Administrator guide

Under development

We will release this feature with XP+ v21.

The Level Up XP MCP integration lets an AI assistant get information from Moodle. It can also perform permitted actions with the permissions of the connected Moodle user.

Use this page to configure the integration and control its users, tool permissions, and OAuth clients.

Requirements

You need:

• An XP+ plan that includes MCP access.
• Level Up XP v21.0 or later and XP+ v21.0 or later.
• A Moodle site that uses HTTPS.
• An AI client that supports remote MCP servers and OAuth.

A cloud-based AI client connects from the AI provider's systems. If your Moodle site is on a private network or behind a firewall, review the provider's network requirements.

Enable and configure MCP

1. Go to Site administration > Plugins > Blocks > Level Up XP.
2. Find the AI settings section.
3. Set Enable MCP access to Yes.
4. In MCP tool permissions, select each checkbox for the type of operation that you want to allow.
5. Set Allow ChatGPT connections to Yes if users can connect ChatGPT.
6. Set Allow Claude connections to Yes if users can connect Claude.
7. Enter Connect instructions if users need information about another assistant.
8. Select Save changes.
9. Select the full list of tools link to review the available tools and their status.

Enable MCP access is the sitewide control for the integration. Set it to No to stop OAuth authorisation and MCP requests for the site.

Provide connection instructions

The Connect instructions setting adds information to the AI page in Level Up XP. This information appears before the ChatGPT and Claude instructions. Use it to give users a link and the steps to access an assistant.

This setting is useful for assistants other than ChatGPT and Claude. You can also use it for an assistant that is available only to your organisation. For example, you can create AI clients in Microsoft Foundry (Azure AI Studio) and tell users how to access them.

The Connect instructions setting provides information only. You must configure the client in the AI environment. If the client requires OAuth credentials, you must also register it manually.

Control who can connect

A user must have local/xp:usemcp at the system level to authorise a connection and use it. The user must also have this capability in the context where an MCP tool runs. An Allow permission at the system level normally applies in lower contexts unless you override it.

The capability does not replace the user's other Moodle permissions. Each MCP tool also checks permissions in the relevant Moodle context. For example, many tools require block/xp:manage. Reports, logs and learner information require the relevant XP permissions.

You can override or prohibit local/xp:usemcp in a course or another context. The user can stay connected, but the MCP tools cannot operate in that context. For more information, see local/xp:usemcp in the permissions guide.

Control the available tools

The MCP tool permissions setting contains three checkboxes. The checkboxes control the types of operations that tools can perform. They do not give users new Moodle permissions.

Checkbox	Effect
Read information	Allows tools that read information, such as levels, rules and configuration.
Access personal data	Allows tools that access learner information, reports, logs or individual leaderboard data.
Make changes or trigger actions	Allows tools that change data or trigger an action, such as awarding points or sending a notification.

You must select every checkbox that a tool requires before you can use the tool. For example, the tool that awards points requires Access personal data and Make changes or trigger actions.

The tools list also depends on whether XP operates sitewide or in each course. XP+ automatically disables tools that do not apply to the configured mode. You can review the full list of tools and their descriptions in the Level Up XP AI settings.

Control OAuth clients

OAuth lets users sign in on your Moodle site and approve a connection. Users do not give their Moodle password to the AI client.

Level Up XP includes this OAuth service only for the MCP integration. Its access tokens are valid only for the Level Up XP MCP endpoint. They do not grant access to Moodle web services or other Moodle APIs.

The OAuth endpoint uses paths under blocks/xp/oauth.php/. Your web server must support slash arguments for these paths. For configuration instructions, see Slash arguments. If an OAuth route returns a not found error, see OAuth route troubleshooting.

Automatically registered clients

ChatGPT and Claude use Client ID Metadata Documents (CIMDs) to register automatically. These documents identify the clients and their OAuth redirect URLs.

Use Allow ChatGPT connections and Allow Claude connections to control automatic registration. When you allow an assistant, users can connect it without manual OAuth registration. The user must still sign in to Moodle and approve the connection.

Set Allow ChatGPT connections to No to disable automatically registered ChatGPT clients. Set Allow Claude connections to No to disable automatically registered Claude clients. Use Manage OAuth clients to review, enable, disable or delete existing clients.

Manually registered clients

Some AI clients require manual OAuth registration. The redirect URL that you register must exactly match the URL that the AI client uses. The client might provide this URL only after you enter the client ID and secret.

1. In the Level Up XP AI settings, select Manage OAuth clients.
2. Select Add client.
3. Enter a clear name. If the AI client has provided its redirect URL, enter the exact URL.
4. Save the client.
5. Open the client details.
6. Copy the client ID, client secret, Authorisation URL and Token URL to the AI client's connection settings.
7. If the AI client now provides its redirect URL, edit the OAuth client and save the exact URL.

The client secret is a credential that the AI client uses to authenticate.

You can disable an OAuth client to block new and existing connections that use it.

Moodle AI subsystem

Level Up XP does not use the Moodle AI subsystem. You do not configure an AI provider or API key in Moodle.

Review data and privacy

The MCP server runs on your Moodle site. MCP requests and responses do not pass through our systems.

The AI client receives the information that an MCP tool returns. Depending on the tool, this information can include:

• Course names, sections, activities and descriptions.
• XP configuration, levels, rules and settings.
• Learner names and Moodle user IDs.
• Usernames, ID numbers and email addresses when Moodle makes these identity fields visible to the connected user.
• Points, levels, leaderboard positions and team membership.
• XP logs and recent activity.

Moodle controls visible identity fields through the Show user identity (showuseridentity) setting and the moodle/site:viewuseridentity capability. Level Up XP uses the username, ID number and email address fields from this configuration. See Show user identity in the Moodle documentation.

The information that an AI client can receive depends on:

• The MCP tool permissions setting.
• The tools that are available for the XP sitewide or per-course mode.
• The connected user's Moodle and XP permissions.
• Moodle and XP settings that control user and leaderboard visibility.

After the AI client receives information, the AI provider handles it under the terms that apply to the user's account or workspace.

For information about the data that XP stores in Moodle, see User information and privacy.

Hardening

To make MCP available only to selected users:

1. Remove local/xp:usemcp from the Authenticated user role.
2. Create or select a role that you can assign at the system level.
3. Allow local/xp:usemcp for that role.
4. Assign the role at the system level to the selected users.
5. Override or prohibit the capability in lower contexts where necessary.

Disable or revoke access

Use the control that matches the scope of the access change:

• Remove the connection in the AI client to stop its use in that client.
• Remove local/xp:usemcp at the system level to block one Moodle user.
• Prohibit local/xp:usemcp in a context to block MCP tools in that context.
• Disable an OAuth client to block all connections that use that client.
• Set Enable MCP access to No to block all MCP connections to the site.
• Delete an OAuth client to remove its configuration and OAuth tokens.

Changes to Enable MCP access, MCP tool permissions, and Moodle permissions take effect on the server immediately. An AI client might continue to show an old tool list. Refresh or reconnect the integration if this occurs.

For connection and permission problems, see Troubleshooting AI and MCP.