brightspace-mcp-server 5.1.39 → 5.1.41

package/README.md

@@ -30,14 +30,14 @@ Works with Claude Desktop, Claude Code, Cursor, ChatGPT Desktop, Windsurf, and a
    **On a Mac:** when Keychain asks whether `node` may use the saved Brightspace password, choose **Always Allow**, not just Allow. That lets later sign-ins (the `auth` command and questions from your AI app) read it without asking again.
 3. **Restart your AI app and ask it something** — the first question signs you in. If your phone asks you to approve a sign-in, approve it and ask again.
 
-At one of these schools, add the flag and skip typing the address: `--purdue`, `--suny`, `--western`, `--tudelft`, `--cuny`, `--leiden`, `--mcgill`, `--ngeeann`, `--javeriana`.
+At one of these schools, add the flag and skip typing the address: `--purdue`, `--suny`, `--western`, `--tudelft`, `--cuny`, `--leiden`, `--mcgill`, `--mun`, `--ngeeann`, `--javeriana`.
 
 **Rather have the AI install it for you?** Paste this into Claude Code, Cursor, Windsurf, Copilot, or Codex:
 
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, --leiden at Leiden, --mcgill at McGill, --ngeeann at Ngee Ann Polytechnic, or --javeriana at Javeriana Cali).
+(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, --leiden at Leiden, --mcgill at McGill, --mun at Memorial University, --ngeeann at Ngee Ann Polytechnic, or --javeriana at Javeriana Cali).
 ```
 
 The AI does everything it can by itself: it checks your computer, downloads the browser sign-in uses, and connects your AI apps. Then it gives you one command to run in a terminal. That command asks for your password and waits for you to approve the sign-in on your phone. That's the only part that needs you. Afterwards the AI checks that it can see your courses.
@@ -57,6 +57,7 @@ If your school uses D2L Brightspace, yes. These have automatic sign-in built in:
 | CUNY | CUNY Login, authenticator code each time | `--cuny` |
 | Leiden University | SURFconext → Microsoft | `--leiden` |
 | McGill University | Microsoft Entra | `--mcgill` |
+| Memorial University of Newfoundland | MUN Login (CAS, no two-factor when tested) | `--mun` |
 | Javeriana Cali | OneGate (password + authenticator code) | `--javeriana` |
 | Ngee Ann Polytechnic | Microsoft Entra | `--ngeeann` |
 | Any other D2L school | Paste your Brightspace address. If the login page isn't recognized, pick option 2 at setup's sign-in question so the page opens for you to finish by hand | none |

package/build/auth/mun-sso.js

@@ -0,0 +1,128 @@
+/** Memorial University of Newfoundland (MUN) login entry point. Licensed under MIT; see LICENSE. */
+import { log } from "../utils/logger.js";
+import { SETUP_COMMAND } from "../utils/commands.js";
+import { BrowserAuthError } from "../utils/errors.js";
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
+const MUN_HOST = "online.mun.ca";
+const CAS_HOST = "login.mun.ca";
+const ENTRA_HOST = "login.microsoftonline.com";
+const SELECTORS = {
+    loginButton: "#mun-login",
+    username: "input#username",
+    password: "input#password",
+    submit: 'button[name="submitBtn"]',
+};
+const POLL_MS = 500;
+const HEADLESS_TIMEOUT_MS = 60_000;
+/** A visible window may have a person finishing a page this flow does not know. */
+const VISIBLE_TIMEOUT_MS = 5 * 60 * 1000;
+export function isMunBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === MUN_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function secureHost(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" ? parsed.hostname.toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * MUN's Brightspace lands on its own page at /d2l/loginh/, whose "MUN Login"
+ * button leads to MUN's CAS server, not to SAML or Microsoft:
+ *
+ *   /d2l/loginh/ -> /d2l/custom/cas -> login.mun.ca/cas/login -> /d2l/home
+ *
+ * The default flow never clicks that button, and CAS's plain `username` field
+ * matches none of its username selectors. Seen live on 2026-11-05.
+ *
+ * If MUN ever sends the login on to Microsoft, the shared flow takes over from
+ * there, which answers "Stay signed in?", "Don't ask again" and code prompts.
+ */
+export class MunSSOFlow {
+    common;
+    config;
+    constructor(config) {
+        this.config = config;
+        this.common = new PurdueSSOFlow(config);
