---
name: iblai-connect-classlink
description: "Read ClassLink data through the ClassLink Roster Server (OneRoster 1.1 and 1.2 API); ClassLink OAuth2 SSO API and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with ClassLink data, or to set up a ClassLink MCP connection on ibl.ai."
metadata:
  kind: guide
---

# ClassLink connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/classlink — not part of the iblai/vibe repository. Checked against ClassLink's documentation on October 20, 2026; test it against your own ClassLink setup before you rely on it.

ClassLink provides LaunchPad single sign-on and Roster Server, which pulls district SIS data and delivers class rosters (orgs, users, classes, enrollments, courses, terms, resources) to learning apps using OneRoster.

## Auth & conventions

- **API:** ClassLink Roster Server (OneRoster 1.1 and 1.2 API); ClassLink OAuth2 SSO API (REST). Roster Server is a 1EdTech-certified OneRoster REST provider for rostering and resources, scoped to what each district shares with a vendor. The SSO API signs users in and returns profile, district and linked-student info.
- **Access:** Partner or license program. Apps integrate as ClassLink partners; each district decides in Roster Server which data a vendor receives. Partner docs live on ClassLink's help site, which did not render for verification.
- **Auth:** OAuth 2.0 authorization code (SSO); OAuth 1.0a HMAC-SHA256 signed requests (OneRoster); OAuth 2.0 client credentials (OneRoster 1.2). SSO uses https://launchpad.classlink.com/oauth2/v2/auth and /oauth2/v2/token, then https://nodeapi.classlink.com/v2/my/info. ClassLink's OneRoster sample libraries sign requests with OAuth 1.0a HMAC-SHA256.
- Keep ClassLink credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Orgs and schools** — District and school orgs via the certified OneRoster REST rostering provider.
- **Users** — Students, teachers and other users the district shares with the vendor.
- **Classes and enrollments** — Class rosters and enrollments built from the district SIS.
- **Courses and academic sessions** — Courses and terms through OneRoster rostering endpoints.
- **Resources** — OneRoster Resources service (certified Resources Core and Optional).
- **Signed-in user profile** — nodeapi.classlink.com v2/my/info, v2/my/district, v2/my/profiles and v2/my/students after SSO.

## Writes

- None. This skill only reads ClassLink data.

## Expose it to an ibl.ai agent (MCP)

ClassLink did not publish an MCP server of its own when this skill was checked. Host a small MCP server that wraps the calls above, then register it below.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - ClassLink supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "List the classes and enrolled students our district shares with this app in ClassLink"
- "Show which teachers at Westview Elementary are rostered to 2nd-grade classes"
- "Look up the signed-in ClassLink user's district and linked students"
- "Compare today's Roster Server enrollments with last week's and list the changes"

## Guardrails

- Student education records protected by FERPA: identities, demographics and class rosters. Roster Server's DataGuard can mask personally identifiable information before sharing.
- Request the narrowest ClassLink scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Page through large result sets and back off on rate-limit responses instead of retrying in a loop.

## References

- ClassLink Roster Server: https://www.classlink.com/roster-server
- ClassLink request libraries (GitHub): https://github.com/classlinkinc/request-libraries
- 1EdTech certification: ClassLink Roster Server: https://site.imsglobal.org/certifications/classlink-inc/classlink-roster-server
- This connector on ibl.ai: https://ibl.ai/developer/connectors/classlink
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections