infinitecampus-mcp 2.3.3 → 2.3.5

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Infinite Campus (Campus Parent) — grades, attendance, assignments, messages, documents",
-    "version": "2.3.3"
+    "version": "2.3.5"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Infinite Campus",
       "source": "./",
       "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents via natural language",
-      "version": "2.3.3",
+      "version": "2.3.5",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "infinitecampus-mcp",
   "displayName": "Infinite Campus",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents",
   "author": {
     "name": "Chris Hall",

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Hall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,9 @@
 # infinitecampus-mcp
 
+[![CI](https://github.com/chrischall/infinitecampus-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/chrischall/infinitecampus-mcp/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/infinitecampus-mcp)](https://www.npmjs.com/package/infinitecampus-mcp)
+[![license](https://img.shields.io/npm/l/infinitecampus-mcp)](LICENSE)
+
 MCP server for Infinite Campus (Campus Parent portal). Single-account config — linked districts are auto-discovered via CUPS SSO after login.
 
 ## Tools

package/dist/bundle.js

@@ -13,7 +13,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -34685,6 +34689,22 @@ async function runMcp(opts) {
   return server;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/errors/index.js
+var API_KEY_RE = new RegExp([
+  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
+  // OpenAI / Anthropic (incl. sk-ant-…)
+  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
+  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
+  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
+  // Slack
+  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
+  // Google API key (39 chars total)
+  "AKIA[0-9A-Z]{16}\\b",
+  // AWS access key id (20 chars total)
+  "whsec_[A-Za-z0-9]{16,}\\b"
+  // webhook signing secret (Stripe-style)
+].map((p) => `\\b${p}`).join("|"), "g");
+
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
 function textResult(data) {
   return {
@@ -34737,23 +34757,38 @@ async function loadDotenvSafely(opts = {}) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
-var MAX_AGE_ZERO_RE = /(?:^|;)\s*Max-Age\s*=\s*0\s*(?:;|$)/i;
-var EXPIRES_EPOCH_RE = /(?:^|;)\s*Expires\s*=\s*Thu,\s*01\s*Jan\s*1970/i;
+var MAX_AGE_RE = /(?:^|;)\s*Max-Age\s*=\s*(-?\d+)\s*(?:;|$)/i;
+var EXPIRES_RE = /(?:^|;)\s*Expires\s*=\s*([^;]+)/i;
+var EXPIRES_DELETION_YEAR = 2e3;
+function isDeletionCookie(entry) {
+  const maxAge = MAX_AGE_RE.exec(entry);
+  if (maxAge)
+    return Number(maxAge[1]) <= 0;
+  const expires = EXPIRES_RE.exec(entry);
+  if (expires && expires[1]) {
+    const when = new Date(expires[1].trim());
+    if (!Number.isNaN(when.getTime()))
+      return when.getUTCFullYear() < EXPIRES_DELETION_YEAR;
+  }
+  return false;
+}
+function parseNameValue(entry) {
+  const nameValue = (entry.split(";")[0] ?? "").trim();
+  const eqIdx = nameValue.indexOf("=");
+  if (eqIdx < 1)
+    return null;
+  return { name: nameValue.slice(0, eqIdx).trim(), value: nameValue.slice(eqIdx + 1).trim() };
+}
 function parseCookieJar(setCookieHeaders) {
-  const entries = setCookieHeaders == null ? [] : Array.isArray(setCookieHeaders) ? setCookieHeaders : splitSetCookie(setCookieHeaders);
+  const entries = setCookieEntries(setCookieHeaders);
   const jar = /* @__PURE__ */ new Map();
   for (const entry of entries) {
-    if (MAX_AGE_ZERO_RE.test(entry) || EXPIRES_EPOCH_RE.test(entry))
+    if (isDeletionCookie(entry))
       continue;
-    const nameValue = (entry.split(";")[0] ?? "").trim();
-    const eqIdx = nameValue.indexOf("=");
-    if (eqIdx < 1)
+    const pair = parseNameValue(entry);
+    if (!pair || !pair.value)
       continue;
-    const name = nameValue.slice(0, eqIdx).trim();
-    const value = nameValue.slice(eqIdx + 1).trim();
-    if (!value)
-      continue;
-    jar.set(name, value);
+    jar.set(pair.name, pair.value);
   }
   const cookies = {};
   for (const [k, v] of jar)
@@ -34761,6 +34796,18 @@ function parseCookieJar(setCookieHeaders) {
   const cookieHeader = [...jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
   return { cookies, cookieHeader };
 }
+function setCookieEntries(source2) {
+  if (source2 == null)
+    return [];
+  if (Array.isArray(source2))
+    return source2;
+  if (typeof source2 === "string")
+    return splitSetCookie(source2);
+  if (typeof source2.getSetCookie === "function")
+    return source2.getSetCookie();
+  const joined = source2.get("set-cookie");
+  return joined ? splitSetCookie(joined) : [];
+}
 function splitSetCookie(header) {
   return header.split(/,(?=\s*[^;,\s]+\s*=)/).map((s) => s.trim()).filter((s) => s.length > 0);
 }
@@ -34771,6 +34818,8 @@ var NonNegInt = external_exports.number().int().nonnegative();
 var NonEmptyString = external_exports.string().min(1);
 var IsoDate = external_exports.iso.date();
 var IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30");
+var NumericIdString = external_exports.string().regex(/^\d+$/, "must be a numeric id (digits only)").describe("A numeric id string (digits only), safe to interpolate into a URL path.");
+var SafePathSegment = external_exports.string().min(1).regex(/^[^/?#\s]+$/, 'must not contain "/", "?", "#", or whitespace').refine((v) => !v.includes(".."), 'must not contain ".."').describe('A single URL path segment, safe to interpolate: no "/", "..", "?", "#", or whitespace.');
 var schemaOrigin = external_exports.string().optional().describe("Portal origin (e.g. https://<vendor>.example.co) selecting which active session to use. Optional when only one session is active.");
 var schemaConfirm = external_exports.boolean().optional().describe("Must be true to proceed. Without this, the tool returns a preview.");
 var paginationSchema = {
@@ -35738,10 +35787,20 @@ async function openEncryptedFrame(sessionKey, frame) {
 
