brightspace-mcp-server 3.9.14 → 3.9.16

package/README.md

@@ -28,14 +28,14 @@ Works with Claude Desktop, Claude Code, Cursor, ChatGPT Desktop, Windsurf, and a
    It asks for your school's Brightspace address, your username and password, and how you normally do two-factor sign-in (phone approval, authenticator code, or a browser window). Your password goes into your computer's own password store (Keychain on Mac, Credential Manager on Windows), never into a file. At the end it connects itself to Claude Desktop, Cursor, Codex, or Claude Code if you have them.
 3. **Restart your AI app and ask it something** — the first question signs you in. If your phone asks you to approve a sign-in, approve it and ask again.
 
-At one of these schools, add the flag and skip typing the address: `--purdue`, `--suny`, `--western`, `--tudelft`, `--cuny`, `--leiden`.
+At one of these schools, add the flag and skip typing the address: `--purdue`, `--suny`, `--western`, `--tudelft`, `--cuny`, `--leiden`, `--javeriana`.
 
 **Rather have the AI install it for you?** Paste this into Claude Code, Cursor, Windsurf, Copilot, or Codex:
 
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, or --leiden at Leiden).
+(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, --leiden at Leiden, or --javeriana at Javeriana Cali).
 ```
 
 Using a different AI app? Add the command `npx -y brightspace-mcp-server@latest` to its MCP settings (on Windows: `cmd /c npx -y brightspace-mcp-server@latest`). Exact steps for each app: [docs/troubleshooting.md](docs/troubleshooting.md).
@@ -52,6 +52,7 @@ If your school uses D2L Brightspace, yes. These have automatic sign-in built in:
 | TU Delft | NetID (no two-factor) | `--tudelft` |
 | CUNY | CUNY Login, authenticator code each time | `--cuny` |
 | Leiden University | SURFconext → Microsoft | `--leiden` |
+| Javeriana Cali | OneGate (password + authenticator code) | `--javeriana` |
 | Any other D2L school | Paste your Brightspace address; if the login page isn't recognized, a browser window opens so you can sign in by hand | none |
 
 School-specific quirks: [docs/sign-in.md](docs/sign-in.md#per-school-notes).

package/build/auth/index.js

@@ -9,6 +9,7 @@ export { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 export { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 export { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
 export { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
+export { JaverianaSSOFlow, isJaverianaBrightspace } from "./javeriana-sso.js";
 export { createSSOFlow } from "./sso-flow.js";
 export { TokenManager } from "./token-manager.js";
 export { SessionStore } from "./session-store.js";

package/build/auth/javeriana-sso.js

@@ -0,0 +1,322 @@
+/** Pontificia Universidad Javeriana Cali login via MobilityGuard OneGate. Licensed under MIT; see LICENSE. */
+import { BrowserAuthError } from "../utils/errors.js";
+import { log } from "../utils/logger.js";
+import { AUTH_COMMAND, SETUP_COMMAND } from "../utils/commands.js";
+import { MfaApprovalError, UnsupportedAuthenticationError } from "./sso-flow.js";
+/**
+ * Ported from Joshua Mendez (@JoshuaMontclair)'s fork, branch
+ * feat/javeriana-cali-sso (MIT). The fork's stored-TOTP-secret path and its
+ * separate sso-factory.ts are not carried over: here, as with every other
+ * code-based MFA in this project, the authenticator code is typed by a
+ * person through the terminal prompt (see cuny-sso.ts, which this flow is
+ * otherwise modeled on).
+ *
+ * Brightspace federates by SAML to MobilityGuard OneGate at
+ * mg-local.servicios.javerianacali.edu.co:
+ *
+ *   /d2l/login → ... → IdP "Elija su método de autenticación" chooser
+ *     → GET /mg-local/login?type=webtoken   ("Usuario y Contraseña")
+ *     → (submit #form)   → an /auth/totp-pattern page asking for the code
+ *     → (submit #otp-form) → /d2l/home
+ *
+ * Both the credentials form (#form) and the code form (#otp-form) copy their
+ * typed values into hidden inputs from a submit handler wired up on `load`;
+ * clicking before that handler attaches posts the hidden fields empty. Hence
+ * `waitForLoadState("load")` before every click. The code field is rendered
+ * visible but disabled at first paint, so being editable — not merely
+ * visible — is the only honest sign that OneGate is ready for it.
