curricula-mcp exposes Huntress Curricula API operations as MCP tools for reading most Curricula data and performing limited state-changing actions.
List/get accounts; delete an account.
Read assignments: assignments, assigned learners, learner activity, completion certificates, enrollment conditions/extras.
List/get departments, episodes, groups, and learners.
Read phishing data: campaigns, scenarios, campaign scenarios, and attempts; report a phishing attempt.
List account-scoped assignments, departments, groups, learners, phishing campaigns/scenarios, admin users, and summary reports.
List/get account summary reports.
Manage admin users: list/get/create/update/delete.
Use path_params for IDs, query for filters/pagination/includes, and JSON:API body for writes.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@curricula-mcp List the active phishing simulation campaigns in production."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that exposes all 44 operations in the Huntress Curricula public API. It uses the OAuth access token issued by Curricula and supports the production and development-sandbox APIs.
pip install curricula-mcpOr run from a checkout:
pip install -e .Related MCP server: cloudradial-mcp
Create an OAuth access token with the Curricula scopes required for the operations you plan to use, then set:
export CURRICULA_ACCESS_TOKEN="your-access-token"
# Optional; default is production.
export CURRICULA_BASE_URL="https://mycurricula.com/api/v1"For group, learner, and assignment management, the Curricula OAuth client must be granted assignments:read, assignments:manage, learners:read, and learners:manage. The server requests those scopes by default when configured with CURRICULA_CLIENT_ID and CURRICULA_CLIENT_SECRET; a pre-issued CURRICULA_ACCESS_TOKEN must carry them already.
For the development sandbox, set CURRICULA_BASE_URL=https://dev.curricula.com/api/v1.
The server sends Authorization: Bearer <token> and uses the JSON:API media type. See the Curricula authentication and scopes documentation.
{
"mcpServers": {
"curricula": {
"command": "curricula-mcp",
"env": {
"CURRICULA_ACCESS_TOKEN": "your-access-token"
}
}
}
}Each API operation is an MCP tool. Supply URI identifiers through path_params, filters/pagination/includes through query, and JSON:API request content through body. For example:
{
"path_params": {"accountId": "abc123"},
"query": {"include": "learners", "page": 1, "perPage": 50}
}See TOOLS.md for the complete catalog.
Most tools are read-only. State-changing tools, including group movement and assignment enrollment, forward the request immediately. Agents should confirm intent before calling them.
pip install -e ".[dev]"
pytestCreate an administrator user. Calls POST /users. Put route IDs in path_params and filtering, pagination, sorting, or include values in query. Provide the JSON:API payload in body.
Inputs: body, query, path_params. Returns: object
Permanently delete an account. Calls DELETE /accounts/{accountId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Permanently delete an administrator user. Calls DELETE /users/{userId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get an account's details. Calls GET /accounts/{accountId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get an account summary report. Calls GET /account-summary-reports/{accountSummaryReportId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get administrator user details. Calls GET /users/{userId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get assignment details. Calls GET /assignments/{assignmentId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get a learner's assignment completion certificate. Calls GET /assignments/{assignmentId}/completion-certificate. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get learner activity for an assignment. Calls GET /assignments/{assignmentId}/learner-activity. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get department details. Calls GET /departments/{departmentId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get training episode details. Calls GET /episodes/{episodeId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get learner group details. Calls GET /groups/{groupId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get learner details. Calls GET /learners/{learnerId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get phishing campaign details. Calls GET /phishing-campaigns/{phishingCampaignId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get a campaign-scenario's details. Calls GET /phishing-campaign-scenarios/{phishingCampaignScenarioId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get the campaign related to a campaign-scenario. Calls GET /phishing-campaign-scenarios/{phishingCampaignScenarioId}/campaign. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get the phishing scenario related to a campaign-scenario. Calls GET /phishing-campaign-scenarios/{phishingCampaignScenarioId}/scenario. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Get phishing scenario details. Calls GET /phishing-scenarios/{phishingScenarioId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List account administrators. Calls GET /accounts/{accountId}/users. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List assignments for an account. Calls GET /accounts/{accountId}/assignments. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List departments in an account. Calls GET /accounts/{accountId}/departments. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List learner groups in an account. Calls GET /accounts/{accountId}/groups. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List learners in an account. Calls GET /accounts/{accountId}/learners. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List phishing campaigns for an account. Calls GET /accounts/{accountId}/phishing-campaigns. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List phishing scenarios for an account. Calls GET /accounts/{accountId}/phishing-scenarios. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List accounts available to the authenticated administrator. Calls GET /accounts. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List account summary reports. Calls GET /account-summary-reports. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List summary reports for an account. Calls GET /accounts/{accountId}/account-summary-reports. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List administrator users. Calls GET /users. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List assignment enrollment conditions. Calls GET /assignments/{assignmentId}/enrollment-conditions. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List assignment enrollment extras. Calls GET /assignments/{assignmentId}/enrollment-extras. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List learners assigned to an assignment. Calls GET /assignments/{assignmentId}/learners. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List assignments. Calls GET /assignments. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List departments. Calls GET /departments. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List training episodes. Calls GET /episodes. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List learner groups. Calls GET /groups. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List learners. Calls GET /learners. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List phishing attempts for a campaign. Calls GET /phishing-campaigns/{phishingCampaignId}/attempts. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List phishing campaigns. Calls GET /phishing-campaigns. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List attempts for a campaign-scenario. Calls GET /phishing-campaign-scenarios/{phishingCampaignScenarioId}/attempts. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List scenarios attached to a phishing campaign. Calls GET /phishing-campaigns/{phishingCampaignId}/campaign-scenarios. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
List phishing scenarios. Calls GET /phishing-scenarios. Put route IDs in path_params and filtering, pagination, sorting, or include values in query.
Inputs: body, query, path_params. Returns: object
Mark a phishing attempt reported using a code or message ID. Calls POST /phishing-attempts/actions/report. Put route IDs in path_params and filtering, pagination, sorting, or include values in query. Provide the JSON:API payload in body.
Inputs: body, query, path_params. Returns: object
Update an administrator user. Calls PATCH /users/{userId}. Put route IDs in path_params and filtering, pagination, sorting, or include values in query. Provide the JSON:API payload in body.
Inputs: body, query, path_params. Returns: object
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 44 tools
Most tools have clear resource-and-scope distinctions, such as list_account_learners vs list_learners. However, list_account_summary_reports_for_account and list_account_summary_reports are nearly identical, and list_account_admin_users vs list_admin_users could easily be confused.
Tool names overwhelmingly follow a consistent verb_noun snake_case pattern with list/get/create/update/delete prefixes. The main deviations are report_phishing_attempt, which uses an action verb rather than a CRUD prefix, and the awkward list_account_summary_reports_for_account name.
44 tools is well above the well-scoped range, and many are thin GET wrappers around nested REST endpoints. The surface area could be meaningfully reduced by consolidating account-scoped list variants or using parameters.
The tool surface is heavily read-only: only admin users have full create/update/delete coverage, plus one report action. There are no mutation tools for accounts, assignments, departments, groups, learners, phishing campaigns, phishing scenarios, or episodes, so management workflows cannot complete.
One OAuth connector for your team's remote MCP servers, with Tool Packs, guardrails and logs.
Find, document and execute authenticated API calls across 1000+ apps via one MCP server
Discover, plan and run tools across your connected business systems through one OAuth MCP endpoint
