moodle-mcp

A Model Context Protocol server that gives AI assistants (Claude, opencode, any MCP client) safe access to Moodle, and syncs your courses, grades, deadlines and materials into an Obsidian vault.

Works with any Moodle that has Web Services and the mobile app service enabled — including universities behind federated SSO (Entra ID, SAML, Shibboleth, CAS), where students can't generate an API token by hand.

🇵🇹 Versão em português

Why this one

Most MCP servers for third-party platforms pipe untrusted content straight into the model and expose every write action by default. Moodle is a worst case for that: any participant in a course can write forum posts the model will read, and actions like submitting an assignment can't be undone. This server is designed around that threat model:

• Read-only by default. Write tools (submissions, forum posts, messages) and the raw Web Services API are off unless you enable them explicitly. 18 of the 22 default tools carry readOnlyHint, so a client can auto-approve them without auto-approving anything irreversible.
• Prompt-injection defenses on the server side (OWASP LLM01), not delegated to the model:
  • hidden content is stripped from every Moodle response — display:none, font-size:0, hidden, HTML comments, Unicode tag characters, zero-width and bidi control characters — so the model reads what the student sees;
  • notes written to the vault can't execute anything: dataviewjs/dataview blocks, inline Dataview and Templater commands are neutralised, remote images become links (no tracking pixels);
  • every Moodle write requires user confirmation via MCP elicitation, showing the exact recipient and text — even when the client is set to auto-approve.
• Token confinement. Credentials never appear in tool responses. The token is only ever attached to pluginfile.php URLs on the configured instance; any other host is refused before a request is made. Tools that can overwrite credentials are off by default, so a malicious forum post can't swap your token.
• Context-budget aware. The full tool set costs ~9,700 tokens per request; selectable toolsets cut that to ~1,750–5,500.

Features

• SSO token capture — moodle-mcp --login starts the mobile-app login in your browser with a single-use passport; a moodlemobile:// URL handler receives the redirect, checks Moodle's signature and stores the token (0600). Registered natively on Linux (xdg-mime), Windows (HKEY_CURRENT_USER, no admin) and macOS (an AppleScript applet registered with Launch Services). The token never passes through the model, and the handler moves the URL out of its command-line arguments at once, so other local users can't read it with ps.
• Obsidian dashboard sync — a central note with every course, progress, current grades and a sorted deadline calendar; one note per course with grade report, per-assignment submission status, assignment briefs converted to Markdown and the resource tree.
• What changed — each sync compares with the previous one and writes a note (and get_recent_changes returns it, without calling Moodle): new grades, changed deadlines, new assignments and quizzes, n

... View full README on GitHub