brightspace-mcp-server 3.9.3 → 3.9.5

package/README.md

@@ -172,9 +172,10 @@ If this is a Docker or other headless setup with no `~/.brightspace-mcp/config.j
 | Announcements | "Did any professor post something important today?" · "What did my CS prof announce this week?" · "Any announcements since last Monday?" · "Read the file attached to today's announcement" · "Save the rubric my prof attached to that announcement" |
 | Course content | "Find the midterm review slides" · "Download every PDF from Module 5" · "What's new in this course since I last checked?" |
 | Roster | "Who are the TAs for ECE 264?" · "Get me my instructor's email" |
+| Groups | "Who is in my project group?" · "List my lab group members for this course" |
 | Discussions | "What are people saying in the final project thread?" · "Summarize the latest discussion posts" |
 | Video transcripts | "What did the professor say about pinch-off in Tuesday's lecture recording?" · "Summarize last week's BoilerCast video" — works for Kaltura and YouTube embeds; other platforms report that they aren't supported yet |
-| Troubleshooting | "Which version of the Brightspace server am I running?" · "Where is my Brightspace config file?" — `get_server_info` reports the version, Node runtime, platform, config and session paths, school URL, whether a credential is stored, what Microsoft remembered (`microsoftSession`: stay-signed-in and its expiry, plus whether "Don't ask again" was ticked, already on, not offered, or left off because `D2L_REMEMBER_MFA` isn't set), and `requests` (lightweight counters: responses by status class, network errors, cache hits/misses, coalesced in-flight joins, and token refreshes), without contacting Brightspace or revealing secrets |
+| Troubleshooting | "Which version of the Brightspace server am I running?" · "Where is my Brightspace config file?" · "What timezone are my due dates being computed in?" — `get_server_info` reports the version, Node runtime, platform, config and session paths, school URL, whether a credential is stored, the server's local timezone and UTC offset (`localTimezone`, `utcOffsetMinutes`), who the session is signed in as when known (`signedInAs: { uniqueName, displayName }`), what Microsoft remembered (`microsoftSession`: stay-signed-in and its expiry, plus whether "Don't ask again" was ticked, already on, not offered, or left off because `D2L_REMEMBER_MFA` isn't set), and `requests` (lightweight counters: responses by status class, network errors, cache hits/misses, coalesced in-flight joins, and token refreshes), without contacting Brightspace or revealing secrets |
 | Calendar | "When is my midterm?" · "What's on my calendar this week?" · "Is lab cancelled on Thursday?" — reads exams, labs, review sessions, and deadlines instructors put only on the course calendar |
 | Planning | "Build me a study schedule based on my upcoming due dates" · "Which class needs the most attention right now?" — pulls from assignments, quizzes, graded discussion topics (any topic with a due date), and course calendar events such as exams and labs |
 