+    }
+    hasCredentials() {
+        return this.common.hasCredentials();
+    }
+    rememberMfaResult() {
+        return this.common.rememberMfaResult();
+    }
+    /** Called on every poll, so a button that has not rendered yet is simply tried again. */
+    async prepareLogin(page) {
+        if (secureHost(page.url()) !== MUN_HOST || !new URL(page.url()).pathname.startsWith("/d2l/login"))
+            return;
+        const button = page.locator(SELECTORS.loginButton).first();
+        if (await button.isVisible().catch(() => false)) {
+            log("DEBUG", "Clicked the MUN Login button");
+            await button.click().catch(() => { });
+        }
+    }
+    async login(page) {
+        const deadline = Date.now() + (this.config.headless === false ? VISIBLE_TIMEOUT_MS : HEADLESS_TIMEOUT_MS);
+        let submitted = false;
+        let navigatedAfterSubmit = false;
+        const onNavigated = (frame) => {
+            if (submitted && frame === page.mainFrame())
+                navigatedAfterSubmit = true;
+        };
+        page.on("framenavigated", onNavigated);
+        try {
+            while (Date.now() < deadline) {
+                const host = secureHost(page.url());
+                if (host === MUN_HOST && /^\/d2l\/home(?:\/|$)/.test(new URL(page.url()).pathname))
+                    return true;
+                if (host === ENTRA_HOST)
+                    return await this.common.login(page);
+                await this.prepareLogin(page);
+                // Never type the password into anything but MUN's own login server.
+                if (host === CAS_HOST && await page.locator(SELECTORS.password).first().isVisible().catch(() => false)) {
+                    // The form coming back means CAS said no. Sending it again would only
+                    // count toward a lockout.
+                    if (navigatedAfterSubmit) {
+                        throw new BrowserAuthError(`MUN Login rejected the saved username or password. Run \`${SETUP_COMMAND} --mun\` to update them.`, "credentials");
+                    }
+                    if (!submitted) {
+                        submitted = true;
+                        await this.enterCredentials(page);
+                    }
+                }
+                await page.waitForTimeout(POLL_MS);
+            }
+        }
+        catch (error) {
+            if (error instanceof BrowserAuthError)
+                throw error;
+            throw new UnsupportedAuthenticationError("MUN Login could not complete automatic sign-in.", error);
+        }
+        finally {
+            page.off("framenavigated", onNavigated);
+        }
+        throw new UnsupportedAuthenticationError("MUN sign-in did not reach Brightspace. MUN may have changed its login pages or asked for a second factor; set D2L_HEADLESS=false to finish sign-in in the browser.");
+    }
+    async enterCredentials(page) {
+        if (!this.config.username)
+            throw new BrowserAuthError("Username is required for SSO login", "credentials");
+        if (!this.config.password)
+            throw new BrowserAuthError("Password is required for SSO login", "credentials");
+        log("INFO", "Entering MUN Login credentials");
+        await page.locator(SELECTORS.username).first().fill(this.config.username);
+        // Re-check right before the password goes in, in case the page moved since the poll.
+        if (secureHost(page.url()) !== CAS_HOST)
+            return;
+        await page.locator(SELECTORS.password).first().fill(this.config.password);
+        // CAS answers with a full navigation, which can detach the button.
+        await page.locator(SELECTORS.submit).first().click().catch(() => { });
+    }
+}

package/build/auth/sso-flow.js

@@ -11,6 +11,7 @@ import { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
 import { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 import { McgillSSOFlow, isMcgillBrightspace } from "./mcgill-sso.js";
 import { JaverianaSSOFlow, isJaverianaBrightspace } from "./javeriana-sso.js";
+import { MunSSOFlow, isMunBrightspace } from "./mun-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -90,5 +91,8 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge, onAutomati
     if (isJaverianaBrightspace(config.baseUrl)) {
