer, required): Assignment (dropbox folder) ID, as returned by get_assignments. - `courseId` (integer, required): Course ID the assignment belongs to. ### `get_assignment_files` (~224 tokens) Get Assignment Files Read the files an instructor attached to an assignment: the spec or instructions PDF, a starter workbook, a rubric document. Call it with just courseId to see which assignments have attachments, then with folderId and fileId to read one. Use this when the user asks what an assignment requires, what the instructions say, or to summarize a handout. Returns the text itself. Use download_file instead when the user wants the file saved to disk. Input parameters: - `courseId` (integer, required): Course ID whose assignment attachments to look at. - `extractText` (boolean): Extract readable text from the file. Works for PDF, DOCX, XLSX, PPTX, and plain text. - `fileId` (integer): Attachment file ID to read. Requires folderId. Omit to list the files without reading them. - `folderId` (integer): Assignment (dropbox folder) ID. Omit to list every assignment in the course that has attachments. - `maxChars` (integer): Maximum characters of extracted text to return. The response reports whether it was truncated. ### `get_announcement_files` (~221 tokens) Get Announcement Files Read the files an instructor attached to an announcement: prompt questions, a rubric, an updated schedule, slides. Call it with just courseId to see which announcements have attachments, then with newsId and fileId to read one. Use this when the user asks what a file attached to an announcement says. Returns the text itself. Use download_file (newsId + fileId) instead when the user wants the file saved to disk. Input parameters: - `courseId` (integer, required): Course ID whose announcement attachments to look at. - `extractText` (boolean): Extract readable text from the file. Works for PDF, DOCX, XLSX, PPTX, and plain text. - `fileId` (integer): Attachment file ID to read. Requires newsId. Omit to list the files without reading them. - `maxChars` (integer): Maximum characters of extracted text to return. The response reports whether it was truncated. - `newsId` (integer): Announcement (news item) ID. Omit to list every announcement in the course that has attachments. ### `get_course_content` (~323 tokens) Get Course Content Fetch the content tree for a course showing modules, topics, files, and links. Use this when the user asks about course materials, lecture slides, uploaded files, content structure, or what's in a course module. Use moduleTitle to filter to a specific module (e.g. 'Labs', 'Staff', 'Homeworks') instead of fetching the entire tree. Use maxDepth to limit recursion depth for a table-of-contents view. A module or topic that isn't currently available carries isAvailable/availabilityStatus/availabilityMessage (and startDate/endDate when known) explaining why; absence of these fields means it's available now. Input parameters: - `courseId` (integer, required): Course ID to get content tree for. - `maxDepth` (integer): Limit recursive depth of the content tree. Depth 1 returns top-level modules with direct children only. Useful for getting a table of contents without all nested content. - `modifiedSince` (string): Only return topics last modified at or after this ISO 8601 datetime (e.g. 2026-01-15T00:00:00Z), plus any module that contains a matching topic. Topics with no modified timestamp are always included.… - `moduleTitle` (string): Case-insensitive substring match on module titles. Only returns modules whose title contains this string (e.g. 'Labs', 'Staff', 'Homeworks'). Children of matching modules are included in full. - `typeFilter` (string): Optional filter to narrow results by content type. ### `download_file` (~782 tokens) Download File Download a file from course content, files linked by path inside a module description (coursePath, from get_course_content's quickLink URLs with type=coursefile), instructor assignment attachments (source: assignmentAttachment with folderId + fileId), assignment submissions, or an announcement's attachments. Use this when the user wants a file from Brightspace course content, dropbox submissions, or an announcement (newsId + fileId, from get_announcements). Two response modes: (1) INLINE (default — omit downloadPath): the file comes back directly in the tool response — extracted text for PDFs and Office documents, an image block for jpeg/png/gif/webp, or a short description for anything else — so it can be read immediately without touching any filesystem. This is the right choice in clients like Claude Desktop, whose analysis/sandbox tools cannot see a file the MCP server writes to its own host filesystem. (2) DISK (set downloadPath to an absolute path on the HOST filesystem the MCP server runs on): the file is saved there. The directory must already exist; it is not created for you. Ask the user where to save it before using disk mode — never guess a directory. After