---
name: iblai-connect-powerschool-sis
description: "Read and write PowerSchool SIS data through the PowerSchool SIS plugin data access (PowerQueries); OneRoster 1.1 and 1.2 REST provider and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with PowerSchool SIS data, or to set up a PowerSchool SIS MCP connection on ibl.ai."
metadata:
  kind: guide
---

# PowerSchool SIS connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/powerschool-sis — not part of the iblai/vibe repository. Checked against PowerSchool's documentation on October 20, 2026; test it against your own PowerSchool SIS setup before you rely on it.

PowerSchool SIS is a K-12 student information system. It holds district and school records, students and staff, class sections and enrollments, gradebook data, and the PowerQueries used for reports, exports and state reporting.

## Auth & conventions

- **API:** PowerSchool SIS plugin data access (PowerQueries); OneRoster 1.1 and 1.2 REST provider (REST). A district-installed plugin declares the data it may read and gets OAuth client credentials for data exchange, including named PowerQueries. The SIS is also 1EdTech-certified as a OneRoster 1.1/1.2 REST provider for rostering and gradebook.
- **Access:** Issued by your administrator. A district admin installs and enables the plugin; PowerSchool auto-generates its client ID and secret (Data Provider Configuration). The developer API reference sits in PowerSource, which requires a PowerSchool login.
- **Auth:** OAuth 2.0 client credentials (per plugin). Each data-exchange plugin gets an auto-generated client ID and secret that the external system uses to obtain an access token. Data is limited by the plugin's access request and the school access an admin configures.
- Keep PowerSchool SIS credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Schools and academic sessions** — Orgs, schools and terms through the certified OneRoster rostering provider.
- **Students, teachers and staff** — User records through OneRoster rostering or plugin data access, limited to what the plugin requests.
- **Classes and enrollments** — Course sections and student/teacher enrollments through OneRoster rostering.
- **Gradebook line items and results** — Certified OneRoster Gradebook Pull (1.1 and 1.2) and Assessment Results Profile pull (1.2).
- **PowerQuery result sets** — Core, state-reporting and custom PowerQueries a plugin is granted; results depend on page permissions.

## Writes

- **Gradebook line items and scores** — Certified OneRoster 1.1 Gradebook Push: an external app writes assignments and scores into the SIS gradebook. **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

PowerSchool did not publish an MCP server of its own when this skill was checked. Host a small MCP server that wraps the calls above, then register it below.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - For an API key or service credential use `auth_type=token` with `auth_scope=platform` for one key across the organization, or scope it to a single agent for one key per agent.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "List every student enrolled in Algebra I sections at Lincoln Middle School this term"
- "Pull this quarter's gradebook scores for 7th-grade science and flag missing assignments"
- "Run the attendance PowerQuery our plugin has access to and summarize chronic absences"
- "Push the unit test scores from our assessment app into the PowerSchool gradebook"

## Guardrails

- Student education records protected by FERPA, including demographics, enrollment and grades; may include state-reporting identifiers and special-program data.
- Request the narrowest PowerSchool SIS scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Page through large result sets and back off on rate-limit responses instead of retrying in a loop.

## References

- View OAuth Client Credentials: https://ps.powerschool-docs.com/pssis-admin/latest/view-oauth-client-credentials
- Plugin Management Setup: https://ps.powerschool-docs.com/pssis-admin/latest/plugin-management-setup
- 1EdTech certification: PowerSchool SIS: https://site.imsglobal.org/certifications/powerschool-group-llc/powerschool-sis
- This connector on ibl.ai: https://ibl.ai/developer/connectors/powerschool-sis
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections