Mcp Workspace — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Workspace (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that connects AI assistants to your university's D2L Brightspace and Piazza. Sign up once at [horizon.hamzaammar.ca/onboard](https://horizon.hamzaammar.ca/onboard), then use Claude, ChatGPT, or any MCP-compatible client to query your courses, grades, assignments, deadlines, files, and Piazza posts — all from your AI assistant.
Horizon is a tool for organizing and accessing your own academic data. Use in accordance with your institution's academic integrity policies.
The easiest way to use Horizon is the hosted instance at https://horizon.hamzaammar.ca/onboard:
No infrastructure required.
{
"mcpServers": {
"horizon": {
"command": "npx",
"args": [
"mcp-remote",
"https://horizon.hamzaammar.ca/mcp",
"--header",
"x-api-key: YOUR_API_KEY"
]
}
}
}claude mcp add horizon -- npx mcp-remote https://horizon.hamzaammar.ca/mcp --header "x-api-key: YOUR_API_KEY"ChatGPT's desktop app supports MCP servers natively:
https://horizon.hamzaammar.ca/mcpx-api-key: YOUR_API_KEYAlternatively, add it via the config file at ~/Library/Application Support/com.openai.chat/mcp_config.json (Mac):
{
"mcpServers": {
"horizon": {
"command": "npx",
"args": [
"mcp-remote",
"https://horizon.hamzaammar.ca/mcp",
"--header",
"x-api-key: YOUR_API_KEY"
]
}
}
}https://horizon.hamzaammar.ca/mcpx-api-key: YOUR_API_KEYReplace YOUR_API_KEY with the key shown on your Horizon dashboard.
Horizon exposes your academic data as MCP tools across four categories:
D2L / Brightspace
get_my_courses — list all enrolled coursesget_my_grades — check grades for any courseget_assignments / get_assignment / get_assignment_submissions — assignments, due dates, submission statusget_upcoming_due_dates — deadlines within a configurable time windowget_course_content / get_course_modules / get_course_module / get_course_topic — full syllabus and lecture materialsget_announcements — instructor posts and updatesdownload_file / read_file / delete_file — download and extract text from course PDFs and filesPiazza
piazza_get_classes / piazza_get_posts / piazza_get_post — browse class discussionspiazza_search / piazza_semantic_search — search posts by keyword or meaningpiazza_sync / piazza_embed_missing — sync and embed recent postspiazza_suggest_for_item — find relevant posts for a given assignmentNotes (uploaded PDFs)
notes_search / semantic_search_notes — search your uploaded notes by keyword or semanticallynotes_sync / notes_embed_missing — process and embed uploaded PDFsnotes_suggest_for_item — find relevant notes for a given assignmentStudy & Tasks
tasks_list / tasks_add / tasks_complete — personal task trackingplan_week — AI-generated weekly study plan based on upcoming deadlinessync_all — sync all assignments from every enrolled course at onceMCP Client (Claude, ChatGPT, Poke, etc.)
|
| HTTPS + Streamable HTTP
v
Go Gateway (JWT/API key auth, rate limiting, Prometheus metrics)
|
| HTTP proxy (X-User-Id header)
v
Node.js MCP Server (tools, D2L API, Piazza API)
|
+---> Supabase (users, tasks, notes, pgvector embeddings)
+---> D2L Brightspace (session cookies via VNC browser login)
+---> Piazza (SSO cookies)
+---> S3 (browser state persistence for headless token refresh)
+---> OpenAI (embeddings for semantic search)Session management: D2L sessions are refreshed automatically every 18 hours using saved ADFS browser state from S3. If the ADFS session expires (~30–90 days), Horizon falls back to stored username/password credentials for headless re-login. If Duo MFA is required, the user gets a push notification to re-authenticate via the dashboard.
d2l-mcp/
gateway/ Go reverse proxy — JWT/API key auth, rate limiting, Prometheus
src/
api/ REST routes (onboarding, file upload, push notifications)
browser/ Playwright + VNC sessions for D2L login with Duo MFA
jobs/ Background session refresh scheduler
tools/ MCP tool implementations (D2L, files, content)
study/ Study tools (notes, tasks, Piazza sync, semantic search)
public/ Onboarding page (horizon.hamzaammar.ca)
scripts/ Deployment scripts (ECS, migrations)
study-mcp-app/ React Native companion app (Expo) — push notifications
supabase/ Database migrationsgit clone https://github.com/hamzaammar/horizon.git
cd horizon/d2l-mcp
cp .env.template .env
# Fill in SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, OPENAI_API_KEY, S3_BUCKET, etc.Run each SQL file in src/study/db/migrations/ in order via your Supabase SQL editor.
npm install
npm run build
SKIP_JWT_AUTH=1 MCP_USER_ID=dev npm start
# Server at http://localhost:3000/mcpcp task-definition.example.json task-definition.json
# Replace all <PLACEHOLDER> values with your AWS account details and secret ARNs
bash scripts/deploy-to-ecs.shSee task-definition.example.json for the full ECS Fargate two-container configuration (gateway + backend).
Point any MCP client at your deployed server:
| Setting | Value |
|---|---|
| URL | https://your-domain.com/mcp |
| Header | x-api-key: <key from dashboard> |
Three methods are supported at the gateway level:
hzn_...) — never expire, best for MCP clients; generated from the dashboard/auth/refreshAll auth is handled by the Go gateway before requests reach the Node.js server. The user's ID is forwarded as X-User-Id and scopes all database queries.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.