alphaportal-mcp

An MCP server for AlphaPortal (AlphaRoute), the parent/guardian school-bus transportation portal used by districts such as Charlotte-Mecklenburg Schools (cmsnc.alphaportal.app). Ask Claude where your child's bus is, what stops they have, and what arrival notifications came in — and (confirm-gated) adjust notification preferences and walk-zone radius.

Developed and maintained by AI. Use at your own discretion.

What it can do

Reads (all live-verified against the real API):

• alphaportal_list_students — your children, with grade, school, and transport flags
• alphaportal_get_student — a child's school plus morning/afternoon stops
• alphaportal_get_student_stops — assigned stops with times and locations
• alphaportal_get_bus_location — live GPS of the bus for the AM or PM run
• alphaportal_list_notifications — arrival/departure alerts (view: "brief" for one line per alert)
• alphaportal_list_requests — submitted transportation requests + tracking numbers
• alphaportal_get_report_link — a PDF report download link
• alphaportal_list_schools, alphaportal_list_grades — district reference data
• alphaportal_get_profile, alphaportal_get_account, alphaportal_get_settings
• alphaportal_session_status — is a working session configured (no secrets returned)
• alphaportal_healthcheck — which hop is broken: no refresh token resolved, AlphaPortal rejected it, a CDN/WAF blocked the request, or the API is down (no secrets returned)

Writes (each asks you to confirm first — a confirmation prompt where the client supports one; otherwise the first call returns a preview of the exact payload plus a confirmToken, and only a repeat call with that token proceeds; see Confirmations):

• alphaportal_edit_walk_radius — set a student's walk-zone radius (meters)
• alphaportal_set_notification — set per-student push/email notification preferences

Authentication — the refresh token

AlphaPortal's login is reCAPTCHA-gated and can't be automated with a username/password. Instead this server uses the refresh token the web app stores in your signed-in browser (an 8-day credential); from it, it mints the short-lived access tokens it needs entirely server-side — no browser bridge in the request hot path. There are two ways it gets that token, tried in order:

1. Automatic (fetchproxy bootstrap). If ALPHAPORTAL_REFRESH_TOKEN is not set, the server reads it once from your signed-in AlphaPortal tab via the ContextMint Bridge browser extension (formerly the fetchproxy extension) — a one-shot read that snapshots only the token (a JSON-pointer extraction, so your name/ email/phone never leave the browser), then closes. Requires the extension installed and a signed-in *.alphaportal.app tab. Get ContextMint Bridge from its releases page: in Chrome, unzip the chrome build and load it unpacked (chrome://extensions → Developer mode → Load unpacked). Safari isn't available yet (it will ship inside the ContextMint app, which has no public download), so use Chrome for now. ContextMint Bridge is the fetchproxy browser extension under its new name, from the same maintainer — fetchproxy's own README points to it. Its source is public at https://github.com/nullnet-app/contextmint-bridge: build it yourself, or check a release zip against the .sha256 file published beside it (shasum -a 256 -c contextmint-bridge-chrome-<version>.zip.sha256). Set ALPHAPORTAL_DISABLE_FETCHPROXY=1 to turn this off.
2. Manual (env var). Set ALPHAPORTAL_REFRESH_TOKEN yourself. Capture it in a signed-in tab's DevTools console:

   JSON.parse(localStorage.user).User.RefreshToken
   

   This is the right path for a headless/hosted deployment with no browser.

Either way, the server persists each r

... View full README on GitHub