{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/canvas-lms.json", "name": "Instructure Canvas", "score": 59.5, "shared": [ "learning.lms", "learning.courses", "learning.quiz", "learning.progress" ], "slug": "canvas-lms" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/learnosity.json", "name": "Learnosity", "score": 60.2, "shared": [ "learning.quiz", "learning.progress", "learning.courses" ], "slug": "learnosity" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/kahoot.json", "name": "Kahoot!", "score": 55.2, "shared": [ "learning.quiz", "learning.progress", "learning.lms" ], "slug": "kahoot" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/quizgecko.json", "name": "Quizgecko", "score": 33, "shared": [ "learning.quiz", "learning.courses" ], "slug": "quizgecko" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/preply.json", "name": "Preply", "score": 57.4, "shared": null, "slug": "preply" } ], "tool": { "slug": "moodle", "name": "Moodle", "vendor": "Moodle Pty Ltd", "vendorUrl": "https://moodle.com", "kind": "http-api", "category": "learning", "summary": "Moodle is an open-source learning management system that schools and companies run themselves or through MoodleCloud. Its web services expose 800 functions for courses, quizzes, assignments and grades, and Moodle 5.3 adds a scoped REST API with personal access tokens.", "url": "https://www.anchorterminal.com/tools/moodle", "markdownUrl": "https://www.anchorterminal.com/tools/moodle.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/moodle.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/moodle.json", "dns": "moodle.grade.anchorterminal.com", "repo": "https://github.com/moodle/moodle", "license": "GPL-3.0-or-later", "transports": [ "http" ], "remoteUrl": "https://\u003csite\u003e/webservice/rest/server.php", "packages": [], "auth": "mixed", "authNotes": "Classic web services use a token tied to a user and a service. An administrator enables web services and the REST protocol, creates a service with chosen functions, authorises users and makes the token under Manage tokens, with optional IP restriction and a valid-until date; users with the capability can also fetch one from login/token.php with a username and password. The token travels as the `wstoken` parameter in the query string or POST body. Moodle 5.3 (5 October 2026) adds a REST API at /api/rest/v2 with personal access tokens (scoped, expiring after 7 days to 1 year, shown once, revocable, with last-use IP) and OAuth 2 clients an administrator registers, enforced by scopes such as core_user:user:read in addition to capabilities (https://docs.moodle.org/503/en/REST_API_tokens).", "pricing": "free", "pricingNotes": "Moodle LMS is free software under GPL-3.0-or-later, installed and run by the owner. Moodle Pty Ltd's hosted MoodleCloud plans are public, billed yearly in Australian dollars, from Starter at AUD 230 (USD 160) a year for 50 users and 1GB to Standard at AUD 3,000 (USD 2,090) for 750 users and 50GB, with a 28-day trial of Starter that needs no card; MoodleCloud sites cannot install plugins, and whether they allow web services was not established. Partner hosting is quoted (https://www.moodlecloud.com/standard-plans/).", "priceSummary": "Free · OSS", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the web services documentation, the routing and scopes docs or MoodleCloud's pages (checked 2026-11-03).", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://moodledev.io/docs/6.0/apis/subsystems/external", "capabilities": [ "learning.lms", "learning.courses", "learning.quiz", "learning.progress" ], "tags": [ "self-hosted", "open-source", "official", "free", "oauth", "security-txt", "gpl" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 67.7, "grade": "B", "agentReady": false, "rank": 280, "ranked": true, "rankOf": 1349, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 81, "payments": 60, "reliability": 80, "schema": 66, "security": 67, "transparency": 76 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 80, "points": 16, "reason": "Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 66, "points": 10.73, "reason": "Function definitions are machine-readable inside a site (the generated API Documentation page for classic functions, SwaggerUI for the 5.3 REST API), but no OpenAPI or similar file is published without a site (15 of 25). No llms.txt on moodledev.io or docs.moodle.org (0). Each function and parameter carries a description, and the developer docs explain when to write a service and how to validate context (14 of 20). PARAM_* types, required, optional and default flags, nested structures, and scope declarations on 5.3 routes (13 of 15). curl samples and sample clients in several languages, but the error response shape was not documented on the pages read (9 of 15). Release notes per version, an \"introduced in\" column in the function list and a written deprecation policy (15). 15 + 0 + 14 + 13 + 9 + 15 = 66.