package/build/auth/browser-auth.js

@@ -147,7 +147,13 @@ export class BrowserAuth {
             if (material.cookieHeader && material.csrfToken) {
                 const minted = await mintAccessToken({ baseUrl: this.config.baseUrl, cookieHeader: material.cookieHeader, csrfToken: material.csrfToken });
                 if (minted.ok) {
-                    token = { accessToken: minted.accessToken, capturedAt: Date.now(), expiresAt: Date.now() + this.config.tokenTtl * 1000, source: "browser" };
+                    // The mint endpoint itself carries no identity. Reuse the same
+                    // whoami read the other extraction strategies already validate
+                    // against so a mint-path login reports signedInAs too; a failure
+                    // here (offline, slow tenant) must not fail a login that already
+                    // has a good token, so it degrades to "no identity" instead.
+                    const identity = await this.validateToken(minted.accessToken).catch(() => null);
+                    token = { accessToken: minted.accessToken, capturedAt: Date.now(), expiresAt: Date.now() + this.config.tokenTtl * 1000, source: "browser", ...identity };
                 }
                 else if (minted.reason === "transport") {
                     throw new BrowserAuthTransportError(`Token mint temporarily failed: ${minted.detail ?? "network unavailable"}. Saved sign-in state is preserved.`);
@@ -157,8 +163,11 @@ export class BrowserAuth {
                 }
             }
             token ??= await this.tryExtractToken(page, context);
-            if (!token && captured && await this.validateToken(captured)) {
-                token = { accessToken: captured, capturedAt: Date.now(), expiresAt: Date.now() + this.config.tokenTtl * 1000, source: "browser" };
+            if (!token && captured) {
+                const identity = await this.validateToken(captured);
+                if (identity) {
+                    token = { accessToken: captured, capturedAt: Date.now(), expiresAt: Date.now() + this.config.tokenTtl * 1000, source: "browser", ...identity };
+                }
             }
             if (!token)
                 throw new BrowserAuthError("Brightspace did not provide a usable API token. Saved SSO cookies have been preserved.", "token_extraction");
@@ -211,31 +220,37 @@ export class BrowserAuth {
      * Returns null if every strategy fails.
      */
     async tryExtractToken(page, context) {
-        const build = (token) => {
+        const build = (token, identity) => {
             const now = Date.now();
             return {
                 accessToken: token,
                 capturedAt: now,
                 expiresAt: now + this.config.tokenTtl * 1000,
                 source: "browser",
+                ...identity,
             };
         };
         // Strategy 0: localStorage (D2L.Fetch.Tokens) : fastest
         const lsToken = await this.extractLocalStorageToken(page);
-        if (lsToken && (await this.validateToken(lsToken))) {
-            log("INFO", "Extracted valid Bearer token from localStorage");
-            return build(lsToken);
-        }
-        if (lsToken)
+        if (lsToken) {
+            const identity = await this.validateToken(lsToken);
+            if (identity) {
+                log("INFO", "Extracted valid Bearer token from localStorage");
+                return build(lsToken, identity);
+            }
             log("WARN", "localStorage Bearer token failed validation, trying next strategy");
+        }
         // Strategy 1: Force a Bearer fetch by hitting the API, then re-check localStorage
         try {
             log("DEBUG", "Navigating to API endpoint to trigger token capture");
             await page.goto(`${this.config.baseUrl}/d2l/api/lp/1.57/users/whoami`, { waitUntil: "load", timeout: 15000 });
             const lsToken2 = await this.extractLocalStorageToken(page);
-            if (lsToken2 && (await this.validateToken(lsToken2))) {