identifying the file, suggest a clean readable filename (e.g., 'Lecture 7 - Memory Management.pdf' instead of 'L07_CS251_2026SP_v2.pdf') and pass it as customFilename, or omit it to keep the original. If a content-topic download fails because the file isn't released yet, the response explains why when Brightspace's module/topic metadata supports it (not yet open, ended, locked, or hidden). Input parameters: - `courseId` (integer, required): Course ID the file belongs to. - `coursePath` (string): A file in the course's file store, for files an instructor linked inside a module or page description instead of adding as a content topic (get_course_content lists them as courseFiles on the module)… - `customFilename` (string): Custom filename for the downloaded file (include extension). If not provided, uses the original filename from Brightspace. - `downloadPath` (string): Absolute path to an existing directory where the file should be saved on disk. The directory must already exist; it is not created for you, so create it first if needed. Omit this to receive the file… - `fileId` (integer): Specific file ID within a dropbox submission, instructor assignment attachment (with source: assignmentAttachment), or announcement attachment (with newsId). - `folderId` (integer): Dropbox folder ID. Downloads your submission by default; set source to assignmentAttachment for an instructor-provided handout. - `newsId` (integer): Announcement (news item) ID whose attachment to download. Requires fileId. - `source` (string): For folderId + fileId: assignmentAttachment downloads an instructor-provided handout from get_assignment_files; submission (default) downloads your own submitted file. Do not combine source with topi… - `topicId` (integer): Content topic ID to download (for course content files). ### `get_classlist_emails` (~72 tokens) Get Classlist Emails Fetch all email addresses for everyone in a course — instructors, TAs, and students. Use this when the user wants a list of emails for a class, needs to email the whole class, or wants contact info for everyone enrolled. Input parameters: - `courseId` (integer, required): Course ID to get emails for. ### `get_roster` (~154 tokens) Get Course Roster Fetch the roster for a course including instructors, TAs, and optionally students with their names, emails, and roles. Use this when the user asks about classmates, instructor contact info, TA emails, professor names, or who's in a class. By default returns only instructors and TAs for privacy. Use includeStudents to get full class list. Input parameters: - `courseId` (integer, required): Course ID to get roster for. - `includeStudents` (boolean): Include students in results. Default is instructors and TAs only. - `limit` (integer): Maximum users to return. Default 100. The response reports the true total and whether it was truncated. - `searchTerm` (string): Optional search term to filter by name. ### `get_my_groups` (~66 tokens) Get My Groups List the current user's project/discussion groups in a course, with each group's members. Use this when a student asks who is in their project group, lab group, or discussion group. Input parameters: - `courseId` (integer, required): Course ID to list the current user's project/discussion groups for. ### `get_available_groups` (~130 tokens) Get Available Groups List the groups the current user can still join themselves (self-enrollment), with spots left and when sign-up closes. Use this when a student asks which project or lab groups are open. This tool only reads; joining happens in Brightspace under Groups > Available Groups. Input parameters: - `courseId` (integer): Course ID to list joinable groups for. If omitted, checks courses that started in the last 12 months. - `includeOlder` (boolean): Without courseId, also check older and undated courses. Schools that never close a course keep years of finished courses whose sign-ups still look open. ### `get_syllabus` (~241 tokens) Get Course Syllabus Fetch the syllabus/overview text and optional attachment for a course. Returns the course overview description as markdown. When the syllabus lives in an external LTI tool (e.g. Simple Syllabus), lists those sources in externalSyllabusSources; their contents cannot be read. If some of those lookups could not be completed (e.g. permission denied), externalSyllabusDiscovery says which, and an empty result is then not proof the course has no syllabus. If the attachment request fails with anything but a 404, attachmentUnreadable is true and an empty hasAttachment is not proof the course has no syllabus file. If downloadPath is provided, also downloads the syllabus attachment (e.g. PDF); the directory must already exist, since it is not created for you. IMPORTANT: You MUST ask the user where they want to save the file before calling this tool with a downloadPath. Input parameters: - `courseId` (integer, required): Course ID to get syllabus for. - `downloadPath` (string): Absolute