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 49, "points": 7.96, "reason": "About 800 to 900 functions, but a service can expose only the functions an agent needs and each call names one function, so the working set is small (20 of 25). Paging and filtering vary by function; course and user lookups take criteria and some take limits, read only in the catalogue (10 of 20). The REST protocol returns an exception, errorcode and message object on failure, and the 5.3 API returns OAuth2 access_denied with a hint naming the missing scope; the classic shape was not read first-hand on this pass (8 of 20). No idempotency keys; many functions are creates and updates (5 of 20). Required parameters vary by function; no official SDK, only sample clients and community libraries (6 of 15). 20 + 10 + 8 + 5 + 6 = 49.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "Two credential models. The classic token is one secret per user and service with no scopes, documented in the `wstoken` query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 81, "points": 7.09, "reason": "Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "note": "editorial 76, provenance 76", "reason": "GPL-3.0-or-later source (30). Privacy notice last updated October 2025 with a DPA and a GDPR register, no fixed retention periods, and for a self-hosted site the owner is the controller (18 of 30). A written deprecation policy with three stages tied to major versions and upgrade notes, plus a dated release and support calendar to 2029 (20). Sites may register with moodle.org and send statistics, and the AI subsystem names its providers; the privacy notice names no subprocessors or data locations (8 of 20). 30 + 18 + 20 + 8 = 76.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "About 800 to 900 functions, but a service can expose only the functions an agent needs and each call names one function, so the working set is small (20 of 25). Paging and filtering vary by function; course and user lookups take criteria and some take limits, read only in the catalogue (10 of 20). The REST protocol returns an exception, errorcode and message object on failure, and the 5.3 API returns OAuth2 access_denied with a hint naming the missing scope; the classic shape was not read first-hand on this pass (8 of 20). No idempotency keys; many functions are creates and updates (5 of 20). Required parameters vary by function; no official SDK, only sample clients and community libraries (6 of 15). 20 + 10 + 8 + 5 + 6 = 49.", "maintenance": "Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81.", "payments": "Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60.", "reliability": "Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80.", "schema": "Function definitions are machine-readable inside a site (the generated API Documentation page for classic functions, SwaggerUI for the 5.3 REST API), but no OpenAPI or similar file is published without a site (15 of 25). No llms.txt on moodledev.io or docs.moodle.org (0). Each function and parameter carries a description, and the developer docs explain when to write a service and how to validate context (14 of 20). PARAM_* types, required, optional and default flags, nested structures, and scope declarations on 5.3 routes (13 of 15). curl samples and sample clients in several languages, but the error response shape was not documented on the pages read (9 of 15). Release notes per version, an \"introduced in\" column in the function list and a written deprecation policy (15). 15 + 0 + 14 + 13 + 9 + 15 = 66.", "security": "Two credential models. The classic token is one secret per user and service with no scopes, documented in the `wstoken` query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67.", "transparency": "GPL-3.0-or-later source (30). Privacy notice last updated October 2025 with a DPA and a GDPR register, no fixed retention periods, and for a self-hosted site the owner is the controller (18 of 30). A written deprecation policy with three stages tied to major versions and upgrade notes, plus a dated release and support calendar to 2029 (20). Sites may register with moodle.org and send statistics, and the AI subsystem names its providers; the privacy notice names no subprocessors or data locations (8 of 20). 30 + 18 + 20 + 8 = 76." }, "sources": [ { "what": "external services overview", "url": "https://moodledev.io/docs/apis/subsystems/external", "seen": "2026-11-03" }, { "what": "external function definitions", "url": "https://moodledev.io/docs/6.0/apis/subsystems/external/functions", "seen": "2026-11-03" }, { "what": "external function security", "url": "https://moodledev.io/docs/6.0/apis/subsystems/external/security", "seen": "2026-11-03" }, { "what": "web service API function list", "url": "https://docs.moodle.org/dev/Web_service_API_functions", "seen": "2026-11-03" }, { "what": "creating a web service client", "url": "https://docs.moodle.org/dev/Creating_a_web_service_client", "seen": "2026-11-03" }, { "what": "enabling web services and creating tokens", "url": "https://docs.moodle.org/en/How_to_create_and_enable_a_web_service", "seen": "2026-11-03" }, { "what": "REST