brightspace-mcp-server 5.1.38 → 5.1.40

package/README.md

@@ -30,14 +30,14 @@ Works with Claude Desktop, Claude Code, Cursor, ChatGPT Desktop, Windsurf, and a
    **On a Mac:** when Keychain asks whether `node` may use the saved Brightspace password, choose **Always Allow**, not just Allow. That lets later sign-ins (the `auth` command and questions from your AI app) read it without asking again.
 3. **Restart your AI app and ask it something** — the first question signs you in. If your phone asks you to approve a sign-in, approve it and ask again.
 
-At one of these schools, add the flag and skip typing the address: `--purdue`, `--suny`, `--western`, `--tudelft`, `--cuny`, `--leiden`, `--mcgill`, `--ngeeann`, `--javeriana`.
+At one of these schools, add the flag and skip typing the address: `--purdue`, `--suny`, `--western`, `--tudelft`, `--cuny`, `--leiden`, `--mcgill`, `--mun`, `--ngeeann`, `--javeriana`.
 
 **Rather have the AI install it for you?** Paste this into Claude Code, Cursor, Windsurf, Copilot, or Codex:
 
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, --leiden at Leiden, --mcgill at McGill, --ngeeann at Ngee Ann Polytechnic, or --javeriana at Javeriana Cali).
+(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, --leiden at Leiden, --mcgill at McGill, --mun at Memorial University, --ngeeann at Ngee Ann Polytechnic, or --javeriana at Javeriana Cali).
 ```
 
 The AI does everything it can by itself: it checks your computer, downloads the browser sign-in uses, and connects your AI apps. Then it gives you one command to run in a terminal. That command asks for your password and waits for you to approve the sign-in on your phone. That's the only part that needs you. Afterwards the AI checks that it can see your courses.
@@ -57,6 +57,7 @@ If your school uses D2L Brightspace, yes. These have automatic sign-in built in:
 | CUNY | CUNY Login, authenticator code each time | `--cuny` |
 | Leiden University | SURFconext → Microsoft | `--leiden` |
 | McGill University | Microsoft Entra | `--mcgill` |
+| Memorial University of Newfoundland | MUN Login (CAS, no two-factor when tested) | `--mun` |
 | Javeriana Cali | OneGate (password + authenticator code) | `--javeriana` |
 | Ngee Ann Polytechnic | Microsoft Entra | `--ngeeann` |
 | Any other D2L school | Paste your Brightspace address. If the login page isn't recognized, pick option 2 at setup's sign-in question so the page opens for you to finish by hand | none |

package/build/auth/mun-sso.js

@@ -0,0 +1,128 @@
+/** Memorial University of Newfoundland (MUN) login entry point. Licensed under MIT; see LICENSE. */
+import { log } from "../utils/logger.js";
+import { SETUP_COMMAND } from "../utils/commands.js";
+import { BrowserAuthError } from "../utils/errors.js";
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
+const MUN_HOST = "online.mun.ca";
+const CAS_HOST = "login.mun.ca";
+const ENTRA_HOST = "login.microsoftonline.com";
+const SELECTORS = {
+    loginButton: "#mun-login",
+    username: "input#username",
+    password: "input#password",
+    submit: 'button[name="submitBtn"]',
+};
+const POLL_MS = 500;
+const HEADLESS_TIMEOUT_MS = 60_000;
+/** A visible window may have a person finishing a page this flow does not know. */
+const VISIBLE_TIMEOUT_MS = 5 * 60 * 1000;
+export function isMunBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === MUN_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function secureHost(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" ? parsed.hostname.toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * MUN's Brightspace lands on its own page at /d2l/loginh/, whose "MUN Login"
+ * button leads to MUN's CAS server, not to SAML or Microsoft:
+ *
+ *   /d2l/loginh/ -> /d2l/custom/cas -> login.mun.ca/cas/login -> /d2l/home
+ *
+ * The default flow never clicks that button, and CAS's plain `username` field
+ * matches none of its username selectors. Seen live on 2026-11-05.
+ *
+ * If MUN ever sends the login on to Microsoft, the shared flow takes over from
+ * there, which answers "Stay signed in?", "Don't ask again" and code prompts.
+ */
+export class MunSSOFlow {
+    common;
+    config;
+    constructor(config) {
+        this.config = config;
+        this.common = new PurdueSSOFlow(config);
+    }
+    hasCredentials() {
+        return this.common.hasCredentials();
+    }
+    rememberMfaResult() {
+        return this.common.rememberMfaResult();
+    }
+    /** Called on every poll, so a button that has not rendered yet is simply tried again. */
+    async prepareLogin(page) {
+        if (secureHost(page.url()) !== MUN_HOST || !new URL(page.url()).pathname.startsWith("/d2l/login"))
+            return;
+        const button = page.locator(SELECTORS.loginButton).first();
+        if (await button.isVisible().catch(() => false)) {
+            log("DEBUG", "Clicked the MUN Login button");
+            await button.click().catch(() => { });
+        }
+    }
+    async login(page) {
+        const deadline = Date.now() + (this.config.headless === false ? VISIBLE_TIMEOUT_MS : HEADLESS_TIMEOUT_MS);
+        let submitted = false;
+        let navigatedAfterSubmit = false;
+        const onNavigated = (frame) => {
+            if (submitted && frame === page.mainFrame())
+                navigatedAfterSubmit = true;
+        };
+        page.on("framenavigated", onNavigated);
+        try {
+            while (Date.now() < deadline) {
+                const host = secureHost(page.url());
+                if (host === MUN_HOST && /^\/d2l\/home(?:\/|$)/.test(new URL(page.url()).pathname))
+                    return true;
+                if (host === ENTRA_HOST)
+                    return await this.common.login(page);
+                await this.prepareLogin(page);
+                // Never type the password into anything but MUN's own login server.
+                if (host === CAS_HOST && await page.locator(SELECTORS.password).first().isVisible().catch(() => false)) {
+                    // The form coming back means CAS said no. Sending it again would only
+                    // count toward a lockout.
+                    if (navigatedAfterSubmit) {
+                        throw new BrowserAuthError(`MUN Login rejected the saved username or password. Run \`${SETUP_COMMAND} --mun\` to update them.`, "credentials");
+                    }
+                    if (!submitted) {
+                        submitted = true;
+                        await this.enterCredentials(page);
+                    }
+                }
+                await page.waitForTimeout(POLL_MS);
+            }
+        }
+        catch (error) {
+            if (error instanceof BrowserAuthError)
+                throw error;
+            throw new UnsupportedAuthenticationError("MUN Login could not complete automatic sign-in.", error);
+        }
+        finally {
+            page.off("framenavigated", onNavigated);
+        }
+        throw new UnsupportedAuthenticationError("MUN sign-in did not reach Brightspace. MUN may have changed its login pages or asked for a second factor; set D2L_HEADLESS=false to finish sign-in in the browser.");
+    }
+    async enterCredentials(page) {
+        if (!this.config.username)
+            throw new BrowserAuthError("Username is required for SSO login", "credentials");
+        if (!this.config.password)
+            throw new BrowserAuthError("Password is required for SSO login", "credentials");
+        log("INFO", "Entering MUN Login credentials");
+        await page.locator(SELECTORS.username).first().fill(this.config.username);
+        // Re-check right before the password goes in, in case the page moved since the poll.
+        if (secureHost(page.url()) !== CAS_HOST)
+            return;
+        await page.locator(SELECTORS.password).first().fill(this.config.password);
+        // CAS answers with a full navigation, which can detach the button.
+        await page.locator(SELECTORS.submit).first().click().catch(() => { });
+    }
+}

package/build/auth/sso-flow.js

@@ -11,6 +11,7 @@ import { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
 import { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 import { McgillSSOFlow, isMcgillBrightspace } from "./mcgill-sso.js";
 import { JaverianaSSOFlow, isJaverianaBrightspace } from "./javeriana-sso.js";
+import { MunSSOFlow, isMunBrightspace } from "./mun-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -90,5 +91,8 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge, onAutomati
     if (isJaverianaBrightspace(config.baseUrl)) {
         return new JaverianaSSOFlow(credentials);
     }
+    if (isMunBrightspace(config.baseUrl)) {
+        return new MunSSOFlow(credentials);
+    }
     return new PurdueSSOFlow(credentials);
 }

package/build/setup/presets.js

@@ -60,6 +60,12 @@ export const SCHOOL_PRESETS = {
         mfaNote: "Approve the sign-in request from your MFA app.",
         usernameHint: "Use your full sign-in address if your McGill account requires it.",
     },
+    mun: {
+        name: "Memorial University of Newfoundland",
+        baseUrl: "https://online.mun.ca",
+        usernameLabel: "MUN Login ID",
+        mfaNote: "MUN Login normally runs headlessly without MFA.",
+    },
     javeriana: {
         name: "Pontificia Universidad Javeriana Cali",
         baseUrl: "https://auladigital.javerianacali.edu.co",

package/build/tools/get-syllabus.js

@@ -5,7 +5,7 @@
  */
 import { ApiError, DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { GetSyllabusSchema } from "./schemas.js";
-import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable, throwIfCredentialRejected } from "./tool-helpers.js";
 import { convertHtmlToMarkdown } from "../utils/html-converter.js";
 import { stripD2lSessionParams } from "../utils/session-params.js";
 import { secureDownload, readBodyCapped } from "../utils/download-helpers.js";
@@ -114,7 +114,7 @@ async function discoverExternalSyllabusSources(apiClient, courseId) {
 export function registerGetSyllabus(server, apiClient) {
     server.registerTool("get_syllabus", {
         title: "Get Course Syllabus",
-        description: "Fetch the syllabus/overview text and optional attachment for a course. Returns the course overview description as markdown. When the syllabus lives in an external LTI tool (e.g. Simple Syllabus), lists those sources in externalSyllabusSources; their contents cannot be read. If some of those lookups could not be completed (e.g. permission denied), externalSyllabusDiscovery says which, and an empty result is then not proof the course has no syllabus. If downloadPath is provided, also downloads the syllabus attachment (e.g. PDF); the directory must already exist, since it is not created for you. IMPORTANT: You MUST ask the user where they want to save the file before calling this tool with a downloadPath.",
+        description: "Fetch the syllabus/overview text and optional attachment for a course. Returns the course overview description as markdown. When the syllabus lives in an external LTI tool (e.g. Simple Syllabus), lists those sources in externalSyllabusSources; their contents cannot be read. If some of those lookups could not be completed (e.g. permission denied), externalSyllabusDiscovery says which, and an empty result is then not proof the course has no syllabus. If the attachment request fails with anything but a 404, attachmentUnreadable is true and an empty hasAttachment is not proof the course has no syllabus file. If downloadPath is provided, also downloads the syllabus attachment (e.g. PDF); the directory must already exist, since it is not created for you. IMPORTANT: You MUST ask the user where they want to save the file before calling this tool with a downloadPath.",
         inputSchema: GetSyllabusSchema,
     }, async (args) => {
         try {
@@ -166,6 +166,9 @@ export function registerGetSyllabus(server, apiClient) {
             let attachmentBuffer = null;
             let attachmentFilename = "syllabus";
             let hasAttachment = false;
+            // Set when the attachment request failed for any reason but a 404, so
+            // a failed read is never reported as "this course has no attachment".
+            let attachmentUnreadable = false;
             try {
                 const response = await apiClient.getRaw(apiClient.le(courseId, "/overview/attachment"));
                 if (response.ok) {
@@ -193,11 +196,13 @@ export function registerGetSyllabus(server, apiClient) {
                 }
             }
             catch (error) {
+                throwIfCredentialRejected(error);
                 if (error instanceof ApiError && error.status === 404) {
                     hasAttachment = false;
                 }
                 else {
-                    log("DEBUG", "Could not fetch syllabus attachment", error);
+                    attachmentUnreadable = true;
+                    log("INFO", `get_syllabus: Syllabus attachment for course ${courseId} could not be read`, error);
                 }
             }
             // Extract text from PDF attachment if available
@@ -238,7 +243,9 @@ export function registerGetSyllabus(server, apiClient) {
             else if (downloadPath && !attachmentBuffer) {
                 download = {
                     success: false,
-                    error: "No attachment found for this course's syllabus.",
+                    error: attachmentUnreadable
+                        ? "The syllabus attachment could not be read from Brightspace, so nothing was saved. Try again, or download it from the course in Brightspace."
+                        : "No attachment found for this course's syllabus.",
                 };
             }
             log("INFO", `get_syllabus: Retrieved overview for course ${courseId}`);
@@ -252,6 +259,13 @@ export function registerGetSyllabus(server, apiClient) {
             else {
                 result.hasAttachment = hasAttachment;
             }
+            if (attachmentUnreadable) {
+                result.attachmentUnreadable = true;
+                result.attachmentNote =
+                    "The syllabus attachment could not be read from Brightspace, so this course may still have " +
+                        "a syllabus file. Do not report the course as having no syllabus attachment: call " +
+                        "get_syllabus again, or check the course overview in Brightspace.";
+            }
             if (download) {
                 result.download = download;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.38",
+  "version": "5.1.40",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",
@@ -92,6 +92,7 @@
     "cuny",
     "leiden",
     "mcgill",
+    "mun",
     "javeriana",
     "ngee-ann"
   ]