-                log("INFO", "Extracted valid Bearer token from localStorage after API nudge");
-                return build(lsToken2);
+            if (lsToken2) {
+                const identity = await this.validateToken(lsToken2);
+                if (identity) {
+                    log("INFO", "Extracted valid Bearer token from localStorage after API nudge");
+                    return build(lsToken2, identity);
+                }
             }
         }
         catch (error) {
@@ -245,25 +260,31 @@ export class BrowserAuth {
         }
         // Strategy 2: XSRF / page JS context
         const xsrfToken = await this.extractXsrfToken(page);
-        if (xsrfToken && (await this.validateToken(xsrfToken))) {
-            log("INFO", "Extracted valid XSRF token from page context");
-            return build(xsrfToken);
-        }
-        if (xsrfToken)
+        if (xsrfToken) {
+            const identity = await this.validateToken(xsrfToken);
+            if (identity) {
+                log("INFO", "Extracted valid XSRF token from page context");
+                return build(xsrfToken, identity);
+            }
             log("WARN", "XSRF token failed validation, trying next strategy");
+        }
         // Strategy 3: Cookie-based auth
         const cookieToken = await this.extractCookieToken(context);
-        if (cookieToken && (await this.validateToken(cookieToken))) {
-            log("INFO", "Extracted valid session cookie for API auth");
-            return build(cookieToken);
-        }
-        if (cookieToken)
+        if (cookieToken) {
+            const identity = await this.validateToken(cookieToken);
+            if (identity) {
+                log("INFO", "Extracted valid session cookie for API auth");
+                return build(cookieToken, identity);
+            }
             log("WARN", "Cookie token failed validation");
+        }
         return null;
     }
     /**
      * Validate a token by making a test API call to /users/whoami.
-     * Returns true if the token is accepted by D2L, false otherwise.
+     * Returns the non-secret identity whoami reported when the token is
+     * accepted by D2L (an empty object if the response carried no usable
+     * name fields), or null when the token is rejected.
      */
     async validateToken(token) {
         let response;
@@ -279,7 +300,7 @@ export class BrowserAuth {
         if (response.ok) {
             const contentType = response.headers.get("content-type") ?? "";
             if (!contentType.includes("json"))
-                return false;
+                return null;
             let user;
             try {
                 user = await response.json();
@@ -287,11 +308,18 @@ export class BrowserAuth {
             catch (error) {
                 throw new BrowserAuthTransportError("Token validation returned unreadable JSON.", { cause: error });
             }
-            const identifier = user?.Identifier;
-            return (typeof identifier === "string" && identifier.length > 0) || (typeof identifier === "number" && Number.isFinite(identifier));
+            const whoami = user;
+            const identifier = whoami?.Identifier;
+            const valid = (typeof identifier === "string" && identifier.length > 0) || (typeof identifier === "number" && Number.isFinite(identifier));
+            if (!valid)
+                return null;
+            return {
+                ...(typeof whoami?.UniqueName === "string" && whoami.UniqueName ? { uniqueName: whoami.UniqueName } : {}),
+                ...(typeof whoami?.DisplayName === "string" && whoami.DisplayName ? { displayName: whoami.DisplayName } : {}),
+            };
         }
         if (response.status === 401 || response.status === 403)
-            return false;
+            return null;
         throw new BrowserAuthTransportError(`Token validation temporarily failed with HTTP ${response.status}.`);
     }
     /** Restore first, and only attempt credentials after a real sign-in is needed. */