API tokens (5.3)", "url": "https://docs.moodle.org/503/en/REST_API_tokens", "seen": "2026-11-03" }, { "what": "personal access tokens (5.3)", "url": "https://docs.moodle.org/503/en/Personal_access_tokens", "seen": "2026-11-03" }, { "what": "routing subsystem", "url": "https://moodledev.io/docs/5.3/apis/subsystems/routing", "seen": "2026-11-03" }, { "what": "routing scopes", "url": "https://moodledev.io/docs/5.3/apis/subsystems/routing/scopes", "seen": "2026-11-03" }, { "what": "releases and support calendar", "url": "https://moodledev.io/general/releases", "seen": "2026-11-03" }, { "what": "Moodle 5.3 release notes", "url": "https://moodledev.io/general/releases/5.3", "seen": "2026-11-03" }, { "what": "deprecation policy", "url": "https://moodledev.io/general/development/policies/deprecation", "seen": "2026-11-03" }, { "what": "security process", "url": "https://moodledev.io/general/development/process/security", "seen": "2026-11-03" }, { "what": "security advisories", "url": "https://moodle.org/security/", "seen": "2026-11-03" }, { "what": "security.txt", "url": "https://moodle.org/.well-known/security.txt", "seen": "2026-11-03" }, { "what": "privacy notice", "url": "https://moodle.com/privacy-notice/", "seen": "2026-11-03" }, { "what": "MoodleCloud plans", "url": "https://www.moodlecloud.com/standard-plans/", "seen": "2026-11-03" }, { "what": "MoodleCloud home", "url": "https://www.moodlecloud.com/", "seen": "2026-11-03" }, { "what": "MoodleCloud status page (Uptime Kuma)", "url": "https://status.moodlecloud.com/", "seen": "2026-11-03" }, { "what": "webservice_mcp marketplace plugin (third-party)", "url": "https://marketplace.moodle.com/plugins/webservice_mcp", "seen": "2026-11-03" }, { "what": "moodle/moodle tags and main commit feed", "url": "https://github.com/moodle/moodle/commits/main.atom", "seen": "2026-11-03" }, { "what": "about page and leadership", "url": "https://moodle.com/about/leadership/", "seen": "2026-11-03" }, { "what": "robots.txt", "url": "https://moodle.org/robots.txt", "seen": "2026-11-03" }, { "what": "official MCP registry search (community servers only)", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=moodle", "seen": "2026-11-03" }, { "what": "RDAP for moodle.org", "url": "https://rdap.publicinterestregistry.org/rdap/domain/moodle.org", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: whether MoodleCloud plans allow web services and token creation, since the plans page says only that plugins and integrations cannot be installed.", "unchecked: the classic REST error envelope (exception, errorcode, message) and per-function paging, which were not read first-hand on this pass; the function list page is the read-only 3.11-era wiki.", "unchecked: the moodle/moodle GitHub Actions status on main and the open issue count; the repository feed gave the last commit date (30 October 2026) only, and the GitHub API was rate-limited.", "unchecked: the MoodleCloud terms of service, which its site does not link, and the status page's history.", "Which parts of Moodle the 5.3 REST API covers; the user docs say only a few, with more planned, and the per-component route list was not read.", "firstReleased is Moodle 1.0 on 20 August 2002 from the releases page; the web services framework arrived later (the function list's \"introduced in\" column starts at 2.x).", "Investors. Moodle's own MoodleNet sustainability page records an investment received in 2017 from Education For The Many; the amount and stake are reported only by press, so the humans file names the investor from the Moodle page and the figure from EdSurge as press.", "The audit's lead, \"external services API, administrator setup\", holds; it predates the 5.3 personal access tokens and OAuth 2 server of 5 October 2026." ] }, "negative": 0, "verdict": "Free GPL software with about 800 typed web service functions over courses, quizzes, assignments and grades, a six-monthly release train with dated security advisories, and in 5.3 a scoped REST API with expiring tokens. An administrator must enable the services and issue tokens, the classic token travels in the query string, and no public OpenAPI file exists without a site.", "bestFor": "An agent working inside an institution or company that runs Moodle and can get a scoped token, reading course content, quiz attempts, assignments and grades or writing grades and enrolments.", "strengths": [ "About 800 to 900 external functions with typed, described parameters and returns, generated into a reference on every site", "Moodle 5.3 adds personal access tokens with scopes and 7-day to 1-year expiry, OAuth 2 clients and a SwaggerUI for the new REST API", "Services can expose only chosen functions to authorised users, with IP restriction and expiry on tokens", "Releases every April and October, point releases every two months, 5.3 LTS supported with security fixes to October 2029", "Ten dated security advisories with CVEs between 9 September and 15 October 2026, under GPL-3.0-or-later source" ], "weaknesses": [ "A site administrator has to enable