Settings¶
Site administration → Plugins → Local plugins → MCP server. The page shows the endpoint URL at the top.
| Setting | Name | Default | What it does |
|---|---|---|---|
| Enable MCP server | local_mcp/enabled |
On | When off, the endpoint rejects every request. |
| Allow write tools | local_mcp/allowwrite |
Off | Turns on the tools that create and change courses. See Enabling write mode. |
| Requests per user per minute | local_mcp/ratelimit |
60 | 0 disables the limit. See Rate limiting. |
| Access token lifetime (seconds) | local_mcp/accesstokenlifetime |
3600 | Clamped between 60 and 86400. |
| Refresh token lifetime (seconds) | local_mcp/refreshtokenlifetime |
2592000 (30 days) | Clamped between 1 hour and 365 days. |
| Authorization code lifetime (seconds) | local_mcp/codelifetime |
300 | Clamped between 30 and 600. |
| Accept Moodle web service tokens | local_mcp/allowwstoken |
Off | Accepts a Moodle wstoken as Authorization: Bearer. |
| Allow dynamic client registration | local_mcp/enabledcr |
On | Lets MCP clients register themselves (RFC 7591). |
| Allow client ID metadata documents | local_mcp/allowcimd |
On | Lets a client identify itself with an HTTPS metadata URL. Private and link-local addresses are refused. |
| Extra allowed Origin values | local_mcp/extraorigins |
Empty | One browser Origin per line, for example https://cursor.com. |
Tools¶
Under the Tools heading there is one checkbox per tool, 34 in total (local_mcp/tool_<name>, for example
local_mcp/tool_delete_section). All are on by default. A disabled tool is not listed in tools/list
and cannot be called.
Origin check¶
The site URL is always allowed. Requests with no Origin header (desktop and server clients) are allowed.
A present but unknown Origin gets HTTP 403.