package/build/auth/session-store.js

@@ -31,6 +31,8 @@ function validToken(value) {
         && (token.source === "browser" || token.source === "cache")
         && (token.cookieHeader === undefined || typeof token.cookieHeader === "string")
         && (token.csrfToken === undefined || typeof token.csrfToken === "string")
+        && (token.uniqueName === undefined || typeof token.uniqueName === "string")
+        && (token.displayName === undefined || typeof token.displayName === "string")
         && validTenantOrigin(token.tenantOrigin);
 }
 function equalToken(a, b) {
@@ -174,6 +176,28 @@ export class SessionStore {
             this.storeError("load", error);
         }
     }
+    /**
+     * Read-only sibling of load(): same decode (legacy-upgrade validation and
+     * native-key decrypt included), but never takes the write lock and never
+     * writes back a migrated version 1 record. load() upgrades a legacy file
+     * in place as a side effect of reading it; callers that just want to know
+     * "what identity/token is on disk right now" (get_server_info's
+     * signedInAs, say) should not silently rewrite session.json or contend
+     * with an in-flight sign-in for the write lock just to answer that.
+     */
+    async peek() {
+        try {
+            const record = await this.readFile();
+            if (!record)
+                return null;
+            if (record.version === 1)
+                await this.assertLegacyUpgradePending();
+            return await this.decode(record);
+        }
+        catch (error) {
+            this.storeError("load", error);
+        }
+    }
     async clear() {
         try {
             await this.withWriteLock(async () => {

package/build/auth/token-manager.js

@@ -171,6 +171,11 @@ export class TokenManager {
                 source: "browser",
                 cookieHeader: stale.cookieHeader,
                 csrfToken: stale.csrfToken,
+                // The cookie mint only returns a JWT, not an identity; carry the
+                // uniqueName/displayName the original browser login captured
+                // forward so an hourly HTTP re-mint doesn't erase signedInAs.
+                uniqueName: stale.uniqueName,
+                displayName: stale.displayName,
             };
             if (!await this.sessionStore.saveIfCurrent(token, stale))
                 return this.afterConcurrentChange();