web services, build a service and issue a token before any call; nothing is self-serve", "The classic token goes in the `wstoken` query or POST parameter, is all-powerful within the user's capabilities and has no scopes", "No public OpenAPI or llms.txt; the machine-readable reference exists only inside a running site", "The 5.3 REST API reaches only a few parts of Moodle, so most work still goes through the classic functions", "No official client SDK or MCP server from Moodle HQ; sample clients and community servers only" ], "agentNotes": [ "Ask the site administrator for a token on a custom service limited to the functions you need, with an IP restriction and a valid-until date; don't use the mobile service token for broader work", "Call https://\u003csite\u003e/webservice/rest/server.php with wsfunction, wstoken and moodlewsrestformat=json, sending the token in the POST body rather than the URL", "On a 5.3 site, prefer a personal access token or OAuth 2 client for the /api/rest/v2 routes it covers, and expect an access_denied error naming the missing scope", "Read each function's parameters in the site's API Documentation page; array parameters are flattened as users[0][username] in REST", "Check the site's Moodle version and the upgrade notes before relying on a function; deprecated external functions are removed outright" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.7 } ], "editorialScores": { "ergonomics": 49, "maintenance": 81, "payments": 60, "reliability": 80, "schema": 66, "security": 67, "transparency": 76 }, "provenanceScore": 76, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "B", "kind": "listed", "method": "0.7", "score": 67.7 } ] }, "connect": { "http": "curl -X POST \"https://\u003csite\u003e/webservice/rest/server.php\" -d wstoken=\u003cTOKEN\u003e -d wsfunction=core_course_get_courses -d moodlewsrestformat=json" }, "letme": { "capability": "https://letme.dev/learning.lms", "tool": "https://letme.dev/moodle" }, "notable": [ "Each external function is a class with execute_parameters(), execute() and execute_returns(), typed with PARAM_* values, VALUE_REQUIRED, VALUE_OPTIONAL or VALUE_DEFAULT and nested single and multiple structures, with descriptions; a running site publishes the generated reference under Site administration, Server, Web services, API Documentation (https://moodledev.io/docs/6.0/apis/subsystems/external/functions)", "The function catalogue runs to about 800 to 900 functions across core_course, core_user, core_grades, mod_quiz (start, save and process attempts, best grade), mod_assign (assignments, submissions, grades) and more; XML-RPC was removed from core in 4.1 and REST answers XML or JSON by moodlewsrestformat (https://docs.moodle.org/dev/Web_service_API_functions)", "Moodle 5.3 LTS (5 October 2026) adds an OAuth 2 server, personal access tokens and scoped routes for a REST API under /api/rest/v2, with a SwaggerUI reference under Site administration, Development; only a few parts of Moodle are reachable through it so far (https://moodledev.io/general/releases/5.3)", "Releases every six months (April and October) with point releases every two months; 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 on 5 October 2026, 5.3.x security fixes until 1 October 2029 (https://moodledev.io/general/releases)", "Ten security advisories from 9 September to 15 October 2026 (MSA-26-0036 to MSA-26-0045, three serious), with CVEs, fixes across supported branches and a Bugcrowd-linked report form; no paid bounty (https://moodle.org/security/)", "Deprecated external functions are marked with execute_is_deprecated() and removed outright at final deprecation, about two major versions after the deprecation; every deprecation needs an upgrade note (https://moodledev.io/general/development/policies/deprecation)", "No Moodle HQ MCP server found. A third-party marketplace plugin, webservice_mcp (last release 23 July 2026, 644 installs), turns external functions into MCP tools over JSON-RPC, and community Moodle MCP servers sit in the official registry under individual namespaces (https://marketplace.moodle.com/plugins/webservice_mcp)", "moodle.org/robots.txt carries Content-Signal ai-train=no, search=yes, ai-input=no and a 10-second crawl delay; moodledev.io and moodle.com allow all (https://moodle.org/robots.txt)" ], "area": "everyday", "details": [ { "label": "Surface listed", "value": "Moodle LMS's web services (external functions over REST) and the 5.3 REST API, as run on an owner's own site, read from moodledev.io, docs.moodle.org, moodle.org, moodle.com, moodlecloud.com, the Moodle marketplace and the moodle/moodle repository feeds on 3 November 2026. No site was installed and no call was made" }, { "label": "Endpoints", "value": "https://\u003csite\u003e/webservice/rest/server.php for classic functions (wsfunction, wstoken, moodlewsrestformat); https://\u003csite\u003e/api/rest/v2/\u003ccomponent\u003e/... for the 5.3 REST API; https://\u003csite\u003e/login/token.php to fetch a token with a username and password" }, { "label": "Functions", "value": "About 