 // node_modules/@fetchproxy/server/dist/election.js
 import { createServer, Server as HttpServer } from "node:http";
+var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
+  const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
   return new Promise((resolve, reject) => {
+    let timer;
+    const clearBindTimer = () => {
+      if (timer) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+    };
     const onError = (e) => {
+      clearBindTimer();
       server.removeListener("listening", onListening);
       if (e.code === "EADDRINUSE") {
         try {
@@ -35754,11 +35813,25 @@ async function electRole(opts) {
       }
     };
     const onListening = () => {
+      clearBindTimer();
       server.removeListener("error", onError);
       resolve({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
+    if (bindTimeoutMs > 0) {
+      timer = setTimeout(() => {
+        server.removeListener("error", onError);
+        server.removeListener("listening", onListening);
+        try {
+          server.close();
+        } catch {
+        }
+        reject(new Error(`fetchproxy: bind to ${opts.host}:${opts.port} timed out after ${bindTimeoutMs}ms (port may be in a bad state)`));
+      }, bindTimeoutMs);
+      if (typeof timer.unref === "function")
+        timer.unref();
+    }
     server.listen(opts.port, opts.host);
   });
 }
@@ -35851,6 +35924,44 @@ var SessionState = class {
   }
 };
 
+// node_modules/@fetchproxy/server/dist/session-ready.js
+var SESSION_READY_TIMEOUT_MS = 3e4;
+var FetchproxySessionNotReadyError = class extends Error {
+  reason;
+  pairCode;
+  mcpId;
+  hint;
+  constructor(info) {
+    const pairing = info.pairCode !== null && info.pairCode !== "";
+    const hint = pairing ? `Open the Transporter extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
+    super(`fetchproxy: ${pairing ? "pairing not yet approved" : "no confirmed browser session"} for "${info.mcpId}". ${hint}`);
+    this.name = "FetchproxySessionNotReadyError";
+    this.reason = pairing ? "pair-required" : "not-ready";
+    this.pairCode = pairing ? info.pairCode : null;
+    this.mcpId = info.mcpId;
+    this.hint = hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+async function awaitSessionReady(ready, opts) {
+  const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
+  if (ms <= 0)
+    return ready;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new FetchproxySessionNotReadyError({ mcpId: opts.mcpId, pairCode: opts.pendingPairCode() }));
+    }, ms);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([ready, timeout]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+
 // node_modules/@fetchproxy/server/dist/host.js
 var PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost)(:|$))/i;
 var enc2 = new TextEncoder();
@@ -35938,6 +36049,29 @@ async function startHost(opts) {
           return;
         }
         if (frame.type === "hello" && frame.role === "server") {
+          const peerEdPub = fromB64(frame.identityEd25519Pub);
+          const peerSigMsg = concatBytes(enc2.encode(frame.mcpId), fromB64(frame.sessionNonce));
+          const peerSig = fromB64(frame.sessionSig);
+          let peerSigOk = false;
+          try {
+            peerSigOk = await ed25519Verify(peerEdPub, peerSigMsg, peerSig);
+          } catch {
+            peerSigOk = false;
+          }
+          if (!peerSigOk) {
+            console.warn("[fetchproxy] peer hello signature invalid \u2014 refusing registration (possible squatter)");
+            ws.close(1008, "peer hello signature invalid");
+            return;
+          }
+          const existing = peers.get(frame.mcpId);
+          if (existing && existing.ws !== ws) {
+            const existingEdPub = existing.helloFrame.identityEd25519Pub;
+            if (existingEdPub !== frame.identityEd25519Pub) {
+              console.warn("[fetchproxy] peer mcpId already mapped to a different identity \u2014 refusing (mcpId squatting)");
+              ws.close(1008, "mcpId already registered to another identity");
+              return;
+            }
+          }
           identified = "peer";
           peerMcpId = frame.mcpId;
           peers.set(frame.mcpId, { ws, helloFrame: frame });
@@ -36030,8 +36164,10 @@ async function startHost(opts) {
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
       }
-      if (identified === "peer" && peerMcpId)
-        peers.delete(peerMcpId);
+      if (identified === "peer" && peerMcpId) {
+        if (peers.get(peerMcpId)?.ws === ws)
+          peers.delete(peerMcpId);
+      }
     });
   });
   return {
@@ -36047,7 +36183,10 @@ async function startHost(opts) {
       });
     }),
     sendOwnInner: async (inner) => {
-      const session = await ownSessionReady;
+      const session = await awaitSessionReady(ownSessionReady, {
+        mcpId: opts.ownMcpId,
+        pendingPairCode: () => ownPendingPairCode
+      });
       if (!extensionWs)
         throw new Error("host: no extension connected");
       const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), inner);
@@ -36152,7 +36291,10 @@ async function startPeer(opts) {
     ws,
     session: sessionPromise,
     sendInner: async (inner) => {
-      await sessionPromise;
+      await awaitSessionReady(sessionPromise, {
+        mcpId: opts.mcpId,
+        pendingPairCode: () => pendingPairCode
+      });
       const s = session;
       const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), inner);
       ws.send(JSON.stringify(sealed));
@@ -36818,6 +36960,35 @@ var FetchproxyServer = class {
       this.keepAliveTimer = null;
     }
   }
+  /**
+   * Send an inner request frame via whichever bridge handle is active. If the
+   * send throws (e.g. `FetchproxySessionNotReadyError` — the session never
+   * confirmed), the frame never reached the bridge, so no reply will arrive:
+   * drop the just-registered pending resolver for this id (it lives in exactly
+   * one of the op maps — request ids are unique) so it doesn't leak until the
+   * server closes, then rethrow.
+   */
+  async sendInnerFrame(inner) {
+    try {
+      if (this.hostHandle) {
+        await this.hostHandle.sendOwnInner(inner);
+      } else if (this.peerHandle) {
+        await this.peerHandle.sendInner(inner);
+      }
+    } catch (err) {
+      if ("id" in inner && typeof inner.id === "number") {
+        const { id } = inner;
+        this.pending.delete(id);
+        this.pendingReadCookies.delete(id);
+        this.pendingStorage.delete(id);
+        this.pendingCapture.delete(id);
+        this.pendingRedirect.delete(id);
+        this.pendingDownload.delete(id);
+        this.pendingIdb.delete(id);
+      }
+      throw err;
+    }
+  }
   /**
    * Single bridge round-trip, wrapped by `fetchTimeoutMs` when set.
    * On timeout returns the `{ok:false, kind:'timeout'}` envelope —
@@ -36829,11 +37000,7 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve) => {
       this.pending.set(id, resolve);
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
+    await this.sendInnerFrame(inner);
     const timeoutMs = this.opts.fetchTimeoutMs;
     if (timeoutMs === void 0 || timeoutMs <= 0)
       return pending;
@@ -36862,6 +37029,51 @@ var FetchproxyServer = class {
         clearTimeout(timer);
     }
   }
+  /**
+   * FP-B2: bound a non-`fetch` verb's reply wait by `fetchTimeoutMs`.
+   *
+   * Before this, only `fetch()` raced its `pending` reply against a timer
+   * (`_fetchOnceWithTimeout`); `readCookies`, the storage reads,
+   * `capture_request_header`, `capture_redirect`, `download`, and
+   * `read_indexed_db` awaited their `pending` promise with no race, so a
+   * wedged extension hung the tool call indefinitely.
+   *
+   * `pending` is the already-registered reply promise. `pendingMap`/`id`
+   * point at the op-specific map entry so we can drop it on expiry exactly
+   * as `_fetchOnceWithTimeout` does — otherwise a late bridge reply would
+   * resolve into a stale resolver / leak. On timeout we reject with a
+   * `FetchproxyTimeoutError` (the same throwable the convenience methods
+   * already surface for fetch timeouts). `0`/unset opts out (unbounded),
+   * matching the fetch path.
+   */
+  async _withVerbTimeout(pending, pendingMap, id, url2) {
+    const timeoutMs = this.opts.fetchTimeoutMs;
+    if (timeoutMs === void 0 || timeoutMs <= 0)
+      return pending;
+    let timer;
+    const start = Date.now();
+    try {
+      return await Promise.race([
+        pending,
+        new Promise((_resolve, reject) => {
+          timer = setTimeout(() => {
+            pendingMap.delete(id);