package/build/index.js

@@ -16,7 +16,7 @@ import { startUpdateChecks } from "./utils/update-checker.js";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-import { registerGetMyCourses, registerGetUpcomingDueDates, registerGetCalendarEvents, registerGetMyGrades, registerGetAnnouncements, registerGetAssignments, registerGetAssignmentFiles, registerGetAnnouncementFiles, registerGetCourseContent, registerDownloadFile, registerGetClasslistEmails, registerGetRoster, registerGetSyllabus, registerGetDiscussions, registerGetVideoTranscript, registerGetServerInfo, } from "./tools/index.js";
+import { registerGetMyCourses, registerGetUpcomingDueDates, registerGetCalendarEvents, registerGetMyGrades, registerGetAnnouncements, registerGetAssignments, registerGetAssignmentFiles, registerGetAnnouncementFiles, registerGetCourseContent, registerDownloadFile, registerGetClasslistEmails, registerGetRoster, registerGetMyGroups, registerGetSyllabus, registerGetDiscussions, registerGetVideoTranscript, registerGetServerInfo, } from "./tools/index.js";
 import { registerWeeklyBriefingPrompt, registerGradeAuditPrompt, registerStudyPlannerPrompt, registerCourseSummaryPrompt, } from "./prompts/index.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -128,11 +128,12 @@ else {
             registerDownloadFile(server, apiClient);
             registerGetClasslistEmails(server, apiClient);
             registerGetRoster(server, apiClient);
+            registerGetMyGroups(server, apiClient);
             registerGetSyllabus(server, apiClient);
             registerGetDiscussions(server, apiClient);
             registerGetVideoTranscript(server, apiClient);
             registerGetServerInfo(server, config, PKG_VERSION, apiClient);
-            log("DEBUG", "MCP tools registered (16 tools)");
+            log("DEBUG", "MCP tools registered (17 tools)");
             // Register MCP prompts — surfaced in clients (e.g. Claude Desktop) as a
             // picker, distinct from tools. Each one is a canned user message that
             // names our own tools by name, so a client with no idea what to ask
@@ -145,7 +146,7 @@ else {
             // Connect stdio transport
             const transport = new StdioServerTransport();
             await server.connect(transport);
-            log("INFO", "Brightspace MCP Server by Rohan Muppa — running on stdio (16 tools, 4 prompts registered)");
+            log("INFO", "Brightspace MCP Server by Rohan Muppa — running on stdio (17 tools, 4 prompts registered)");
             log("INFO", "Setup: see README.md for MCP client configuration (Claude Desktop, ChatGPT Desktop, Cursor, etc.)");
         }
         catch (error) {

package/build/tools/get-assignments.js

@@ -11,6 +11,7 @@ import { convertHtmlToMarkdown } from "../utils/html-converter.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
 import { assignmentUrl, gradebookUrl, quizUrl } from "../utils/deep-links.js";
+import { dueIn } from "../utils/due-in.js";
 /** The display HTML of a quiz rich-text field, nested shape or flat. */
 function richTextHtml(field) {
     if (!field)
@@ -165,6 +166,7 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                     ? convertHtmlToMarkdown(folder.CustomInstructions.Html).markdown
                     : "",
                 dueDate: folder.DueDate,
+                dueIn: dueIn(folder.DueDate),
                 points: folder.Assessment?.ScoreDenominator ?? null,
                 isGroup: folder.GroupTypeId !== null,
                 rubric: folder.Assessment?.Rubrics?.map((r) => ({
@@ -288,6 +290,7 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                 ? convertHtmlToMarkdown(descriptionHtml).markdown
                 : "",
             dueDate: quiz.DueDate,
+            dueIn: dueIn(quiz.DueDate),
             startDate: quiz.StartDate,
             endDate: quiz.EndDate,
             timeLimit: timeLimit?.IsEnforced ? timeLimit.TimeLimitValue : null,
@@ -349,6 +352,7 @@ function gradebookHeadsUp(raw, fetched, courseId, baseUrl) {
             // Always null: a grade column carries no due date of its own, and
             // inventing one from the column name would be a guess.
             dueDate: null,
+            dueIn: null,
             url: baseUrl ? gradebookUrl(baseUrl, courseId) : null,
         });
     }