800 to 900 across core_course, core_user, core_enrol, core_grades, core_message, core_calendar, core_competency, mod_quiz, mod_assign, mod_forum, mod_lesson, mod_workshop, gradereport_* and gradingform_*; 5.3 adds assignment overrides, multiple-marker feedback and forum read-state functions" }, { "label": "Tokens", "value": "Classic tokens per user and service, created by an administrator or through login/token.php, with IP restriction and valid-until; 5.3 personal access tokens with scopes and expiry, shown once, with last-use time and IP, and OAuth 2 clients registered by an administrator" }, { "label": "Hosting", "value": "Self-hosted (PHP, PostgreSQL 17 or MariaDB 11.4 and up for 5.3), MoodleCloud from Moodle Pty Ltd, or certified partners; MoodleCloud's status page runs on Uptime Kuma" }, { "label": "Deprecation", "value": "Three stages (initial, final, removal) tied to major versions, upgrade notes required; external functions are removed at final deprecation with no stub" }, { "label": "MCP", "value": "None from Moodle HQ. The marketplace plugin webservice_mcp by an individual maintainer and community servers in the official registry are third-party" }, { "label": "Company", "value": "Moodle Pty Ltd, West Perth, Australia, founded by Martin Dougiamas (chairperson), CEO Scott Anderberg, a certified B Corporation; minority investment from Education For The Many in 2017" } ], "unitPrices": [ { "item": "MoodleCloud Starter (50 users, 1GB), yearly", "unit": "month", "usd": 13.33, "note": "USD 160 a year (AUD 230); hosted by Moodle Pty Ltd, plugins not installable" }, { "item": "MoodleCloud Standard (750 users, 50GB), yearly", "unit": "month", "usd": 174.17, "note": "USD 2,090 a year (AUD 3,000)" } ], "provenance": { "legalEntity": "Moodle Pty Ltd", "domain": "moodle.org", "domainRegistered": "2002-04-02", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://moodle.com/privacy-notice/", "statusPage": "https://status.moodlecloud.com", "changelog": "https://moodledev.io/general/releases", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "Moodle Pty Ltd is named in the privacy notice (last updated October 2025, PO Box 303, West Perth) and in the trademark notice on moodle.com. The software licence is GPL-3.0-or-later, which stands in for terms; no terms of service for self-hosted use exist, and MoodleCloud's site links only cookie, privacy and trademark policies.", "The privacy notice links a standard data processing agreement (February 2026 PDF) and a register of GDPR information, and names dpo@moodle.com and privacy@moodle.com.", "moodle.org/.well-known/security.txt names the report form at moodle.org/security/report/ and the policy at moodledev.io/general/development/process/security, with Expires 10 May 2027.", "moodle.org/robots.txt disallows search pages and /plugins/*/*, sets Content-Signal ai-train=no, search=yes, ai-input=no and asks for a 10-second crawl delay; docs.moodle.org asks for 5 seconds. Both were followed. moodledev.io, moodle.com and www.moodlecloud.com allow all.", "The endpoint sits on each owner's own site, not on a Moodle domain, so endpointOnVendorDomain is false. status.moodlecloud.com (Uptime Kuma) covers MoodleCloud only.", "RDAP at Public Interest Registry gives moodle.org a registration date of 2 April 2002; moodle.com dates from 22 February 1999." ], "score": 76, "checks": [ { "check": "Legal entity named", "value": "Moodle Pty Ltd", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "moodle.org, registered 2002-04-02 (24 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "\u003csite\u003e is not on moodle.org", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.moodlecloud.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" }, { "check": "People named", "value": "3 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://moodle.com/privacy-notice/", "state": "read", "readAt": "2026-11-03", "statedDate": "2025-10-01", "words": 3363, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: October 2025", "says": "Last updated 2025-10-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This privacy notice sets out how Moodle collects and uses information about you when you use our products and services (“services”) and why we collect certain personal data." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain personal data for as long as necessary to fulfill the purposes outlined in this privacy notice or as required by law.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may need to pass your personal data on to third-party service providers contracted to Moodle in the course of dealing with you." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "right to opt out of the sale of your personal information, although we do not sell your data;", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You have the right to withdraw your consent at any time either by selecting ‘delete my data’ within the specific service or by request to privacy@moodle.com;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "You have the right to withdraw your consent at any time either by selecting ‘delete my data’ within the specific service or by request to privacy@moodle.com;", "says": "privacy@moodle.