+ */
+const JAVERIANA_BRIGHTSPACE_HOST = "auladigital.javerianacali.edu.co";
+const ONEGATE_HOST = "mg-local.servicios.javerianacali.edu.co";
+/** "Usuario y Contraseña" — OneGate's chooser link for password sign-in. */
+const CREDENTIALS_FORM_PATH = "/mg-local/login?type=webtoken";
+const SELECTORS = {
+    username: "input#user-id",
+    password: "input#password",
+    token: "input#token",
+    credentialsSubmit: 'form#form input[type="submit"]',
+    tokenSubmit: 'form#otp-form input[type="submit"]',
+    /** OneGate's status banner. Rendered hidden and unhidden to show errors. */
+    statusMessage: ".box--system-message",
+    /**
+     * The method chooser's own "Usuario y Contraseña" link — a positive
+     * marker that distinguishes the chooser from a transient interstitial
+     * (a SAML auto-post, a "processing" page) that also lacks the
+     * username/token fields but must not be navigated away from.
+     */
+    chooserLink: 'a[href*="type=webtoken"]',
+};
+const POLL_MS = 500;
+/** OneGate parks on the chooser and credentials form briefly before the code challenge. */
+const CHALLENGE_TIMEOUT_MS = 60_000;
+/** A person has to find their authenticator and read a code. */
+const MFA_TIMEOUT_MS = 5 * 60 * 1000;
+const FORM_NAVIGATION_TIMEOUT_MS = 30_000;
+/** How many mistyped codes to re-prompt for before giving up on this challenge. */
+const MAX_CODE_ATTEMPTS = 3;
+/** True for Javeriana Cali's Brightspace tenant. */
+export function isJaverianaBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === JAVERIANA_BRIGHTSPACE_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/** Compare hosts, not substrings: a lookalike domain must never pass this check. */
+function isOneGate(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" && parsed.hostname.toLowerCase() === ONEGATE_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Login flow for Javeriana Cali's Brightspace, behind MobilityGuard OneGate.
+ *
+ * OneGate's chooser is a plain GET link rather than a visible form, so
+ * `selectIdentityProvider` follows it during the shared silent-SSO poll
+ * (see browser-auth.ts's clickSilentSurfaces) before a human ever has to;
+ * `login` calls the same step again in case nothing resolved it yet. The
+ * authenticator code OneGate asks for afterward has no stored secret to
+ * generate it from, so it comes from a person, through the same terminal
+ * prompt or visible browser every other code-based MFA in this project uses.
+ */
+export class JaverianaSSOFlow {
+    config;
+    /** Guards the chooser-to-credentials-form redirect to at most once per login. */
+    credentialsFormOpened = false;
+    constructor(config) {
+        this.config = config;
+    }
+    hasCredentials() {
+        return Boolean(this.config.username && this.config.password);
+    }
+    /** Follow OneGate's "Usuario y Contraseña" chooser link before a human has to. */
+    async selectIdentityProvider(page) {
+        if (!isOneGate(page.url()))
+            return;
+        await this.openCredentialsForm(page);
+    }
+    async login(page) {
+        try {
+            log("INFO", "Starting Javeriana Cali sign-in flow (MobilityGuard OneGate)");
+            await this.completeLogin(page);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof BrowserAuthError)
+                throw error;
+            throw new UnsupportedAuthenticationError("OneGate could not complete automatic sign-in. Check saved credentials and your authenticator settings.", error);
+        }
+    }
+    /**
+     * Poll the page and answer whichever OneGate step is on screen. A run can
+     * hand over mid-flow (resumed re-authentication, or a run that handed off
+     * to a visible browser), so no step is assumed to come first.
