brightspace-mcp-server 3.10.10 → 3.10.13

package/README.md

@@ -73,7 +73,7 @@ School-specific quirks: [docs/sign-in.md](docs/sign-in.md#per-school-notes).
 | Course content | "Find the midterm review slides" · "Download every PDF from Module 5" · "Search this course for office hours" · or just read a file inline instead of saving it |
 | People | "Who are the TAs for ECE 264?" · "Who is in my project group?" |
 | Discussions | "Summarize the latest posts in the final project thread" |
-| Lecture videos | "What did the professor say about pinch-off in Tuesday's recording?" (Kaltura and YouTube) |
+| Lecture videos | "What did the professor say about pinch-off in Tuesday's recording?" (Kaltura, including BoilerCast LTI links, and YouTube) |
 | Calendar | "When is my midterm?" · "Is lab cancelled on Thursday?" |
 | For instructors and TAs | "Which students haven't submitted Lab 4 yet?" · "What feedback did I leave on this student's homework?" · "Download that student's submitted PDF" (students see a clear "instructor access required" note) |
 

package/build/api/client.js

@@ -300,6 +300,28 @@ export class D2LApiClient {
         const resolved = await this.resolvePath(path);
         return this.withAuthentication(resolved, token => this.makeRawRequest(resolved, token));
     }
+    /**
+     * Fetch a Brightspace web page (not an API route) as the signed-in user.
+     * Pages check the session cookie and ignore a Bearer token, so this sends
+     * the stored cookie. Returns null when no cookie is stored or the page
+     * answers with the login redirect: it never starts a login, since a page
+     * read by a read-only tool is not worth an MFA prompt.
+     */
+    async getPage(path) {
+        const token = await this.tokenManager.getToken();
+        if (!token?.cookieHeader)
+            return null;
+        const cookieToken = { ...token, accessToken: `cookie:${token.cookieHeader}` };
+        try {
+            const response = await this.retrying(() => this.throttled(() => this.makeRawRequest(path, cookieToken)));
+            return await response.text();
+        }
+        catch (error) {
+            if (error instanceof ApiError && error.status === 401)
+                return null;
+            throw error;
+        }
+    }
     /** One HTTP refresh and at most one browser login per caller. */
     async withAuthentication(path, request) {
         let token = await this.tokenManager.getToken();

package/build/tools/get-video-transcript.js

@@ -8,6 +8,7 @@ import { GetVideoTranscriptSchema } from "./schemas.js";
 import { toolResponse, errorResponse, sanitizeError } from "./tool-helpers.js";
 import { cuesToText, paginateText } from "../utils/transcript/captions.js";
 import { detectVideoPlatform, extractKalturaIds, extractYouTubeVideoId, } from "../utils/transcript/platform.js";
+import { isBrightspaceRelativeLink, readLtiLaunchPage } from "../utils/transcript/lti.js";
 import { getKalturaTranscript } from "../utils/transcript/kaltura.js";
 import { getYouTubeTranscript } from "../utils/transcript/youtube.js";
 import { NoTranscriptError, TranscriptFetchError } from "../utils/transcript/errors.js";
@@ -28,6 +29,24 @@ async function resolveVideoUrl(apiClient, courseId, topicId) {
     }
     return { url: topic.Url };
 }
+/** The quickLink itself, plus one Brightspace page it frames (the tool launch). */
+const MAX_LTI_PAGES = 2;
+/** Request a Brightspace LTI link as the user and read its launch for the video it opens. */
+async function followLtiLaunch(apiClient, path) {
+    let next = path;
+    for (let page = 0; page < MAX_LTI_PAGES; page++) {
+        const html = await apiClient.getPage(next);
+        if (html === null)
+            return null;
+        const finding = readLtiLaunchPage(html);
+        if (!finding)
+            return null;
+        if ("videoUrl" in finding)
+            return finding.videoUrl;
+        next = finding.nextPath;
+    }
+    return null;
+}
 async function fetchTranscript(platform, videoUrl, fetchImpl) {
     switch (platform) {
         case "kaltura": {
@@ -92,7 +111,7 @@ export function registerGetVideoTranscript(server, apiClient, fetchImpl = fetch)
         description: "Read the transcript of a video embedded in course content, such as a recorded lecture or explainer clip. " +
             "Call it with courseId and topicId from get_course_content (typeFilter: 'video' or 'other'), or with videoUrl " +
             "directly if you already have the link. Returns transcript text with timestamps, plus title and duration when " +
-            "available. Currently supports Kaltura (e.g. BoilerCast) and YouTube; other platforms return a clear message " +
+            "available. Currently supports Kaltura (e.g. BoilerCast, including its Brightspace LTI links) and YouTube; other platforms return a clear message " +
             "naming what isn't supported yet. Use offset/maxChars to page through a long transcript. Read only — this " +
             "never marks the video as watched.",
         inputSchema: GetVideoTranscriptSchema,
@@ -114,6 +133,22 @@ export function registerGetVideoTranscript(server, apiClient, fetchImpl = fetch)
             else {
                 return errorResponse("Provide either videoUrl, or both courseId and topicId to look up the video from course content.");
             }
+            if (isBrightspaceRelativeLink(resolvedUrl)) {
+                const launchedUrl = await followLtiLaunch(apiClient, resolvedUrl);
+                if (!launchedUrl) {
+                    return toolResponse({
+                        courseId,
+                        topicId,
+                        videoUrl: resolvedUrl,
+                        platform: "unknown",
+                        hasTranscript: false,
+                        message: `This is a Brightspace LTI link (${resolvedUrl}), and its launch did not reveal which video it opens. ` +
+                            "Some tools only hand over the video after a browser sign-in to the tool itself, which this server " +
+                            "can't do. The video platform itself may still be supported. Open it in Brightspace directly.",
+                    });
+                }
+                resolvedUrl = launchedUrl;
+            }
             const platform = detectVideoPlatform(resolvedUrl);
             const outcome = await fetchTranscript(platform, resolvedUrl, fetchImpl);
             if ("unsupported" in outcome) {

