Skip to content

Tokens: My MCP tokens and the admin panel

Besides OAuth, local_mcp 0.8.x lets each user create a personal token from Moodle, and gives administrators a panel to see and revoke every token on the site. Token values are never stored: Moodle keeps only a SHA-256 hash.

My MCP tokens (each user)

Any signed-in user with local/mcp:managetokens (allowed by default for the authenticated user role) can open the page at {wwwroot}/local/mcp/tokens.php.

  1. Open the user menu and choose Preferences. Under MCP server, open My MCP tokens. The same link is also in the user menu.
  2. Enter a name (up to 255 characters).
  3. Read is always included. Write and Admin appear only if your roles allow them. Write stays disabled, with an explanation, while the site has write tools switched off.
  4. Choose how long it lasts: 30, 90 or 365 days. Choices above the administrator's maximum are hidden.
  5. Create the token. Moodle shows it once, with a copy button, the MCP server URL, an Authorization: Bearer header, a Cursor mcp.json fragment and a Claude Desktop fragment that uses npx mcp-remote. Copy what you need before leaving the page.
  6. The table Your tokens lists name, scopes, created, last used, expiry, status (Active, Revoked, Expired) and type. Revoke asks for confirmation and stops the token at once.

Warning

A token opens your courses with your permissions. Store it like a password. Anyone who copies it can act as you until you revoke it.

A personal token has no refresh token. When it expires, create a new one.

Admin token panel

Site administration → Plugins → Local plugins → MCP tokens ({wwwroot}/local/mcp/admintokens.php).

  • Open to site administrators (moodle/site:config) and to anyone with local/mcp:admin at system level, such as a manager.
  • Lists every MCP token on the site: OAuth access and refresh tokens and personal tokens. The value is never shown.
  • Filter by user (username or id), status (active, revoked, expired, all) and type.
  • Revoke one token, every token of one user, or every token on the site. Each action asks for confirmation.

Settings

Setting Default What it does
Allow personal access tokens (local_mcp/allowpersonal) on Lets users create personal tokens. When off, users can still revoke the tokens they already have.
Maximum personal token lifetime (days) (local_mcp/patmaxdays) 365 Hides the longer choices. Kept between 30 and 365.

From the command line

cli/list_tokens.php shows personal tokens with the type personal and their name; cli/revoke_token.php --id=N revokes one row. See CLI commands.

See also OAuth and tokens.