package/build/tools/get-my-groups.js

@@ -0,0 +1,122 @@
+/**
+ * Purdue Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+import { DEFAULT_CACHE_TTLS } from "../api/index.js";
+import { ApiError } from "../api/errors.js";
+import { GetMyGroupsSchema } from "./schemas.js";
+import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { fetchClasslistUsers } from "./get-roster.js";
+import { log } from "../utils/logger.js";
+/** True when a group/category endpoint simply isn't there for this course or user. */
+function isMissingOrForbidden(error) {
+    return error instanceof ApiError && (error.status === 403 || error.status === 404);
+}
+/**
+ * Register get_my_groups tool
+ */
+export function registerGetMyGroups(server, apiClient) {
+    server.registerTool("get_my_groups", {
+        title: "Get My Groups",
+        description: "List the current user's project/discussion groups in a course, with each group's members. " +
+            "Use this when a student asks who is in their project group, lab group, or discussion group.",
+        inputSchema: GetMyGroupsSchema,
+    }, async (args) => {
+        try {
+            log("DEBUG", "get_my_groups tool called", { args });
+            const { courseId } = GetMyGroupsSchema.parse(args);
+            const me = await apiClient.get(apiClient.lp("/users/whoami"));
+            const myId = Number(me.Identifier);
+            let categories;
+            try {
+                categories = await apiClient.get(apiClient.lp(`/${courseId}/groupcategories/`), { ttl: DEFAULT_CACHE_TTLS.roster });
+            }
+            catch (error) {
+                if (isMissingOrForbidden(error)) {
+                    log("INFO", "get_my_groups: No group categories visible for course", { courseId });
+                    return toolResponse({
+                        courseId,
+                        groups: [],
+                        note: "No groups are visible for this course (it may not use groups, or group info isn't accessible).",
+                    });
+                }
+                throw error;
+            }
+            // Membership is determined first, from GroupDto.Enrollments alone —
+            // no classlist needed for that. The classlist (for member names) is
+            // fetched lazily, only once we know the user is actually in at least
+            // one group, so a user in no groups never pays for a roster fetch.
+            const matches = [];
+            for (const category of categories) {
+                let categoryGroups;
+                try {
+                    categoryGroups = await apiClient.get(apiClient.lp(`/${courseId}/groupcategories/${category.GroupCategoryId}/groups/`), { ttl: DEFAULT_CACHE_TTLS.roster });
+                }
+                catch (error) {
+                    if (isMissingOrForbidden(error)) {
+                        log("WARN", "get_my_groups: Groups not accessible for category, skipping", {
+                            courseId,
+                            categoryId: category.GroupCategoryId,
+                        });
+                        continue;
+                    }
+                    throw error;
+                }
+                for (const group of categoryGroups) {
+                    const enrollments = group.Enrollments ?? [];
+                    if (!enrollments.includes(myId))
+                        continue;
+                    matches.push({ category, group });
+                }
+            }
+            if (matches.length === 0) {
+                log("INFO", `get_my_groups: User is not a member of any group in course ${courseId}`);
+                return toolResponse({
+                    courseId,
+                    groups: [],
+                    note: "Group categories exist for this course, but the current user is not a member of any group.",
+                });
+            }
+            // Best-effort classlist for member names. A course where the current
+            // user lacks classlist access still returns groups, just with
+            // member names left null instead of failing the whole request.
+            // Identifier comes back from D2L as a string on real tenants, even
+            // though it looks numeric, so it must be coerced before it can be
+            // used as a key alongside the numeric Enrollments ids.
+            let classlistById = new Map();
+            try {
+                const classlist = await fetchClasslistUsers(apiClient, courseId);
+                classlistById = new Map(classlist.map((u) => [Number(u.Identifier), u]));
+            }
+            catch (error) {
+                if (isMissingOrForbidden(error)) {
+                    log("INFO", "get_my_groups: Classlist not accessible, member names will be null", { courseId });
+                }
+                else {
+                    throw error;
+                }
+            }
+            const groups = matches.map(({ category, group }) => {
+                const enrollments = group.Enrollments ?? [];
+                const members = enrollments.map((userId) => ({
+                    userId,
+                    name: classlistById.get(userId)?.DisplayName ?? null,
+                }));
+                return {
+                    categoryId: category.GroupCategoryId,
+                    categoryName: category.Name,
+                    groupId: group.GroupId,
+                    groupName: group.Name,
+                    ...(group.Code ? { groupCode: group.Code } : {}),
+                    members,
+                };
+            });
+            log("INFO", `get_my_groups: Found ${groups.length} groups for course ${courseId}`);
+            return toolResponse({ courseId, groups });
+        }
+        catch (error) {
+            return sanitizeError(error);
+        }
+    });
+}