+     */
+    async completeLogin(page) {
+        let deadline = Date.now() + (this.config.headless === false ? MFA_TIMEOUT_MS : CHALLENGE_TIMEOUT_MS);
+        let credentialsSubmitted = false;
+        let challenged = false;
+        /** The page the code was submitted from; a reload away from it is a rejection. */
+        let codeSubmittedFrom = null;
+        let announced = false;
+        while (Date.now() < deadline) {
+            if (await this.isAuthenticated(page)) {
+                log("INFO", "Login successful - verified Brightspace home");
+                return;
+            }
+            if (isOneGate(page.url())) {
+                await this.openCredentialsForm(page);
+                this.reportStatusMessage(page);
+                // The banner is also used for harmless notices before a password is
+                // ever sent, so only treat it as a hard rejection once credentials
+                // have actually been submitted — otherwise this would abort a login
+                // that is still progressing normally.
+                if (credentialsSubmitted && !challenged && await this.isVisible(page, SELECTORS.statusMessage)) {
+                    throw new BrowserAuthError(`OneGate rejected the saved username or password. Run \`${SETUP_COMMAND} --javeriana\` to update your password.`, "credentials");
+                }
+                if (await this.isEditable(page, SELECTORS.token)) {
+                    if (!challenged) {
+                        challenged = true;
+                        deadline = Date.now() + MFA_TIMEOUT_MS;
+                    }
+                    if (this.config.headless === false && !this.config.requestMfaCode) {
+                        // The person at the window types the code and can retry a typo
+                        // there, so a rejection is theirs to answer, not a failure here.
+                        if (!announced) {
+                            announced = true;
+                            log("WARN", "Enter the authenticator code in the OneGate browser window. Waiting up to 5 minutes.");
+                            this.config.onMfaChallenge?.(null);
+                        }
+                    }
+                    else {
+                        const url = page.url();
+                        if (codeSubmittedFrom !== null && url !== codeSubmittedFrom) {
+                            throw new MfaApprovalError(new Error("OneGate rejected the authenticator code."));
+                        }
+                        if (codeSubmittedFrom === null) {
+                            if (this.config.headless !== false && !this.config.requestMfaCode)
+                                throw this.codePromptUnavailable();
+                            codeSubmittedFrom = url;
+                            await this.submitCode(page);
+                        }
+                    }
+                }
+                else if (!credentialsSubmitted && await this.isVisible(page, SELECTORS.username)) {
+                    // OneGate's authenticator code is required on every full sign-in and
+                    // there is no way to type it without a terminal or a visible window,
+                    // so a headless run with neither can never finish. Stop before the
+                    // password is sent: otherwise a stale saved password keeps getting
+                    // resubmitted on every background re-authentication attempt.
+                    if (this.config.headless !== false && !this.config.requestMfaCode)
+                        throw this.codePromptUnavailable();
+                    credentialsSubmitted = true;
+                    await this.enterCredentials(page);
+                }
+            }
+            await page.waitForTimeout(POLL_MS);
+        }
+        if (challenged)
+            throw new MfaApprovalError();
+        throw new UnsupportedAuthenticationError("OneGate did not reach the authenticator-code challenge or Brightspace. If your sign-in needs a different step, set D2L_HEADLESS=false and finish sign-in in the browser.");
+    }
+    /**
+     * Open the password form from OneGate's chooser. A no-op once a username
+     * or code field is already on screen — a resumed run, or a redirect that
+     * landed past the chooser on its own — once this redirect has already
+     * run for this login, or when the current page is not actually the
+     * chooser: a transient interstitial (a SAML auto-post, a "processing"
+     * page between steps) also lacks the username/token fields, and
+     * navigating away from it would abort an in-flight POST. The chooser's
+     * own "Usuario y Contraseña" link is the positive signal that this really
+     * is the chooser, safe to redirect from.
+     */
+    async openCredentialsForm(page) {
+        const hasUsername = (await page.locator(SELECTORS.username).count()) > 0;
+        const hasToken = (await page.locator(SELECTORS.token).count()) > 0;
+        if (hasUsername || hasToken)
+            return;
+        if (this.credentialsFormOpened)
+            return;
+        const hasChooserLink = (await page.locator(SELECTORS.chooserLink).count()) > 0;
+        if (!hasChooserLink)
+            return;
+        this.credentialsFormOpened = true;
+        const { origin } = new URL(page.url());
+        log("INFO", 'Opening the "Usuario y Contraseña" form');
+        await page.goto(`${origin}${CREDENTIALS_FORM_PATH}`, {
+            waitUntil: "load",
+            timeout: FORM_NAVIGATION_TIMEOUT_MS,
+        });
+    }
+    async enterCredentials(page) {
+        if (!this.config.username)
+            throw new BrowserAuthError("Username is required for SSO login", "credentials");
+        if (!this.config.password)
+            throw new BrowserAuthError("Password is required for SSO login", "credentials");
+        // The handler that copies typed values into hidden fields attaches on
+        // `load`; clicking before then posts the hidden inputs empty.