path to an existing directory where the attachment should be saved. The directory must already exist; it is not created for you, so create it first if needed. ### `get_discussions` (~148 tokens) Get Discussions Fetch discussion board content for a course including forums, topics, and posts. Use this when the user asks about discussion boards, forum posts, class discussions, or wants to see what's been posted. Provide just courseId to list all forums and their topics. Add forumId to get topics and posts for a specific forum. Add both forumId and topicId to get all posts in a specific discussion topic. Input parameters: - `courseId` (integer, required): Course ID to get discussion boards for. - `forumId` (integer): Specific forum ID to get topics and posts for. If omitted, returns all forums. - `topicId` (integer): Specific topic ID to get posts for. Requires forumId. ### `get_video_transcript` (~377 tokens) Get Video Transcript Read the transcript of a video embedded in course content, such as a recorded lecture or explainer clip. Call it with courseId and topicId from get_course_content (typeFilter: 'video' or 'other'), or with videoUrl directly if you already have the link. Returns transcript text with timestamps, plus title and duration when available. Currently supports Kaltura (e.g. BoilerCast, including its Brightspace LTI links) and YouTube; other platforms return a clear message naming what isn't supported yet. A failure returns its message plus a JSON block with reason (e.g. sign_in_required for a YouTube bot check) and recovery steps for the user; never present a failed call as a read transcript. Each call returns at most maxChars characters (up to 100000); to read a whole transcript, call again with offset set to the returned nextOffset until truncated is false. Read only — this never marks the video as watched. Input parameters: - `courseId` (integer): Course ID the video belongs to. Required together with topicId unless videoUrl is given directly. - `maxChars` (integer): Maximum characters of transcript text to return in one call, from 1 to 100000 (default 12000). The response reports whether it was truncated; to read past this limit, page with offset/nextOffset. - `offset` (integer): Character offset into the transcript to resume from. Pass back nextOffset from a truncated response to fetch the next piece. - `topicId` (integer): Content topic ID (from get_course_content) whose embedded video to transcribe. Requires courseId. - `videoUrl` (string): Direct video URL to transcribe, e.g. the url field get_course_content already returned. Use instead of courseId/topicId when you already have the link. ### `get_server_info` (~199 tokens) Get Server Info Report which version of the Brightspace MCP server is running, the Node.js runtime, platform, config file path, session state directory, configured school URL, whether a credential is stored, the server's local timezone and UTC offset, (once a browser sign-in has been saved) what Microsoft remembered: stay-signed-in (which keeps the Microsoft sign-in but does not by itself skip 2FA) and the Don't ask again MFA checkbox, with a plain-language note on what that means for 2FA to relay to the user, (when signed in) the account's uniqueName/displayName as signedInAs, and this process's request counters (requests: responses by status class, network errors, cache hits/misses, coalesced joins, and token refreshes). Use this for troubleshooting, when the user asks which version they have, or what timezone/account dates are being computed against. Never contacts Brightspace and never returns secrets. ### `search_course` (~225 tokens) Search Course Search a course's content (modules, topics, file names), announcements, and discussion forums/topics by keyword in a single call, instead of reading the whole content tree. Use this when the user wants to find something specific, e.g. 'find the midterm review slides' or 'did anyone post about office hours'. Results are ranked: a result matching every query term ranks above one matching only some, and within that, a match in the title ranks above one only in the body text. If one source (e.g. discussions) can't be read, it's skipped and named in `note` rather than failing the whole search. This fans out over the entire content tree, announcements, and every discussion forum, so it can be slower than calling a single tool like get_course_content directly. Input parameters: - `courseId` (integer, required): Course ID to search within. - `limit` (integer): Maximum number of results to return, highest scoring first. - `query` (string, required): Keyword(s) to search for, e.g. 