CLI commands¶

Three scripts under local/mcp/cli/ (on Moodle 5.x, public/local/mcp/cli/). --help on each lists the options.

Warning

Anyone who can run PHP as the web user can mint and revoke tokens. Treat these scripts like the other admin/cli scripts.

issue_token.php¶

Issues an access token and prints it once.

Option	Meaning
`--userid=INT` or `--username=NAME`	User the token acts as
`--scopes="read write"`	Scopes to grant

php local/mcp/cli/issue_token.php --username=ada --scopes="read write"

list_tokens.php¶

Prints id, user, scopes, client name, created, expires, last use, status (active, revoked or expired) and type (access or refresh). Times are UTC ISO 8601, for example 2026-11-01T09:00:23Z. The raw token and its hash are never printed.

Option	Meaning
(none)	Active tokens only
`--userid=INT` / `--username=NAME`	Only this user
`--all`	Include revoked and expired tokens

php local/mcp/cli/list_tokens.php
php local/mcp/cli/list_tokens.php --username=ada
php local/mcp/cli/list_tokens.php --all

revoke_token.php¶

Choose exactly one option.

Option	Meaning
`--id=INT`	Revoke one token row
`--userid=INT` / `--username=NAME`	Revoke every token of a user
`--all`	Revoke every token

php local/mcp/cli/revoke_token.php --id=12
php local/mcp/cli/revoke_token.php --username=ada
php local/mcp/cli/revoke_token.php --all