EduPage Keyring MCP

An MCP server that lets Claude (or any MCP client) read your EduPage school account: timetables, grades, homework, tests, absences, messages, menus and more, for every child and school you have, without ever storing your password.

You sign in once per school in Chrome, on EduPage's own page, two-factor included. Only the resulting session cookies are kept, in the macOS Keychain. Built on edupage-api.

What you can ask

• "What does each kid have tomorrow, and what's due this week?"
• "Any tests coming up for Šimon? Which topics?"
• "How are Ema's grades in Slovak this term?"
• "Did Peter get to school on time today?"
• "Summarize what the school sent in the last two weeks and flag anything I must act on."
• "Which of today's lessons are substituted for 5.C?"
• "Tell the class teacher that Ema will be absent on Friday." (Claude Desktop asks before sending)

Install

1. Get the requirements

You need macOS, Google Chrome, and uv:

brew install uv          # or: curl -LsSf https://astral.sh/uv/install.sh | sh

Nothing else to install: uvx downloads this server from PyPI and runs it in its own isolated environment.

2. Connect your client

Desktop apps need the full path to uvx; get it with which uvx. It is usually /opt/homebrew/bin/uvx (Homebrew) or /Users/YOU/.local/bin/uvx (installer script). Replace myschool with your school: the name before .edupage.org, or simply your school's whole EduPage address, such as https://myschool.edupage.org.

Claude Desktop: open Settings → Local MCP servers → Edit Config (older versions: Settings → Developer → Edit Config) and add:

{
  "mcpServers": {
    "edupage": {
      "command": "/opt/homebrew/bin/uvx",
      "args": ["edupage-keyring-mcp@latest", "--school", "myschool"]
    }
  }
}

Quit Claude Desktop (⌘Q) and reopen it.

Claude Code:

claude mcp add edupage --scope user -- uvx edupage-keyring-mcp@latest --school myschool

Codex CLI:

codex mcp add edupage -- uvx edupage-keyring-mcp@latest --school myschool

Cursor: add the Claude Desktop JSON above to ~/.cursor/mcp.json.

VS Code: .vscode/mcp.json, or MCP: Open User Configuration:

{
  "servers": {
    "edupage": {
      "type": "stdio",
      "command": "/opt/homebrew/bin/uvx",
      "args": ["edupage-keyring-mcp@latest", "--school", "myschool"]
    }
  }
}

Any other client: run uvx edupage-keyring-mcp@latest --school myschool as a stdio server.

3. Ask something

Ask Claude about school, for example "What's on the timetable tomorrow?". The first time, Claude opens your school's EduPage in a Chrome window (Claude Desktop asks you first). Sign in there the way you always do: password, two-factor or QR code. The window closes by itself, the session is saved to the macOS Keychain, and Claude answers. If macOS asks whether Python may use the Keychain, choose Always Allow.

Prefer to sign in before connecting a client? Run uvx edupage-keyring-mcp login myschool.

Options

Add these to the args list (or after --school myschool on the command line):

• Several schools: repeat --school: "--school", "first", "--school", "second". The first is the default. A school without a saved session reports AUTH_REQUIRED and does not affect the others.
• Two accounts at one school (say, as a parent and as a teacher): give each its own label, for example "--school", "myschool=teacher", and sign in to each once. The label only names its Keychain entry.
• No sign-in windows from the server: "--no-browser-signin". sign_in then reports SIGNIN_UNAVAILABLE, and you sign in with login in a terminal (see Command line).
• Attachments on EduPage file servers: if get_attachment reports REDIRECT_NOT_ALLOWED, allow that exact host with "--download-host", "cloud-4.edupage.org". Only *.edupage.org hosts are accepted.

Updates

@latest makes uvx check PyPI each time the client starts the server, so a new release is picked up on the next client restart. What changed is on the releases page.

Signing in again

A session lasts until EduPage expires it. Then Claude does the same as the first time: it gets AUTH_REQUIRED, calls sign_in, and a Chrome window opens on your school's EduPage. While you sign in, Claude waits with wait_for_sign_in, which returns as soon as you're done, and carries on with your question. No restart is needed, and you don't have to tell Claude you're done. The window waits up to 10 minutes.