package/build/tools/get-roster.js

@@ -14,9 +14,13 @@ import { log } from "../utils/logger.js";
 const INSTRUCTOR_ROLE_ID = 109;
 const TA_ROLE_ID = 135;
 /**
- * Fetch every classlist user matching the optional filters, across all pages
+ * Fetch every classlist user matching the optional filters, across all pages.
+ *
+ * Exported so other tools that need names for a course's enrolled users
+ * (e.g. get_my_groups resolving group membership) can reuse this instead of
+ * re-implementing the paged classlist fetch.
  */
-async function fetchClasslistUsers(apiClient, courseId, options) {
+export async function fetchClasslistUsers(apiClient, courseId, options) {
     const params = new URLSearchParams();
     if (options?.roleId !== undefined) {
         params.append("roleId", options.roleId.toString());

package/build/tools/get-server-info.js

@@ -4,13 +4,43 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { readMicrosoftSession } from "../auth/microsoft-session.js";
+import { SessionStore } from "../auth/session-store.js";
 import { getConfigStorePath } from "../utils/config-store.js";
 import { GetServerInfoSchema } from "./schemas.js";
 import { toolResponse } from "./tool-helpers.js";
+/**
+ * Read whatever non-secret identity the persisted session carries, straight
+ * off disk. This is local file + native keyring access only (no network),
+ * and never throws: a locked keyring or a corrupted/absent session file just
+ * means "don't report an identity", not a failed tool call. Identity is
+ * reported regardless of whether the underlying token itself is still valid
+ * — it answers "who last signed in", not "is that session still usable".
+ *
+ * Uses SessionStore.peek() rather than load(): load() silently upgrades a
+ * legacy version-1 session file in place (a write) the first time anything
+ * reads it, and this tool is called just to report status, often repeatedly
+ * and never as part of establishing a session. A read-only status check
+ * should not be the thing that migrates on-disk session state.
+ */
+async function defaultReadSignedInIdentity(sessionDir) {
+    try {
+        const token = await new SessionStore(sessionDir).peek();
+        if (!token || (!token.uniqueName && !token.displayName))
+            return null;
+        return {
+            ...(token.uniqueName ? { uniqueName: token.uniqueName } : {}),
+            ...(token.displayName ? { displayName: token.displayName } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Register get_server_info tool.
  *
- * Answers from the startup config alone: no network call, so it can never
+ * Answers from the startup config alone, plus a local (non-network) read of
+ * the persisted session for signedInAs: no network call, so it can never
  * trigger a sign-in. hasStoredCredential reflects the keychain lookup made at
  * startup, which is the credential this process actually holds.
  * microsoftSession comes from the plain summary saved beside the browser
@@ -18,14 +48,21 @@ import { toolResponse } from "./tool-helpers.js";
  * client's own lightweight counters (apiClient.stats()) — a snapshot of
  * what has happened so far this process, not a network call of its own.
  * Nothing secret — password, username, token, cookie — is ever included.
+ *
+ * readSignedInIdentity is an injection seam: production leaves it to read
+ * the real encrypted session store (native keyring and all), tests supply a
+ * fake so they never have to touch native credential storage.
  */
-export function registerGetServerInfo(server, config, version, apiClient) {
+export function registerGetServerInfo(server, config, version, apiClient, readSignedInIdentity = () => defaultReadSignedInIdentity(config.sessionDir)) {
     server.registerTool("get_server_info", {
         title: "Get Server Info",
-        description: "Report which version of the Brightspace MCP server is running, the Node.js runtime, platform, config file path, session state directory, configured school URL, whether a credential is stored, (once a browser sign-in has been saved) what Microsoft remembered: stay-signed-in and the Don't ask again MFA checkbox, and this process's request counters (requests: responses by status class, network errors, cache hits/misses, coalesced joins, and token refreshes). Use this for troubleshooting or when the user asks which version they have. Never contacts Brightspace and never returns secrets.",
+        description: "Report which version of the Brightspace MCP server is running, the Node.js runtime, platform, config file path, session state directory, configured school URL, whether a credential is stored, the server's local timezone and UTC offset, (once a browser sign-in has been saved) what Microsoft remembered: stay-signed-in and the Don't ask again MFA checkbox, (when signed in) the account's uniqueName/displayName as signedInAs, and this process's request counters (requests: responses by status class, network errors, cache hits/misses, coalesced joins, and token refreshes). Use this for troubleshooting, when the user asks which version they have, or what timezone/account dates are being computed against. Never contacts Brightspace and never returns secrets.",
         inputSchema: GetServerInfoSchema,
     }, async () => {
-        const microsoftSession = await readMicrosoftSession(config.sessionDir);
+        const [microsoftSession, signedInAs] = await Promise.all([
+            readMicrosoftSession(config.sessionDir),
+            readSignedInIdentity(),
+        ]);
         return toolResponse({
             version,
             node: process.version,
@@ -35,7 +72,15 @@ export function registerGetServerInfo(server, config, version, apiClient) {
             sessionStatePath: config.sessionDir,
             schoolUrl: config.baseUrl,
             hasStoredCredential: config.password !== undefined,
+            localTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+            // Minutes the local clock is ahead of UTC (the inverse sign of
+            // Date#getTimezoneOffset, which is "minutes behind UTC"). On a UTC
+            // runner getTimezoneOffset() is 0, so negating it yields -0; `|| 0`
+            // normalizes that back to 0 so Object.is-based equality (toBe(0) in
+            // tests, and any JSON consumer that cares) sees a plain zero.
+            utcOffsetMinutes: -new Date().getTimezoneOffset() || 0,
             ...(microsoftSession && { microsoftSession }),
+            ...(signedInAs && { signedInAs }),
             requests: apiClient.stats(),
         });
     });

