MCP server

The Schulungstool MCP server lets AI agents manage users, groups, courses, and participations of your workspace through the Model Context Protocol (MCP). It works with every client that supports remote MCP servers over Streamable HTTP, such as Claude, Claude Code, Microsoft Copilot Studio, Cursor, VS Code, Gemini CLI, and n8n.

https://mcp.schulungstool.de/mcp

• Transport: Streamable HTTP (no SSE endpoint)
• Authentication: your API key as a request header
• Scope: the key’s workspace; all tools operate on that workspace’s data only

The MCP server uses the same API keys as the REST API. Generate one in your admin area under Settings > Advanced settings > Developer options.

Configure your client to send the key in the Authorization header:

Authorization: Bearer <API key>

Token <API key> is accepted as well. Where a client asks for the raw header value, type the Bearer prefix yourself. Treat the key like a password: use environment variables or your client’s secret storage, and never commit it to a repository.

The key’s access scopes decide which tools work: each tool runs with exactly the rights granted to the key, no more. The tool table below names the required scope per tool; for the full toolset a key needs users:write, groups:write, courses:read, and participations:write.

Use a dedicated key for each agent and grant only what its tasks need: an agent that only answers questions about training status gets along with users:read, groups:read, courses:read, and participations:read. When a tool call fails because a scope is missing, the error names the scope; an administrator can grant it in the admin area, and the change takes effect immediately. The get_key_info tool shows which rights the connected key carries and which tools are available with them.

Settings > Connectors > Add custom connector (as of October 2026): enter a name and the server URL https://mcp.schulungstool.de/mcp, choose No sign-in as authentication, and add the request header Authorization with the value Bearer <API key> (including the Bearer prefix). Then enable the connector per conversation via the plus menu.

Notes: request headers for custom connectors are currently rolling out and may not be available for every organization yet. Authentication settings cannot be changed later; delete and re-add the connector instead. On Team and Enterprise plans a connector added by the organization shares one key across all members.

claude mcp add --transport http schulungstool https://mcp.schulungstool.de/mcp \
  --header "Authorization: Bearer ${SCHULUNGSTOOL_API_KEY}"

Or per project in .mcp.json, keeping the key in an environment variable:

{
  "mcpServers": {
    "schulungstool": {
      "type": "http",
      "url": "https://mcp.schulungstool.de/mcp",
      "headers": { "Authorization": "Bearer ${SCHULUNGSTOOL_API_KEY}" }
    }
  }
}

Check the connection with /mcp.

ChatGPT connectors only support OAuth or no authentication; there is no field for a static API key header. The Schulungstool MCP server currently authenticates with API keys only, so it cannot be used from ChatGPT yet.

In ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

{
  "mcpServers": {
    "schulungstool": {
      "url": "https://mcp.schulungstool.de/mcp",
      "headers": { "Authorization": "Bearer <API key>" }
    }
  }
}

Command palette > MCP: Add Server > HTTP, or in .vscode/mcp.json with the key as a masked input variable:

{
  "inputs": [
    {
      "id": "schulungstool-key",
      "type": "promptString",
      "description": "Schulungstool API key",
      "password": true
    }
  ],
  "servers": {
    "schulungstool": {
      "type": "http",
      "url": "https://mcp.schulungstool.de/mcp",
      "headers": { "Authorization": "Bearer ${input:schulungstool-key}" }
    }
  }
}

Agent > Tools > Add a tool > New tool > Model Context Protocol: enter name, description, and the server URL, choose authentication API key with type Header and header name Authorization, then create a connection and enter Bearer <API key> as the value. Generative orchestration must be enabled; Power Platform DLP policies may block custom connectors.

In ~/.gemini/settings.json:

{
  "mcpServers": {
    "schulungstool": {
      "httpUrl": "https://mcp.schulungstool.de/mcp",
      "headers": { "Authorization": "Bearer $SCHULUNGSTOOL_API_KEY" }
    }
  }
}

Add the MCP Client Tool to an AI agent node, set the endpoint URL, choose Bearer authentication, and store the API key as a credential.

After connecting, send a risk-free prompt such as:

Which access rights does my Schulungstool key have?

The agent should call get_key_info and list the key’s scopes; the tool works with every valid key regardless of its rights. If it does, the connection works.

All tools return compact JSON with stable IDs. Search tools return one page at a time; pass page to fetch more while has_next_page is true.

get_key_info works with every valid key regardless of its scopes and doubles as a connection smoke test. Tools that read two resources at once (such as get_user, which includes group memberships) need both scopes listed.

Example prompts:

• “Create an account for Jane Doe (jane.doe@example.com) and enroll her in the data protection course.”
• “Which participants of the first aid course haven’t completed it yet?”
• “Add everyone from the sales group to the new compliance course.”

Deleting users is deliberately not available via MCP; use the admin area or the REST API for that.

• The REST API’s rate limits apply per workspace; MCP tool calls count like API requests.
• Every tool call is logged in your workspace’s API request log with the user agent schulungstool-mcp/<version>, so you can audit agent activity in the admin area.
• Tool names, parameters, and result fields are treated like API contracts: breaking changes are announced in the changelog with a deprecation period.
• The server is stateless; it stores no data of its own and no conversation state.

• 401 Unauthorized: the header is missing or malformed. Check that the value includes the Bearer (or Token ) prefix and the full 128-character key.
• 403 with “Required access right”: the key lacks the scope the tool needs; the error names it. An administrator can grant it under Settings > Advanced settings > Developer options; the change takes effect immediately. get_key_info shows the current rights.
• 429 Too Many Requests: rate limit reached, or too many failed authentication attempts for this key. Wait for the time given in Retry-After.
• Client starts an OAuth flow or reports a missing login: make sure the server URL is exactly https://mcp.schulungstool.de/mcp and authentication is configured as a static header (No sign-in on claude.ai). The server does not offer OAuth yet.
• Tool calls fail with validation errors: the error message lists the affected fields and what to fix; agents usually repair these on their own.