+        await page.waitForLoadState("load");
+        // Re-check immediately after the load wait and before either field is
+        // touched: a navigation during that wait must never let a lookalike
+        // host receive the username, let alone the password.
+        this.assertOnOneGate(page, "entering credentials");
+        log("INFO", "Entering credentials");
+        await page.locator(SELECTORS.username).first().fill(this.config.username);
+        await page.locator(SELECTORS.password).first().fill(this.config.password);
+        await page.locator(SELECTORS.credentialsSubmit).first().click().catch(() => { });
+    }
+    codePromptUnavailable() {
+        return new UnsupportedAuthenticationError(`OneGate requires an authenticator code. Run \`${AUTH_COMMAND}\` in a terminal to enter it.`);
+    }
+    /**
+     * Feed OneGate's code challenge from the terminal prompt. Unlike the
+     * other code-based flows, which validate once and bail, this re-prompts
+     * on a malformed entry — the caller supplying requestMfaCode may not
+     * already loop the way the CLI's own terminal prompt does.
+     */
+    async submitCode(page) {
+        if (!this.config.requestMfaCode)
+            throw this.codePromptUnavailable();
+        let code;
+        for (let attempt = 1; attempt <= MAX_CODE_ATTEMPTS; attempt++) {
+            const typed = (await this.config.requestMfaCode()).replace(/\s/g, "");
+            if (/^\d{6,8}$/.test(typed)) {
+                code = typed;
+                break;
+            }
+            log("WARN", "That does not look like a 6-8 digit authenticator code.");
+        }
+        if (!code)
+            throw new UnsupportedAuthenticationError("The MFA code must contain 6-8 digits.");
+        // The same submit-handler timing applies to the code form.
+        await page.waitForLoadState("load");
+        // Re-check immediately before the code, for the same reason as the password.
+        this.assertOnOneGate(page, "entering the authenticator code");
+        await page.locator(SELECTORS.token).first().fill(code);
+        await page.locator(SELECTORS.tokenSubmit).first().click().catch(() => { });
+        log("INFO", "Authenticator code submitted");
+    }
+    /** Never type a secret into anything but OneGate itself. */
+    assertOnOneGate(page, action) {
+        if (!isOneGate(page.url())) {
+            throw new UnsupportedAuthenticationError(`Javeriana sign-in reached an unsupported identity-provider page while ${action}. No credentials were entered there.`);
+        }
+    }
+    async isVisible(page, selector) {
+        return page.locator(selector).first().isVisible().catch(() => false);
+    }
+    /**
+     * Editable rather than visible: the code field is on the page, visible and
+     * disabled, before the credentials step is submitted, so waiting for mere
+     * visibility would fill a field the page is still ignoring.
+     */
+    async isEditable(page, selector) {
+        return page.locator(selector).first().isEditable().catch(() => false);
+    }
+    /**
+     * Surface OneGate's status banner (wrong password, locked account, ...) in
+     * the logs if it appears. Deliberately non-blocking and advisory: the
+     * banner is also used for harmless notices, so it must not abort a login
+     * that is still progressing.
+     */
+    reportStatusMessage(page) {
+        const banner = page.locator(SELECTORS.statusMessage).first();
+        banner
+            .isVisible()
+            .then(async (visible) => {
+            if (!visible)
+                return;
+            const text = (await banner.textContent().catch(() => null))?.trim();
+            if (text)
+                log("WARN", `OneGate reported: ${text}`);
+        })
+            .catch(() => {
+            // No banner, or the page navigated away first — both are expected.