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Cross Border Standard Contract Clauses (SCCs) that will allow us to contract with you to ensure protection of any personal data required to be transferred outside the EEA." } ], "notes": [ { "date": "2026-11-03", "text": "Customers buying on behalf of others must sign a Data Processing Agreement with Moodle and also with their own students, employees or customers.", "quote": "If you obtain products or services directly from us on behalf of others we will ensure you enter into a Data Processing Agreement (DPA) with us. You will also need to enter into a DPA with your students/employees/customers when using our systems." }, { "date": "2026-11-03", "text": "The notice does not cover self-hosted Moodle installations, where requests go to the organisation controlling the site.", "quote": "Where we are not involved with your personal data, such as where the Moodle software has been self-hosted, you should address your requests to the Data Controller of the website since we have no access to your personal data." } ] } ] }, "humans": { "slug": "moodle", "checked": "2026-11-03", "company": "Moodle Pty Ltd", "people": [ { "name": "Martin Dougiamas", "role": "Founder and Chairperson", "founder": true, "bio": "Martin Dougiamas founded Moodle, whose first release was 1.0 on 20 August 2002, and chairs the board of Moodle Pty Ltd. The company's about page dates Moodle's beginnings to 1999.", "bioSources": [ "https://moodle.com/about/leadership/", "https://moodle.com/about-us/", "https://moodledev.io/general/releases" ], "page": "/people/martin-dougiamas/" }, { "name": "Scott Anderberg", "role": "Chief Executive Officer", "bio": "Scott Anderberg is chief executive of Moodle Pty Ltd and a member of its board, per the leadership page.", "bioSources": [ "https://moodle.com/about/leadership/" ], "page": "/people/scott-anderberg/" }, { "name": "Marie Achour", "role": "Chief Product Officer", "bio": "Marie Achour is chief product officer of Moodle Pty Ltd, per the leadership page.", "bioSources": [ "https://moodle.com/about/leadership/" ], "page": "/people/marie-achour/" } ], "peopleNote": "From moodle.com/about/leadership/, read 3 November 2026, which lists the board (Martin Dougiamas, Pierre Guerin, Gary Cige, Scott Anderberg, Rohan Hardie) and the senior leadership team (Scott Anderberg, Marie Achour, Liz Carlin, Dan Lehner, Tamara Smith, Rohan Hardie). The page links no personal LinkedIn or X accounts, so none is recorded. The company is Moodle Pty Ltd of West Perth, Australia, a certified B Corporation per moodle.com. Ownership is private. The one outside investment found is from Education For The Many, which Moodle's own MoodleNet sustainability page (docs.moodle.org, last edited 25 March 2019) records as received in 2017; the amount ($6 million for a minority stake and a board seat) comes from EdSurge's report of 2 October 2017, and no moodle.com announcement was found on the news hub or by search.", "companySocial": { "linkedin": "https://www.linkedin.com/company/moodle", "x": "https://x.com/moodle", "github": "https://github.com/moodle" }, "support": { "emails": [ "privacy@moodle.com" ], "urls": [ "https://docs.moodle.org/en/", "https://moodle.org/security/report/", "https://status.moodlecloud.com/" ], "community": [ { "label": "moodle.org community forums", "url": "https://moodle.org/", "kind": "forum" }, { "label": "Moodle developer docs", "url": "https://moodledev.io/", "kind": "link" } ], "contactUrls": [ "https://moodle.com/contact/" ] }, "sources": [ "https://moodle.com/about/leadership/", "https://moodle.com/about-us/", "https://moodle.com/privacy-notice/", "https://moodle.org/.well-known/security.txt", "https://docs.moodle.org/dev/MoodleNet/Sustainability", "https://www.edsurge.com/news/2017-10-02-the-world-s-most-popular-lms-provider-moodle-raises-money-for-the-1st-time" ], "ownership": { "status": "private", "totalRaised": { "amount": "$6M", "asOf": "2017-10-02", "source": "https://www.edsurge.com/news/2017-10-02-the-world-s-most-popular-lms-provider-moodle-raises-money-for-the-1st-time" }, "checked": "2026-11-03", "sources": [ "https://moodle.com/about-us/", "https://moodle.com/about/leadership/", "https://docs.moodle.org/dev/MoodleNet/Sustainability" ] }, "investors": [ { "name": "Education For The Many", "kind": "corporate", "rounds": [ "2017 minority investment" ], "source": "https://docs.moodle.org/dev/MoodleNet/Sustainability", "quote": "the investment we received in 2017 from Education For The Many", "page": "/investors/education-for-the-many/" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/moodle.json", "live": { "slug": "moodle", "probe": { "target": "https://\u003csite\u003e/webservice/rest/server.php", "method": "get", "lastAt": "2026-11-04T19:34:55.482445256Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 43, "samples30d": 43, "days": [ { "date": "2026-11-04", "probes": 43, "ok": 0 } ], "outages": [ { "start": "2026-11-04T15:25:33.426772381Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "vendorStatus": { "page": "https://status.moodlecloud.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:09.831975618Z" }, "securityTxt": { "url": "https://moodle.org/.well-known/security.txt", "state": "valid", "expires": "2027-05-10T01:00:00.000Z", "checkedAt": "2026-11-04T15:54:22.866105142Z" }, "updatedAt": "2026-11-04T19:34:55.482445256Z" } }, "verify": { "accepts": "a page on moodle.org or moodle.com or one of their subdomains, or the README at the root of github.com/moodle/moodle", "badgeUrl": "https://www.anchorterminal.com/badges/moodle.svg", "body": { "slug": "moodle", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/moodle", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/moodle\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/moodle.svg\" alt=\"Moodle on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Moodle on Anchor Terminal](https://www.anchorterminal.com/badges/moodle.svg)](https://www.anchorterminal.com/tools/moodle)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/moodle\"\u003eMoodle on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/moodle", "json": "https://www.anchorterminal.com/tools/moodle.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/moodle.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/moodle#pricing", "reviews": "https://www.anchorterminal.com/tools/moodle#reviews", "slim": "https://www.anchorterminal.com/tools/moodle.min.md" }, "markdown": "## Overview\n\n**Grade B · 67.7/100 · rank #280 of 1349 · #1 in Learning, tutoring \u0026 assessment · not agent-ready · confidence medium**\n\n\n## Assessment\n\nFree GPL software with about 800 typed web service functions over courses, quizzes, assignments and grades, a six-monthly release train with dated security advisories, and in 5.3 a scoped REST API with expiring tokens. An administrator must enable the services and issue tokens, the classic token travels in the query string, and no public OpenAPI file exists without a site.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Moodle Pty Ltd (https://moodle.com) |\n| Kind | HTTP API |\n| Category | Learning, tutoring \u0026 assessment (https://www.anchorterminal.com/categories/learning) |\n| Transport | HTTP |\n| Endpoint | `https://\u003csite\u003e/webservice/rest/server.php` |\n| Auth | OAuth or key · Classic web services use a token tied to a user and a service. An administrator enables web services and the REST protocol, creates a service with chosen functions, authorises users and makes the token under Manage tokens, with optional IP restriction and a valid-until date; users with the capability can also fetch one from login/token.php with a username and password. The token travels as the `wstoken` parameter in the query string or POST body. Moodle 5.3 (5 October 2026) adds a REST API at /api/rest/v2 with personal access tokens (scoped, expiring after 7 days to 1 year, shown once, revocable, with last-use IP) and OAuth 2 clients an administrator registers, enforced by scopes such as core_user:user:read in addition to capabilities (https://docs.moodle.org/503/en/REST_API_tokens). |\n| Pricing | Free (Free · OSS) · Moodle LMS is free software under GPL-3.0-or-later, installed and run by the owner. Moodle Pty Ltd's hosted MoodleCloud plans are public, billed yearly in Australian dollars, from Starter at AUD 230 (USD 160) a year for 50 users and 1GB to Standard at AUD 3,000 (USD 2,090) for 750 users and 50GB, with a 28-day trial of Starter that needs no card; MoodleCloud sites cannot install plugins, and whether they allow web services was not established. Partner hosting is quoted (https://www.moodlecloud.com/standard-plans/). |\n| x402 | No · No x402, MPP or L402 in the web services documentation, the routing and scopes docs or MoodleCloud's pages (checked 2026-11-03). |\n| Licence | GPL-3.0-or-later |\n| Tools exposed | 0 |\n| Source | https://github.com/moodle/moodle |\n| Docs | https://moodledev.io/docs/6.0/apis/subsystems/external |\n| llms.txt | not found |\n| Last release | 2026-10-05 |\n| Surface listed | Moodle LMS's web services (external functions over REST) and the 5.3 REST API, as run on an owner's own site, read from moodledev.io, docs.moodle.org, moodle.org, moodle.com, moodlecloud.com, the Moodle marketplace and the moodle/moodle repository feeds on 3 November 2026. No site was installed and no call was made |\n| Endpoints | https://\u003csite\u003e/webservice/rest/server.php for classic functions (wsfunction, wstoken, moodlewsrestformat); https://\u003csite\u003e/api/rest/v2/\u003ccomponent\u003e/... for the 5.3 REST API; https://\u003csite\u003e/login/token.php to fetch a token with a username and password |\n| Functions | About 800 to 900 across core_course, core_user, core_enrol, core_grades, core_message, core_calendar, core_competency, mod_quiz, mod_assign, mod_forum, mod_lesson, mod_workshop, gradereport_* and gradingform_*; 