# Quizzz MCP

> OAuth-first Model Context Protocol access to Quizzz for language teachers.

## Connect

- **MCP endpoint:** https://mcp.quizzz.link/mcp
- **Transport:** Streamable HTTP
- **Authorization:** OAuth 2.1 Authorization Code + PKCE (S256)
- **Dynamic registration:** https://quizzz.techtranslab.com/api/oauth/register
- **Authorization server metadata:** https://quizzz.techtranslab.com/.well-known/oauth-authorization-server
- **Protected resource metadata:** https://mcp.quizzz.link/.well-known/oauth-protected-resource
- **Authorization endpoint:** https://quizzz.techtranslab.com/oauth/authorize
- **Token endpoint:** https://quizzz.techtranslab.com/api/oauth/token
- **Human portal:** https://mcp.quizzz.link/

Add the endpoint to Claude Code, Cursor, Codex, Gemini CLI, VS Code, ChatGPT,
or another MCP-capable client. The client opens Quizzz in a browser for sign-in
and consent; do not create or paste an API key for the normal setup.

## Capabilities

Quizzz exposes tools for quiz authoring and validation, assignments and Magic
Links, classrooms, student notes and weakness reports, results analysis, QR
codes, collections, folders, and digital products. The live tool list is
available through MCP tools/list; the detailed reference is maintained in
the repository documentation.

## Security boundary

Every call is authenticated, rate-limited, audited, and scoped to the account
that authorized the client. Teacher and student roles have separate tool
surfaces, and repository operations retain the teacher/student tenant filter.
OAuth scopes are enforced per tool. Quizzz does not use its built-in AI credits
for questions written by an external agent; it validates and stores the result.

## Compatibility

Existing clients may continue using
https://quizzz.techtranslab.com/api/mcp. That endpoint remains supported;
new clients should prefer https://mcp.quizzz.link/mcp. The MCP resource stays on this
  dedicated origin, while OAuth authorization and login stay on Quizzz's
  canonical app origin (https://quizzz.techtranslab.com) so an existing app session is reused.