package/build/tools/get-upcoming-due-dates.js

@@ -8,6 +8,7 @@ import { GetUpcomingDueDatesSchema, } from "./schemas.js";
 import { toolResponse, sanitizeError } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { assignmentUrl, quizUrl, discussionUrl } from "../utils/deep-links.js";
+import { dueIn } from "../utils/due-in.js";
 import { resolveCourses } from "./resolve-courses.js";
 import { fetchCourseCalendarEvents } from "./calendar-events.js";
 /** D2L list endpoints return either a paged { Objects: [...] } or a flat array. */
@@ -55,6 +56,7 @@ function calendarItems(events, items) {
         courseId: event.courseId,
         courseName: event.courseName,
         dueDate: event.start,
+        dueIn: dueIn(event.start),
         startDate: null,
         endDate: event.end ?? null,
         ...(event.location ? { location: event.location } : {}),
@@ -91,6 +93,7 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
                 courseId: course.id,
                 courseName: course.name,
                 dueDate: folder.DueDate,
+                dueIn: dueIn(folder.DueDate),
                 startDate: null,
                 endDate: null,
                 url: assignmentUrl(baseUrl, course.id, folder.Id),
@@ -116,6 +119,7 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
                 courseId: course.id,
                 courseName: course.name,
                 dueDate,
+                dueIn: dueIn(dueDate),
                 startDate: quiz.StartDate ?? null,
                 endDate: quiz.EndDate ?? null,
                 url: quizUrl(baseUrl, course.id, quiz.QuizId),
@@ -138,6 +142,7 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
                 courseId: course.id,
                 courseName: course.name,
                 dueDate: topic.DueDate,
+                dueIn: dueIn(topic.DueDate),
                 startDate: null,
                 endDate: null,
                 url: discussionUrl(baseUrl, course.id, topic.TopicId),

package/build/tools/index.js

@@ -16,6 +16,7 @@ export { registerGetCourseContent } from "./get-course-content.js";
 export { registerDownloadFile } from "./download-file.js";
 export { registerGetClasslistEmails } from "./get-classlist-emails.js";
 export { registerGetRoster } from "./get-roster.js";
+export { registerGetMyGroups } from "./get-my-groups.js";
 export { registerGetSyllabus } from "./get-syllabus.js";
 export { registerGetDiscussions } from "./get-discussions.js";
 export { registerGetVideoTranscript } from "./get-video-transcript.js";

package/build/tools/schemas.js

@@ -137,4 +137,8 @@ export const GetRosterSchema = z.object({
     limit: z.coerce.number().int().positive().max(1000).default(100)
         .describe("Maximum users to return. Default 100. The response reports the true total and whether it was truncated."),
 });
+export const GetMyGroupsSchema = z.object({
+    courseId: z.coerce.number().int().positive()
+        .describe("Course ID to list the current user's project/discussion groups for."),
+});
 export const GetServerInfoSchema = z.object({});

package/build/utils/due-in.js

@@ -0,0 +1,41 @@
+/**
+ * Purdue Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+const MINUTE_MS = 60 * 1000;
+const HOUR_MS = 60 * MINUTE_MS;
+const DAY_MS = 24 * HOUR_MS;
+const WEEK_MS = 7 * DAY_MS;
+const relativeTimeFormat = new Intl.RelativeTimeFormat("en", { numeric: "auto" });
+/**
+ * Render a due date as a short relative phrase ("in 3 days", "yesterday",
+ * "in 2 hours") so a caller doesn't have to do date math on a raw ISO
+ * timestamp itself. Unit scales with magnitude: minutes under an hour, hours
+ * under a day, days under a week, weeks beyond that.
+ *
+ * Returns `null` for a missing or unparseable date rather than throwing —
+ * D2L-supplied date strings aren't guaranteed well-formed (same guard as
+ * JhostinAleck/brightspace-mcp's `shared-kernel/date/parseValidDate.ts`, MIT).
+ *
+ * `now` defaults to `Date.now()`; tests pin it with fake timers.
+ */
+export function dueIn(dueDate, now = Date.now()) {
+    if (!dueDate)
+        return null;
+    const due = new Date(dueDate).getTime();
+    if (!Number.isFinite(due))
+        return null;
+    const diffMs = due - now;
+    const absMs = Math.abs(diffMs);
+    if (absMs < HOUR_MS) {
+        return relativeTimeFormat.format(Math.round(diffMs / MINUTE_MS), "minute");
+    }
+    if (absMs < DAY_MS) {
+        return relativeTimeFormat.format(Math.round(diffMs / HOUR_MS), "hour");
+    }
+    if (absMs < WEEK_MS) {
+        return relativeTimeFormat.format(Math.round(diffMs / DAY_MS), "day");
+    }
+    return relativeTimeFormat.format(Math.round(diffMs / WEEK_MS), "week");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.9.3",
+  "version": "3.9.5",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",