+            reject(new FetchproxyTimeoutError({
+              url: url2,
+              timeoutMs,
+              role: this.role,
+              port: this.opts.port,
+              elapsedMs: Date.now() - start,
+              retryAttempted: false
+            }));
+          }, timeoutMs);
+        })
+      ]);
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
+  }
   /**
    * Map an `ok:false` fetch result to its typed throwable. Centralizes
    * the kind-to-error-class switch so `request()` and (via the same
@@ -37152,12 +37364,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve) => {
       this.pendingReadCookies.set(id, resolve);
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    const result = await pending;
+    await this.sendInnerFrame(inner);
+    const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
     if (!result.ok) {
       throw new FetchproxyProtocolError(result.error);
     }
@@ -37223,12 +37431,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingStorage.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
   }
   /**
    * 0.3.0+: snapshot the next outgoing request's named header. Single-
@@ -37332,12 +37536,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingCapture.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingCapture, id, `https://${opts.host}${opts.path ?? "/*"}`);
   }
   /**
    * Snapshot the redirect target URL of the next request the browser
@@ -37421,12 +37621,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingRedirect.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingRedirect, id, `https://${opts.host}${opts.path ?? "/*"}`);
   }
   /**
    * Download `url` through the BROWSER's own network stack via
@@ -37507,12 +37703,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingDownload.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingDownload, id, opts.url);
   }
   /**
    * 0.4.0+: read declared IndexedDB keys from the user's signed-in
@@ -37559,12 +37751,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingIdb.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
   }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
@@ -38000,7 +38188,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.3.3",
+  version: "2.3.5",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38042,16 +38230,16 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.5.0",
+    "@chrischall/mcp-utils": "^0.10.3",
     "@fetchproxy/bootstrap": "^1.0.0",
     "@fetchproxy/server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
-    "node-html-parser": "^7.1.0",
+    "node-html-parser": "^8.0.2",
     zod: "^4.4.3"
   },
   devDependencies: {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     esbuild: "^0.28.0",
     typescript: "^6.0.3",
@@ -39403,7 +39591,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "2.3.3"
+  version: "2.3.5"
   // x-release-please-version
 };
 if (account) {

package/dist/index.js

@@ -57,7 +57,7 @@ catch (e) {
 // actionable stderr message (banner) instead of a crash loop.
 const COMMON = {
     name: 'infinitecampus',
-    version: '2.3.3', // x-release-please-version
+    version: '2.3.5', // x-release-please-version
 };
 if (account) {
     const client = new ICClient(account, { preloaded });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinitecampus-mcp",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "mcpName": "io.github.chrischall/infinitecampus-mcp",
   "description": "Infinite Campus (Campus Parent) MCP server — multi-district read + message/document write",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -42,16 +42,16 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.5.0",
+    "@chrischall/mcp-utils": "^0.10.3",
     "@fetchproxy/bootstrap": "^1.0.0",
     "@fetchproxy/server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
-    "node-html-parser": "^7.1.0",
+    "node-html-parser": "^8.0.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     "esbuild": "^0.28.0",
     "typescript": "^6.0.3",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/infinitecampus-mcp",
     "source": "github"
   },
-  "version": "2.3.3",
+  "version": "2.3.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "infinitecampus-mcp",
-      "version": "2.3.3",
+      "version": "2.3.5",
       "transport": {
         "type": "stdio"
       },