+        });
+    }
+    /** The login shell also exposes D2L.LP, so verify origin and home as well. */
+    async isAuthenticated(page) {
+        try {
+            const expected = new URL(this.config.baseUrl ?? `https://${JAVERIANA_BRIGHTSPACE_HOST}`);
+            const current = new URL(page.url());
+            if (current.origin !== expected.origin || !/^\/d2l\/home(?:\/|$)/.test(current.pathname))
+                return false;
+            const cookies = await page.context().cookies(expected.origin);
+            if (!cookies.some((cookie) => cookie.name === "d2lSessionVal" && Boolean(cookie.value)))
+                return false;
+            return await page.evaluate(() => {
+                const d2l = window.D2L;
+                return Boolean(d2l?.LP);
+            });
+        }
+        catch {
+            // Redirects can replace the execution context mid-check. Keep polling.
+            return false;
+        }
+    }
+}

package/build/auth/sso-flow.js

@@ -9,6 +9,7 @@ import { WesternSSOFlow, isWesternBrightspace } from "./western-sso.js";
 import { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 import { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
 import { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
+import { JaverianaSSOFlow, isJaverianaBrightspace } from "./javeriana-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -63,5 +64,8 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
     if (isCunyBrightspace(config.baseUrl)) {
         return new CunySSOFlow(credentials);
     }
+    if (isJaverianaBrightspace(config.baseUrl)) {
+        return new JaverianaSSOFlow(credentials);
+    }
     return new PurdueSSOFlow(credentials);
 }

package/build/setup.js

@@ -66,6 +66,12 @@ export const SCHOOL_PRESETS = {
         mfaNote: "Type the 6-digit code from your authenticator app when prompted.",
         usernameHint: "Use your full CUNY Login address, e.g. firstname.lastname01@login.cuny.edu",
     },
+    javeriana: {
+        name: "Pontificia Universidad Javeriana Cali",
+        baseUrl: "https://auladigital.javerianacali.edu.co",
+        usernameLabel: "Javeriana username",
+        mfaNote: "OneGate asks for a code from your authenticator app when you sign in.",
+    },
 };
 /**
  * Pick the school preset named by `--purdue`, `--suny`, `--western`, `--cuny`, etc.

package/build/tools/get-assignments.js

@@ -129,8 +129,14 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
             // Skip hidden folders
             if (folder.IsHidden)
                 continue;
-            // Fetch submissions for this folder
+            // Fetch submissions for this folder. Some tenants deny students access
+            // to mysubmissions outright (403), in which case an empty list would be
+            // indistinguishable from genuinely unsubmitted work — track whether the
+            // answer is actually known so the caller never reports denied-but-real
+            // work as missing.
+            // Adapted from JoshuaMontclair/brightspace-mcp-server (MIT).
             let submissions = [];
+            let submissionsKnown = true;
             try {
                 const submissionsRaw = await apiClient.get(apiClient.le(courseId, `/dropbox/folders/${folder.Id}/submissions/mysubmissions/`), { ttl: DEFAULT_CACHE_TTLS.assignments });
                 submissions = Array.isArray(submissionsRaw) ? submissionsRaw : submissionsRaw.Objects ?? [];
@@ -138,9 +144,10 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
             catch (error) {
                 if (isAuthUnavailable(error))
                     throw error;
-                // 404 means no submissions yet - that's fine
+                // 404 is how D2L reports "nothing submitted yet" - that one is known.
                 if (error?.status !== 404) {
-                    log("DEBUG", `Failed to fetch submissions for folder ${folder.Id}`, error);
+                    submissionsKnown = false;
+                    log("DEBUG", `Could not determine submission state for folder ${folder.Id}`, error);
                 }
             }
             // Fetch feedback independently of submissions
@@ -191,6 +198,19 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                         })) ?? [],
                     })) ?? [],
                 })) ?? null,
+                // New, additive fields: existing "submission" stays null either way
+                // when nothing is known, but submissionStatus tells apart "nothing
+                // was submitted" (404, a known answer) from "the answer is denied"
+                // (any other error), so a caller never states real work as missing.
