fabi/Schulcloud-MCP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document the H5P findings

Browse Source 
docs/API.md gains the endpoint and what it returns, why `play` is the bigger
and lesser of the two, the element-by-id route found while probing, and the
per-library shapes with the traps in them — the string "true", the inline cloze
markers, the correct-option-first convention, and the UI subtrees that drown an
exercise in button labels.

CLAUDE.md's "no quiz of its own" note said a contentId was the only handle onto
the content. That was the reason nobody looked further, so it now says where to
look instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-09-17 21:39:19 +02:00
parent a0cef532c6
commit ad8ba28313
5 changed files with 81 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
README.md
View File

@@ -18,8 +18,9 @@ instance, not inferred from the upstream source.
> *"Find the material about Verschlüsselung and explain the Caesar cipher worksheet."*
> *"Summarise the routing lesson from the LF10 course."*
> *"What do I have tomorrow, and has anything been cancelled?"*
> *"Quiz me on the DIN 5008 exercise from the DK room."*
Twenty-seven tools, all read-only:
Twenty-eight tools, all read-only:
| | |
|---|---|
@@ -46,6 +47,7 @@ Twenty-seven tools, all read-only:
| `get_room` | one room: its boards, members and what you may do there |
| `list_classes` | classes ("Klassen") with their teachers, and group membership |
| `list_news` | school and course announcements |
| `get_h5p` | an H5P exercise in full: every question, option and correct answer |
| `api_get` | GET-only escape hatch for uncovered API surface |
| `untis_timetable` | the school day from **WebUntis**: lessons, Entfall, Vertretung, room changes, period notes |
| `untis_homework` | homework from WebUntis' class register — a separate list from Schulcloud's tasks |
@@ -137,6 +139,14 @@ read-only by an allowlist of five read methods rather than by "GET only". Unset
`UNTIS_*` and none of it exists — the tools are not even offered. See
[docs/AUTH.md](docs/AUTH.md).
**A quiz is one request, not a wizard.** Schulcloud has no quiz of its own, so
an exercise is an H5P element and the board hands over nothing but a content
id. The player then shows one question at a time, which makes a quiz look like
something to step through or scrape — it isn't: the endpoint the player loads
returns the whole exercise, every option and every solution. So `get_h5p`
prints all of it, `get_board` names it with its question count, and `search`
reaches the question text like any other material.
**claude.ai gets a token of its own.** Its connector stores a request header,
so `MCP_CONNECTOR_TOKEN` opens `/mcp` and nothing else — it is refused on
`/api`, which can replace the Schulcloud token — and rotates without touching
@@ -208,7 +218,7 @@ npm run typecheck
```
`npm run smoke` starts the HTTP server, connects a real MCP client over
Streamable HTTP and exercises every tool against the live account — 87 checks (89 with the index, 9 fewer without a WebUntis key)
Streamable HTTP and exercises every tool against the live account — 91 checks (93 with the index, 9 fewer without a WebUntis key)
covering the auth gate, the connector token and the secret path, the protocol handshake, every content chain, file
extraction, resources and prompts, token replacement, `api_get`'s guard rails and error handling.