Set up before version 0.2 with EDUPAGE_USERNAME? Keep it to go on using the session you saved then, or remove it and sign in once more.

Command line

edupage-keyring-mcp [serve] --school NAME[=LOGIN] [--school ...] [--download-host HOST] [--no-browser-signin]
edupage-keyring-mcp login NAME [--username LOGIN] [--timeout SECONDS]
edupage-keyring-mcp logout NAME [--username LOGIN]
edupage-keyring-mcp status --school NAME [...]
edupage-keyring-mcp probe --school NAME [...]   # every read tool once; statuses and counts only

Run each with uvx edupage-keyring-mcp@latest .... logout removes the local session only; EduPage itself is not logged out. probe is handy when reporting a problem: its output contains no school data.

Features

36 tools. Each takes an optional school. Child tools take child: a first name (accents optional, so simon finds Šimon), full name, student ID, or the ref from list_children.

Account and children

Timetables

Grades and the timeline

Timeline tools look back up to 90 days (default 30). Every item has for_children: which of your children it is addressed to, by name or class. With child set, items addressed to a sibling are left out.

Messages

People and school data

get_students, get_all_students, find_student, get_teachers (IDs for send_message), get_classes, get_classrooms, get_subjects.

Meals

get_meals: a child's menu, allergens and current order, or MEALS_NOT_AVAILABLE when the school has no canteen module.

Actions

These are marked destructiveHint; clients such as Claude Desktop ask before each call.

Security model

• No password anywhere. It is typed only into EduPage's page in a throwaway Chrome window. The Keychain item holds EduPage session cookies, the account ID and the login name EduPage reports. No username is needed either. The server refuses to start if any EDUPAGE_* environment variable other than the optional EDUPAGE_USERNAME label is set.
• Sign-in from the server stays local. sign_in takes only a configured school and runs the same login command in a separate process. It opens a window only when the saved session is missing or expired, at most one per school at a time, and returns only that command's status code. The window shows EduPage's real login page, so the most a misbehaving model can do is open it. Turn it off with --no-browser-signin.
• Keychain only. On anything but the macOS Keychain backend the server refuses to run, so sessions never land in a plaintext keyring file.
• Confined network. edupage-api gets a replacement session that allows HTTPS to your configured school host only, checks every redirect hop, caps every response at 8 MB (attachments at 3 MB) and ignores proxy and .netrc settings. Cookies loaded from the Keychain are validated for that host first.
• Narrow inputs. No tool accepts a URL, cookie, session ID, header or password. Dates are ISO and window-limited. school only picks a configured school. Attachments are fetched by file id; the model never sees their URLs.
• Each child call picks its child. EduPage remembers which child a parent session last selected, and some pages (grades, menus) show that child. So every child-scoped call selects its own child immediately before reading, under a per-school lock; if selecting fails, the session is dropped. Pages for the parent (timeline, messages, sending) are not affected by the selection: a message sent after selecting a child still comes from the parent.
• Quiet errors. Failures return fixed codes (and at most an exception class name), never server pages or messages.
• Untrusted content. All school text is labelled untrusted_content.
• Pinned EduPage library. edupage-api is pinned to an exact, reviewed version; other dependencies take compatible updates within their major version.

Reading can still be visible to EduPage, like opening a page in the browser.

See SECURITY.md to report a vulnerability.

Contributing

Development setup, tests and releases are in CONTRIBUTING.md.

Credits

Built on edupage-api, a community Python library for EduPage accounts, licensed under GPL-3.0. It does the EduPage requests and parsing; this project adds the Keychain sessions, browser sign-in, network confinement and the MCP tools. Its version is pinned exactly, so a new edupage-api release reaches users only through a release of this project.

Disclaimer

This is an independent open-source project. It is not affiliated with, endorsed by, or supported by aSc Applied Software Consultants, s.r.o., the company that makes EduPage. The EduPage name is used only to say which service this software works with. All EduPage access goes through edupage-api, an independent community library that is not part of this project either. It relies on EduPage's undocumented web endpoints, which can change without notice; when they do, this server may stop working until edupage-api and then this project are updated. Use it at your own risk.

License

GPL-3.0-or-later. Copyright © 2026 Stefan Backor.