'midterm review slides' or 'office hours'. ### `sign_out` (~168 tokens) Sign Out of Brightspace Sign out of Brightspace on this computer: cancel any sign-in still waiting for MFA approval here, then delete the saved Brightspace session, so every Brightspace app here must sign in again from scratch on its next question. Keeps the saved password, settings, and authenticator key. Does not sign out of Microsoft or Brightspace on other devices. Cancelling a waiting sign-in doesn't get a new prompt sooner: Microsoft sends no other prompt to the account until the one already sent expires, up to 5 minutes after it was sent. Call this ONLY when the user explicitly asks to sign out or log out of Brightspace (a shared computer, handing the machine on). Never call it on your own to fix an error, to get a new prompt, or as part of answering another question. ### `sign_in` (~329 tokens) Sign In to Brightspace Sign in to Brightspace on this computer so the other tools work. Does nothing and says so if the saved session is already valid, so it is safe to call first when you are unsure. Opens a browser window for the user to sign in by hand when no password is saved (nothing to type means a windowless sign-in can only time out); otherwise it signs in in the background and reports the 2FA number for the user to approve on their phone. A window is for the user's own hands only (no saved password, or when the user asks to see one): after a "could not be reached", stuck, or timeout answer, call sign_in again without visible. Call this when a Brightspace tool failed because of authentication, or when the user asks to sign in or log in to Brightspace. Every answer says what to do next, including whether to call again. Input parameters: - `visible` (boolean): Open a browser window for the user to sign in by hand. Omit it: a window then opens by itself only when no password is saved on this computer, because a sign-in with no window has nothing to type int… ### `get_dropbox_folders` (~149 tokens) Get Dropbox Folders List all assignment/dropbox folders for a course, for an instructor or TA. Returns folder ID, name, due date, start/end dates, submission type, visibility, and whether rubrics are attached. Use this to discover folderId values before calling get_dropbox_submissions, get_dropbox_user_submissions, get_dropbox_feedback, or get_rubrics_for_object. This reads the same folder listing a student's own client uses, so it is not gated to instructor/TA accounts the way get_dropbox_submissions, get_dropbox_feedback, and download_dropbox_submission_file are. Input parameters: - `courseId` (integer, required): Course ID to list dropbox (assignment) folders for. ### `get_dropbox_submissions` (~260 tokens) Get Dropbox Submissions List every student's (or group's) submission to a dropbox folder, for an instructor or TA — submitter names, submission dates, late status, file lists, and feedback/grading status. Use get_dropbox_folders first to find folderId. Requires instructor or TA access; a student account gets a clear note instead of data (a student's own download_file / get_assignments already cover their own submission). Results are capped by limit (default 100, max 1000); a truncated response says so and only fetches feedback for the returned slice. Input parameters: - `activeOnly` (boolean): When true, skip submissions that have already been fully graded (feedback published with a score). Default false: returns every submission, graded and ungraded. - `courseId` (integer, required): Course ID the dropbox folder belongs to. - `folderId` (integer, required): Dropbox folder ID to list submissions for. Use get_dropbox_folders to find it. - `ignoreFeedback` (boolean): When true, omit feedback status from each submission entry to reduce response size. - `limit` (integer): Maximum submissions to return. Default 100. The response reports the true total and whether it was truncated; feedback is only fetched for the returned slice. ### `get_dropbox_user_submissions` (~142 tokens) Get Dropbox User Submissions Retrieve all submissions made by one specific student (or group) in a dropbox folder, for an instructor or TA — useful for reviewing a single student's work before drafting feedback. Use get_dropbox_submissions or get_roster to find the userId first. Requires instructor or TA access to the course. Input parameters: - `courseId` (integer, required): Course ID the dropbox folder belongs to. - `folderId` (integer, required): Dropbox folder ID. - `ignoreFeedback` (boolean): When true, omit feedback status from the response. - `userId` (integer, required): Brightspace user ID (or group ID for a group folder) whose submissions to retrieve. ### `get_dropbox_feedback` (~199 tokens) Get Dropbox Feedback Retrieve the feedback saved for a dropbox folder — score, graded state, feedback text, and rubric assessment detail. Students: omit entityType and entityId to read your OWN released feedback on an assignment (it is not hidden; use this when get_assignments shows feedback unavailable). Instructors and TAs: pass entityType and entityId to read what is already saved for any user or group, e.g. before drafting new feedback; reading another user's feedback requires instructor or TA access to the course. Input parameters: - `courseId` (integer, required): Course