         return new JaverianaSSOFlow(credentials);
     }
+    if (isMunBrightspace(config.baseUrl)) {
+        return new MunSSOFlow(credentials);
+    }
     return new PurdueSSOFlow(credentials);
 }

package/build/setup/presets.js

@@ -60,6 +60,12 @@ export const SCHOOL_PRESETS = {
         mfaNote: "Approve the sign-in request from your MFA app.",
         usernameHint: "Use your full sign-in address if your McGill account requires it.",
     },
+    mun: {
+        name: "Memorial University of Newfoundland",
+        baseUrl: "https://online.mun.ca",
+        usernameLabel: "MUN Login ID",
+        mfaNote: "MUN Login normally runs headlessly without MFA.",
+    },
     javeriana: {
         name: "Pontificia Universidad Javeriana Cali",
         baseUrl: "https://auladigital.javerianacali.edu.co",

package/build/tools/get-assignment-rubric.js

@@ -5,7 +5,7 @@
  */
 import { ApiError, DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { GetAssignmentRubricSchema } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, throwIfCredentialRejected } from "./tool-helpers.js";
 import { feedbackText } from "../utils/feedback.js";
 import { log } from "../utils/logger.js";
 // D2L's documented SCORING_M enumeration
@@ -216,13 +216,21 @@ export async function fetchAssignmentRubrics(apiClient, courseId, assignmentId)
             rubrics = Array.isArray(raw) ? raw : raw?.Objects ?? [];
         }
         catch (error) {
-            if (error instanceof ApiError && (error.status === 403 || error.status === 404)) {
-                rubrics = [];
-            }
-            else {
-                log("DEBUG", `Failed to fetch rubrics for assignment ${assignmentId} via the rubrics endpoint`, error);
-                rubrics = [];
+            throwIfCredentialRejected(error);
+            if (!(error instanceof ApiError && (error.status === 403 || error.status === 404))) {
+                // Only a 403/404 means "nothing to show here". Anything else (5xx,
+                // timeout, network) leaves it unknown whether a rubric is attached,
+                // so it must never be reported as "no rubric".
+                log("INFO", `get_assignment_rubric: Rubrics for assignment ${assignmentId} in course ${courseId} could not be read`, error);
+                return {
+                    rubrics: [],
+                    rubricsUnreadable: true,
+                    note: "The rubric for this assignment could not be read from Brightspace, so it may still have one. " +
+                        "Do not report the assignment as having no rubric: call get_assignment_rubric again, or check " +
+                        "the assignment in Brightspace.",
+                };
             }
+            rubrics = [];
         }
     }
     if (rubrics.length === 0) {
@@ -257,7 +265,7 @@ export function registerGetAssignmentRubric(server, apiClient) {
     server.registerTool("get_assignment_rubric", {
         title: "Get Assignment Rubric",
         annotations: { readOnlyHint: true },
-        description: "Fetch the full grading rubric for a dropbox assignment: every criteria group, criterion, and achievement level with its points and description, plus the student's own graded outcome per criterion once it has been released. Use this when the user asks what a rubric wants, how an assignment will be graded, or why they got a particular score on a criterion.",
+        description: "Fetch the full grading rubric for a dropbox assignment: every criteria group, criterion, and achievement level with its points and description, plus the student's own graded outcome per criterion once it has been released. If the rubric lookup fails with anything but a 403/404, rubricsUnreadable is true and an empty rubrics list is not proof the assignment has no rubric. Use this when the user asks what a rubric wants, how an assignment will be graded, or why they got a particular score on a criterion.",
         inputSchema: GetAssignmentRubricSchema,
     }, async (args) => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.39",
+  "version": "5.1.41",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",
@@ -92,6 +92,7 @@
     "cuny",
     "leiden",
     "mcgill",
+    "mun",
     "javeriana",
     "ngee-ann"
   ]