Purdue Brightspace MCP (policy-aware)
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PURDUE_MCP_AUDIT_LOG | No | Enable audit logging at ~/.local/state/purdue-brightspace-mcp/audit.jsonl. | true |
| PURDUE_MCP_AUTH_MODE | No | Authentication mode. Use `oauth` or `browser`. | oauth |
| PURDUE_MCP_AI_DATA_TIER | No | Highest Purdue data tier your AI client is authorized for on Purdue's AI tools list. `public` disables every data tool. `sensitive` enables everything but grades and feedback. `restricted` enables those too. | public |
| PURDUE_MCP_OAUTH_CLIENT_ID | No | OAuth 2.0 client ID issued by Purdue's Brightspace administrators for an approved app. | |
| PURDUE_MCP_OAUTH_CLIENT_SECRET | No | OAuth client secret, only needed if the registered app is confidential. Prefer the OS keychain or the MCP client's secret store. | |
| PURDUE_MCP_OAUTH_REDIRECT_PORT | No | OAuth redirect port; redirect URI must be http://127.0.0.1:<port>/callback. Default is 8765. | 8080 |
| PURDUE_MCP_AI_PERMITTED_COURSES | No | Comma-separated course IDs whose course materials are permitted to use with AI. `*` is rejected. | |
| PURDUE_MCP_MAX_REQUESTS_PER_HOUR | No | Maximum requests per hour, capped at 600. | 300 |
| PURDUE_MCP_BROWSER_MODE_ACKNOWLEDGED | No | Must be “true” to enable browser authentication mode. | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
Read-only access to the signed-in student's own Purdue Brightspace data, under Purdue policy limits.
Rules for the assistant:
Every result carries
purdue_data_classification. Treat Sensitive and Restricted results as confidential: do not repeat them into public places, other tools or shared documents.A result with status
refused_by_policyis final. Explain the reason to the user; do not try other tools to get the same data.Academic integrity: this server is for organizing coursework (deadlines, announcements, the student's own grades). Do not use course materials to complete graded work unless the course syllabus allows it. Quiz and exam content is never available.
Never ask for the user's Purdue password or Duo codes. Sign-in happens only on Purdue's own page.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| compliance_statusA | Show the Purdue policy settings in force: the declared AI data tier, which tools are enabled, courses with AI permission, request limits, and the policies they implement. Makes no Brightspace request. |
| sign_inA | Open Purdue's sign-in page in the user's browser so they can sign in and approve Duo themselves. The server never sees the password. |
| sign_outA | End the Brightspace session and clear cached data and stored tokens. |
| list_coursesB | List the student's own Brightspace course enrollments with their course IDs. Purdue Sensitive data. |
| upcoming_due_datesB | Calendar events and due dates across the student's active courses for the next |
| list_assignmentsA | Assignment folders in one of the student's courses: names, due dates, points. Instructions are included only for courses with AI permission. Purdue Sensitive data. |
| assignment_submission_statusB | Whether and when the student submitted to one assignment folder. Score and feedback are included only at the Restricted tier. |
| get_my_gradesA | The student's own released grades in one course. Purdue Restricted data: available only when the AI client is authorized for Restricted data. |
| get_announcementsB | Recent announcements in one course. Bodies are included only for courses with AI permission. Purdue Sensitive data. |
| get_course_outlineB | Module and topic titles for one course (no file contents). Purdue Sensitive data. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Each tool targets a distinct resource or lifecycle action (compliance, auth, courses, deadlines, assignments, grades, announcements, outline), and descriptions explicitly bound each one. The only mild overlap is between assignment_submission_status and get_my_grades, since both can surface score/feedback, but the per-assignment vs. per-course framing keeps them separable.
The set mixes verb_noun names (list_courses, get_my_grades, get_course_outline), verb_particle names (sign_in, sign_out), and bare noun phrases (compliance_status, upcoming_due_dates, assignment_submission_status). All names are readable and descriptive, but there is no single predictable pattern an agent can rely on.
Ten tools is well within the sweet spot, and every tool earns its place: auth pair, one policy/introspection tool, and seven read operations covering the student's domain. Nothing appears redundant or padding.
For a policy-aware, read-only student surface, coverage is solid: courses, deadlines, assignment folders and submission status, grades, announcements, and course structure. Minor gaps remain—no way to fetch a single assignment's details, list announcements across all courses, or access course content/files—but these are workable omissions rather than dead ends.