+                submissionStatus: !submissionsKnown
+                    ? "unknown"
+                    : submissions.length > 0
+                        ? "submitted"
+                        : "not_submitted",
+                ...(submissionsKnown ? {} : {
+                    submissionStatusNote: "Brightspace did not return this assignment's submission list, so whether it was submitted " +
+                        "is unknown. Do not report it as missing or unsubmitted - tell the user to check Brightspace directly.",
+                }),
                 submission: submissions.length > 0
                     ? {
                         submittedDate: submissions[0].SubmissionDate,
@@ -311,6 +331,16 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
             // False when the tenant refused the attempts endpoint, in which case
             // every count below is null rather than a guess of zero.
             attemptsAvailable: completedAttempts !== null,
+            // New, additive field mirroring submissionStatus above: "known" is
+            // completedAttempts !== null (the same condition attemptsAvailable
+            // already tracks), named explicitly so a caller does not have to
+            // infer "unknown" from a boolean meant for something else.
+            // Adapted from JoshuaMontclair/brightspace-mcp-server (MIT).
+            attemptStatus: completedAttempts !== null ? "known" : "unknown",
+            ...(completedAttempts !== null ? {} : {
+                attemptStatusNote: "Brightspace did not provide this quiz's attempt data, so it is unknown whether it was taken. " +
+                    "Do not report it as not attempted.",
+            }),
             attemptsUsed: completedAttempts?.length ?? null,
             attemptsRemaining,
             attemptWarning,
@@ -375,7 +405,8 @@ function gradebookHeadsUp(raw, fetched, courseId, baseUrl) {
 export function registerGetAssignments(server, apiClient, config) {
     server.registerTool("get_assignments", {
         title: "Get Assignments",
-        description: "Fetch assignments and quizzes for a specific course or all enrolled courses. Shows dropbox submissions and quizzes with due dates, status, and rubric info. Use this when the user asks about assignments, homework, what to submit, quizzes, or assignment details and rubrics.",
+        description: "Fetch assignments and quizzes for a specific course or all enrolled courses. Shows dropbox submissions and quizzes with due dates, status, and rubric info. Use this when the user asks about assignments, homework, what to submit, quizzes, or assignment details and rubrics. " +
+            "Read submissionStatus/attemptStatus, not just submission/attemptsUsed, to decide whether something was turned in: some tenants deny students access to submission or attempt data, in which case the status is \"unknown\" even though submission is null or attemptsUsed is 0. Never report an \"unknown\" item as missing, unsubmitted, or not attempted - say it could not be verified and point the user to Brightspace.",
         inputSchema: GetAssignmentsSchema,
     }, async (args) => {
         try {

package/build/utils/config.js

@@ -7,15 +7,33 @@ import * as path from "node:path";
 import * as os from "node:os";
 import { createHash } from "node:crypto";
 import dotenv from "dotenv";
-import { configStoreExists, loadConfigStore } from "./config-store.js";
+import { configStoreExists, getConfigStorePath, loadConfigStore } from "./config-store.js";
 import { resolveStoredPassword } from "./secure-config.js";
 import { migrateLegacyState } from "../auth/legacy-state.js";
 export async function loadConfig() {
     dotenv.config({ quiet: true });
-    const store = configStoreExists() ? loadConfigStore() : null;
+    // A corrupt or permission-denied config.json must not take the whole server
+    // down at startup: env vars alone are a complete, if less convenient,
+    // configuration. The failure is still surfaced loudly (never silent) so a
+    // broken file doesn't masquerade as "no config.json was ever created".
+    // Idea from lmgveerhoek's fork (MIT).
+    let store = null;
+    let storeLoadError;
+    if (configStoreExists()) {
+        try {
+            store = loadConfigStore();
+        }
+        catch (error) {
+            storeLoadError = error;
+        }
+    }
     if (store) {
         console.error("[config] Loaded base config from ~/.brightspace-mcp/config.json");
     }
+    else if (storeLoadError) {
+        console.error(`[config] WARN: Failed to read ${getConfigStorePath()} (${storeLoadError instanceof Error ? storeLoadError.message : String(storeLoadError)}); ` +
+            "continuing with environment variables only.");
+    }
     else {
         console.error("[config] No config.json found, using environment variables");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.9.14",
+  "version": "3.9.16",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",