ID the dropbox folder belongs to. - `entityId` (integer): User ID or group ID whose existing feedback to retrieve. Omit to read the signed-in user's own feedback. - `entityType` (string): Whether entityId identifies an individual user or a group. Omit both entityType and entityId to read your own feedback. - `folderId` (integer, required): Dropbox folder ID. ### `get_rubrics_for_object` (~131 tokens) Get Rubrics for Dropbox Folder Retrieve the full rubric table (criteria, levels, and point values) attached to a dropbox folder, for an instructor or TA. Use get_dropbox_folders first to find folderId. Like get_dropbox_folders, this reads the folder listing's embedded rubric data, so it is not gated to instructor/TA accounts the way get_dropbox_submissions and get_dropbox_feedback are. Input parameters: - `courseId` (integer, required): Course ID the dropbox folder belongs to. - `folderId` (integer, required): Dropbox folder ID whose rubric(s) to retrieve full criteria/level detail for. ### `download_dropbox_submission_file` (~242 tokens) Download Dropbox Submission File Download a specific file from a student's (or group's) dropbox submission to an existing local directory (it is not created for you), for an instructor or TA. Use get_dropbox_submissions or get_dropbox_user_submissions first to find submissionId and fileId. Requires instructor or TA access to the course. IMPORTANT: Ask the user where they want to save the file before calling this tool. After identifying the file, suggest a clean readable filename and ask if they'd like to rename it. Input parameters: - `courseId` (integer, required): Course ID the dropbox folder belongs to. - `customFilename` (string): Custom filename for the downloaded file (include extension). If omitted, uses the original submission filename. - `downloadPath` (string, required): Absolute path to an existing local directory where the file should be saved. The directory must already exist; it is not created for you, so create it first if needed. - `fileId` (integer, required): File ID within that submission. - `folderId` (integer, required): Dropbox folder ID. - `submissionId` (integer, required): Submission ID, from get_dropbox_submissions or get_dropbox_user_submissions. ## Diagnostics Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server#diagnostics ## Score history - 2026-11-05: 78 - 2026-11-04: 93 - 2026-11-03: 77 - 2026-11-02: 77 - 2026-11-01: 91 - 2026-10-31: 76 - 2026-10-30: 77 - 2026-10-29: 77 - 2026-10-28: 91 - 2026-10-27: 76 - 2026-10-26: 90 - 2026-10-25: 90 - 2026-10-24: 63 - 2026-10-23: 74 - 2026-10-22: 73 - 2026-10-21: 62 - 2026-10-20: 73 - 2026-10-19: 87 - 2026-10-18: 72 - 2026-10-17: 86 - 2026-10-16: 75 - 2026-10-15: 85 - 2026-10-14: 47 - 2026-10-13: 47 - 2026-10-12: 47 - 2026-10-04: 47 - 2026-10-03: 54 ## Common questions ### What is the io.github.RohanMuppa/brightspace MCP server? io.github.RohanMuppa/brightspace is an MCP server listed in the public MCP registry as io.github.RohanMuppa/brightspace. D2L Brightspace MCP server: grades, due dates, assignments, announcements and files. Any school. This page covers its npm package (brightspace-mcp-server). ### Is the io.github.RohanMuppa/brightspace MCP server safe to use? io.github.RohanMuppa/brightspace scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the io.github.RohanMuppa/brightspace MCP server expose? io.github.RohanMuppa/brightspace exposes 28 tools: get_my_courses, get_upcoming_due_dates, get_calendar_events, get_my_grades, get_announcements, and 23 more. Their descriptions and schemas cost roughly 6,108 tokens of context every time the server is loaded. ### Is the io.github.RohanMuppa/brightspace MCP server still maintained? io.github.RohanMuppa/brightspace is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ### What licence is the io.github.RohanMuppa/brightspace MCP server under? io.github.RohanMuppa/brightspace declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls. ### What did VerifyMCP test on the io.github.RohanMuppa/brightspace MCP server? VerifyMCP ran 15 checks on io.github.RohanMuppa/brightspace, covering Known CVEs, Install scripts, Dependency health, Source repository and 11 more. One item could not be completed, a gap on our side rather than a finding about io.github.RohanMuppa/brightspace: Malware scan. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out. ## Links - npm package: https://www.npmjs.com/package/brightspace-mcp-server - Socket report: https://socket.dev/npm/package/brightspace-mcp-server - Repository: https://github.com/RohanMuppa/brightspace-mcp-server - Changelog RSS feed: https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server.xml - Changelog JSON feed: https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server/changelog.json - Trust report (JSON): https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server.json - HTML version of this page: https://verifymcp.io/servers/rohanmuppa-brightspace/brightspace-mcp-server