How it works
Studeia implements the Model Context Protocol (MCP) with Streamable HTTP transport and OAuth 2.1 (dynamic client registration, PKCE S256, rotating refresh token). The AI assistant connects with your account, not with an institution key: everything it does goes through the same permission rules as the web interface and is recorded in the audit log.
| Institutional Administrator | Teacher | |
|---|---|---|
| Read | Everything in the tenant: courses, lessons, students, classes, grades, reports, settings | Courses they create/collaborate on/teach; students in their classes |
| Write | Courses, modules, lessons, teacher guides, classes, enrollments, settings | Courses and lessons in their own courses |
| Out of scope | Billing, SSO/SCIM, provider keys, the connector toggle itself | same |
1. Enable at the institution level (admin)
- Go to Settings β AI Connectors (ChatGPT / Claude).
- Turn on Allow MCP connections. Optionally disable Teachers can also connect.
- Copy the MCP server URL β typically
https://<slug>.studeia.com/api/mcp(or your verified custom domain).
Disabling the connector immediately revokes all active connections.
2. Connect in Claude
Claude.ai / Desktop / mobile
- Settings β Connectors β Add custom connector.
- Paste the MCP server URL. Leave Client ID/Secret blank (automatic registration).
- Click Connect: you will be taken to the Studeia login (if not already logged in) and the consent screen.
- Review the permissions (read, write, 30 days) and the privacy notice β Authorize.
Claude Code
claude mcp add --transport http studeia https://<slug>.studeia.com/api/mcp
Claude Code opens the browser for consent and receives the callback at http://localhost:<port>/callback.
3. Connect in ChatGPT
- Settings β Connectors β Advanced β enable Developer Mode.
- Create β name (e.g., "Studeia") β MCP server URL β authentication OAuth β Create.
- Complete the Studeia login and consent flow.
- In the chat, enable the connector under Tools. Write actions require manual confirmation in ChatGPT.
The search and fetch tools follow the ChatGPT contract, so the connector also works in deep research.
4. What to ask the assistant
- "Generate a report for class 3rd Grade A showing at-risk students and the skills with the lowest mastery."
- "List the lessons in the Digital Skills course that are missing a teacher guide and create one for lesson 4."
- "Rewrite the slides for the Digital Vault lesson in simpler language and publish them."
- "Which users have never accessed the platform? Export as a table."
- "Show the gradebook API endpoints and submit grade 8 for student X on assessment Y."
Available tools (summary): tenant overview and settings, courses and modules (list, create, edit, publish, reorder), lessons (full content, create, edit validated content by type, teacher guide, delete), users, classes, enrollments, student/course/tutor effectiveness reports, audit logs, search/fetch, and list_api_endpoints + call_institution_api for the rest of the institutional API.
5. Revoke and audit
- User: Profile β AI Connections β Revoke.
- Admin: Settings β AI Connectors β connections list β Revoke (or disable the connector).
- Audit: Logs β
mcp.*actions (consent, tokens, each tool call with tool name, ids, and result β never the content).
Privacy and limits
- Data queried by the AI (including data of minor students) is processed by the user's account provider (OpenAI/Anthropic). The institution is responsible for legitimate use β the consent screen makes this explicit.
- Access token: 1 hour. Refresh token: rotating, maximum 30 days per consent (re-authorization required afterward).
- Rate limit per connection and per IP on OAuth endpoints.
- Not available via MCP: file uploads, billing, SSO/SCIM, AI/video provider keys, and the connector configuration itself.
For developers
- Discovery:
/.well-known/oauth-protected-resource/api/mcpand/.well-known/oauth-authorization-server(relative to host). POST /api/mcpwithout a token responds with401andWWW-Authenticate: Bearer resource_metadata=β¦.- Dynamic registration only accepts callbacks from Claude, ChatGPT, and loopback (
http://localhost:<port>/callback). - Scopes:
read,write,offline_access.