Brightspace Mcp Server

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/auth/auth-cooldown.ts, line 66

  await fs.unlink(this.file).catch(() => {});

  src/auth/auth-lock.ts, line 141

  await fs.unlink(path.join(lockPath, "owner.json")).catch(() => {});

  src/auth/auth-lock.ts, line 142

  await fs.unlink(path.join(lockPath, CHALLENGE_FILE)).catch(() => {});

  Show more

  src/auth/logout.ts, line 40

  await fs.unlink(file);

  src/auth/session-store.ts, line 240

  await fs.unlink(this.sessionFilePath);

  src/utils/atomic-write.ts, line 87

  await fs.rm(tmp, { force: true }).catch(() => {});

  src/utils/download-helpers.ts, line 182

  await fs.rm(partialPath, { force: true });

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 27

  postinstall

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/api/client.ts, line 521

  const response = await fetch(url, {

  src/api/client.ts, line 614

  const response = await fetch(url, {

  src/api/version-discovery.ts, line 33

  const response = await fetch(url, {

  Show more

  src/auth/browser-auth.ts, line 382

  response = await fetch(`${this.config.baseUrl}/d2l/api/lp/1.45/users/whoami`, {

  src/tools/get-syllabus.ts, line 109

  return { ok: true, value: await fetch() };

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/auth/auth-runner.ts, line 273

  * so both processes read the same account configuration and .env file. It

  src/tools/sign-out.ts, line 75

  your AI app's client configuration or a .env file), and sign_out cannot remove that.

  src/utils/config.ts, line 112

  const passwordless = envBoolean(process.env.D2L_PASSWORDLESS, "D2L_PASSWORDLESS")

  Show more

  src/utils/config.ts, line 117

  const tokenTtl = positiveSeconds(process.env.D2L_TOKEN_TTL, "D2L_TOKEN_TTL")

  src/utils/config.ts, line 146

  const envAccessToken = readEnvSecret(process.env.D2L_ACCESS_TOKEN, "D2L_ACCESS_TOKEN");

  src/utils/config.ts, line 156

  // and is deliberately weaker (see .env.example) so it is never the default.

  src/utils/config.ts, line 157

  const envTotpSecret = readEnvSecret(process.env.D2L_TOTP_SECRET, "D2L_TOTP_SECRET");

  src/utils/secure-config.ts, line 76

  if (process.env.D2L_PASSWORD) {

  src/utils/secure-config.ts, line 78

  await setStoredPassword(baseUrl, username, process.env.D2L_PASSWORD);

  src/utils/self-update.ts, line 118

  env: { ...env, [REEXEC_SENTINEL]: "1" },

  .gitignore, line 2

  build/

  .npmignore, line 2

  tsconfig.json

  .npmignore, line 3

  .env

  LLMs.md, line 163

  `sign_out` (`src/tools/sign-out.ts`) calls the same `clearSavedSession(config.sessionDir)` and then `apiClient.clearCache()` and `tokenManager.forgetSession()` (drops this process'

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 8db71fa6dbba. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen