Brightspace MCP Server

What it does

Brightspace MCP Server connects an AI client to a D2L Brightspace learning platform through the student's (or instructor's) own school account. It is Rohan Muppa's independent project, not a D2L product, and works with any school on Brightspace. Nine schools (Purdue, SUNY, Western, TU Delft, CUNY, Leiden, McGill, Ngee Ann Polytechnic, Javeriana Cali) have their sign-in flow built in behind a setup flag, and at other schools you can finish the login by hand in a browser window.

The published 5.1.27 build registers 27 tools in src/server.ts. They cover course lists, grades, assignments and rubrics, due dates, calendar events, announcements with their attachments, the syllabus and module tree, discussions, a keyword search within one course, rosters, groups and classmate emails. Others download files or fetch timestamped transcripts of course videos. Six dropbox tools are meant for course staff and read every student's submissions and feedback. Four prompts (weekly_briefing, grade_audit, study_planner, course_summary) come with it.

Sign-in happens on first use. A headless Chromium browser walks through the school's login with the password taken from the operating system's credential store, and the session is kept for later. Any two-factor number to approve shows up in the answer. The sign_in tool lets the assistant start a sign-in itself. Pasting a session cookie (D2L_SESSION_COOKIE) or token (D2L_ACCESS_TOKEN) skips the browser, useful in Docker or WSL.

Every client on a computer shares one background server and session, which stops after D2L_RUNTIME_IDLE_SECONDS idle (600 by default).

Two things the README does not say. src/utils/config.ts still reads D2L_PASSWORDLESS (Microsoft passwordless phone approval, off by default), though the README dropped it and LLMs.md calls the mode shelved. And D2L_BASE_URL falls back to https://purdue.brightspace.com when neither setup nor the environment names a school.

What it needs

Run `npx -y brightspace-mcp-server@latest setup` once before first use. It saves the school address, your username and password, and the two-factor method, and registers the server with the clients it finds. On a Mac, answer Keychain's prompt with Always Allow so later sign-ins can read the saved password. A pasted cookie or token in D2L_SESSION_COOKIE or D2L_ACCESS_TOKEN replaces the browser sign-in.

Limits

• Read only No tool submits, edits or deletes anything in Brightspace.
• Not covered The dropbox submission tools answer only for instructors and TAs. Students get an instructor access note instead.
• Size cap download_file puts files inline up to 10 MB (images 3.5 MB, extracted text 400,000 characters). Larger files need an absolute downloadPath.
• Limit How often two-factor sign-in comes back is set by the school. With D2L_PASSWORDLESS every sign-in waits for a phone approval, so it is for interactive use only.
• Limit A session from D2L_SESSION_COOKIE or D2L_ACCESS_TOKEN is not renewed and ends when Brightspace expires it.
• Limit Keep the @latest tag in the command. Without it npx may run an older global install found on PATH (LLMs.md).
• Not covered Courses whose enrollment has ended are hidden unless D2L_ACTIVE_ONLY is false.

No tool submits, edits or deletes anything in Brightspace. The dropbox submission tools only answer for instructors and TAs; students get a 403 note. Inline downloads are bounded at 50MB; saving to disk with downloadPath raises that to 2GB (LLMs.md). How often two-factor sign-in returns is set by the school, and D2L_PASSWORDLESS makes every sign-in wait for a phone approval, so it does not suit unattended use. A session from D2L_SESSION_COOKIE or D2L_ACCESS_TOKEN is not renewed and ends when Brightspace expires it. A course syllabus kept in an external tool such as Simple Syllabus comes back as a link only. Keep the @latest tag: without it npx may run an older global install.

Who it suits

Students who want an assistant to track deadlines, grades and course materials across their Brightspace courses, and instructors or TAs who want to read submissions and feedback without clicking through the web interface. It runs locally on your machine with your own school login and changes nothing in Brightspace, so it fits personal use well. It is less suited to shared or unattended machines, since it stores your password and session locally and two-factor prompts may need a person. We also hold two other Brightspace servers, brightspace-mcp and brightspace-d2l-mcp, from different authors.