package/build/tools/schemas.js

@@ -37,7 +37,7 @@ export const GetMyGradesSchema = z.object({
 });
 export const GetAnnouncementsSchema = z.object({
     courseId: z.coerce.number().int().positive().optional().describe("Course ID to get announcements for. If omitted, returns recent announcements across all courses."),
-    count: z.coerce.number().int().min(1).max(50).default(10).describe("Maximum number of announcements to return"),
+    count: z.coerce.number().int().min(1).max(50).default(10).describe("Maximum number of announcements to return, newest first (1-50, default 10). There is no pagination or offset: when more announcements exist than count, only the newest are returned. To get fuller coverage, call once per course with courseId so courses do not compete for the same slots, and use modifiedSince to return only announcements changed since a cutoff."),
     modifiedSince: z.string().datetime({ offset: true, message: "modifiedSince must be an ISO 8601 datetime, e.g. 2026-01-15T00:00:00Z" }).optional()
         .describe("Only return announcements last modified at or after this ISO 8601 datetime (e.g. 2026-01-15T00:00:00Z). Announcements with no modified timestamp are always included. When set, the response reports how many announcements were filtered out."),
 });

package/build/utils/transcript/lti.js

@@ -0,0 +1,86 @@
+/**
+ * Purdue Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+/**
+ * Brightspace hands out an LTI tool (BoilerCast's Kaltura KAF, for one) as a
+ * relative quickLink such as `/d2l/common/dialogs/quickLink/quickLink.d2l?type=lti&rcode=...`,
+ * which names no video at all. Requesting it with the user's session yields
+ * the LTI launch page: an auto-submitting form whose action, or one of whose
+ * hidden fields, is the tool URL that does name the video. This reads that
+ * page; fetching it is the caller's job.
+ */
+import { detectVideoPlatform, extractKalturaIds, extractYouTubeVideoId } from "./platform.js";
+/** A link into the user's own Brightspace, which only an authenticated request can follow. */
+export function isBrightspaceRelativeLink(url) {
+    return url.startsWith("/d2l/");
+}
+function decodeEntities(value) {
+    return value
+        .replace(/&#x([0-9a-f]+);/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)))
+        .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(parseInt(dec, 10)))
+        .replace(/"/g, '"')
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&amp;/g, "&");
+}
+function tagAttributes(html, tag) {
+    return [...html.matchAll(new RegExp(`<${tag}\\b[^>]*>`, "gi"))].map(element => new Map([...element[0].matchAll(/([\w-]+)\s*=\s*(["'])([\s\S]*?)\2/g)].map(match => [
+        match[1].toLowerCase(),
+        decodeEntities(match[3]),
+    ])));
+}
+/** True when an adapter could fetch a transcript from `url`, or name the platform it can't yet. */
+function namesVideo(url) {
+    switch (detectVideoPlatform(url)) {
+        case "unknown":
+            return false;
+        case "kaltura":
+            return extractKalturaIds(url) !== null;
+        case "youtube":
+            return extractYouTubeVideoId(url) !== null;
+        default:
+            return true;
+    }
+}
+/**
+ * Kaltura KAF's LTI consumer key is the school's Kaltura partner ID, and a
+ * school-branded KAF launch URL often carries only the entry ID, so the key
+ * fills in the `wid` the URL left out.
+ */
+function asVideoUrl(candidate, consumerKey) {
+    if (!/^https?:\/\//i.test(candidate))
+        return null;
+    if (namesVideo(candidate))
+        return candidate;
+    if (!consumerKey || !/^\d+$/.test(consumerKey))
+        return null;
+    let withPartner;
+    try {
+        withPartner = new URL(candidate);
+    }
+    catch {
+        return null;
+    }
+    if (withPartner.searchParams.has("wid"))
+        return null;
+    withPartner.searchParams.set("wid", `_${consumerKey}`);
+    return namesVideo(withPartner.href) ? withPartner.href : null;
+}
+export function readLtiLaunchPage(html) {
+    const inputs = tagAttributes(html, "input");
+    const consumerKey = inputs.find(input => input.get("name") === "oauth_consumer_key")?.get("value");
+    const candidates = [
+        ...tagAttributes(html, "form").map(form => form.get("action")),
+        ...tagAttributes(html, "iframe").map(frame => frame.get("src")),
+        ...inputs.map(input => input.get("value")),
+    ].filter((candidate) => Boolean(candidate));
+    for (const candidate of candidates) {
+        const videoUrl = asVideoUrl(candidate, consumerKey);
+        if (videoUrl)
+            return { videoUrl };
+    }
+    const nextPath = candidates.find(isBrightspaceRelativeLink);
+    return nextPath ? { nextPath } : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.10.10",
+  "version": "3.10.13",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",