5.3 adds assignment overrides, multiple-marker feedback and forum read-state functions |\n| Tokens | Classic tokens per user and service, created by an administrator or through login/token.php, with IP restriction and valid-until; 5.3 personal access tokens with scopes and expiry, shown once, with last-use time and IP, and OAuth 2 clients registered by an administrator |\n| Hosting | Self-hosted (PHP, PostgreSQL 17 or MariaDB 11.4 and up for 5.3), MoodleCloud from Moodle Pty Ltd, or certified partners; MoodleCloud's status page runs on Uptime Kuma |\n| Deprecation | Three stages (initial, final, removal) tied to major versions, upgrade notes required; external functions are removed at final deprecation with no stub |\n| MCP | None from Moodle HQ. The marketplace plugin webservice_mcp by an individual maintainer and community servers in the official registry are third-party |\n| Company | Moodle Pty Ltd, West Perth, Australia, founded by Martin Dougiamas (chairperson), CEO Scott Anderberg, a certified B Corporation; minority investment from Education For The Many in 2017 |\n| Capabilities | learning.lms, learning.courses, learning.quiz, learning.progress |\n| Tags | self-hosted, open-source, official, free, oauth, security-txt, gpl |\n| JSON | https://www.anchorterminal.com/api/v1/tools/moodle.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-11-03 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 80 | 16.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 66 | 10.7 |\n| Agent ergonomics | 13% | 16.2 | 49 | 8.0 |\n| Security \u0026 auth | 14% | 17.5 | 67 | 11.7 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 81 | 7.1 |\n| Transparency \u0026 trust (editorial 76, provenance 76) | 7% | 8.8 | 76 | 6.7 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **67.7 → B** |\n\n### Why each score\n\n- Reliability 80 (checked 2026-11-03): Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 66 (checked 2026-11-03): Function definitions are machine-readable inside a site (the generated API Documentation page for classic functions, SwaggerUI for the 5.3 REST API), but no OpenAPI or similar file is published without a site (15 of 25). No llms.txt on moodledev.io or docs.moodle.org (0). Each function and parameter carries a description, and the developer docs explain when to write a service and how to validate context (14 of 20). PARAM_* types, required, optional and default flags, nested structures, and scope declarations on 5.3 routes (13 of 15). curl samples and sample clients in several languages, but the error response shape was not documented on the pages read (9 of 15). Release notes per version, an \"introduced in\" column in the function list and a written deprecation policy (15). 15 + 0 + 14 + 13 + 9 + 15 = 66.\n- Agent ergonomics 49 (checked 2026-11-03): About 800 to 900 functions, but a service can expose only the functions an agent needs and each call names one function, so the working set is small (20 of 25). Paging and filtering vary by function; course and user lookups take criteria and some take limits, read only in the catalogue (10 of 20). The REST protocol returns an exception, errorcode and message object on failure, and the 5.3 API returns OAuth2 access_denied with a hint naming the missing scope; the classic shape was not read first-hand on this pass (8 of 20). No idempotency keys; many functions are creates and updates (5 of 20). Required parameters vary by function; no official SDK, only sample clients and community libraries (6 of 15). 20 + 10 + 8 + 5 + 6 = 49.\n- Security \u0026 auth 67 (checked 2026-11-03): Two credential models. The classic token is one secret per user and service with no scopes, documented in the `wstoken` query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67.\n- Payments \u0026 pricing 60 (checked 2026-11-03): Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 81 (checked 2026-11-03): Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81.\n- Transparency \u0026 trust 76 (checked 2026-11-03): GPL-3.0-or-later source (30). Privacy notice last updated October 2025 with a DPA and a GDPR register, no fixed retention periods, and for a self-hosted site the owner is the controller (18 of 30). A written deprecation policy with three stages tied to major versions and upgrade notes, plus a dated release and support calendar to 2029 (20). Sites may register with moodle.org and send statistics, and the AI subsystem names its providers; the privacy notice names no subprocessors or data locations (8 of 20). 30 + 18 + 20 + 8 = 76.\n\nFix list, everything this grade says the listing lacks, the biggest gain first (18 items). What it covers is at https://www.anchorterminal.com/fixes/moodle.md (JSON https://www.anchorterminal.com/fixes/moodle.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{\"listing\": \"moodle\", \"plan\": \"read\"}`, free while the beta runs\n\n### What we couldn't check\n\n- unchecked: whether MoodleCloud plans allow web services and token creation, since the plans page says only that plugins and integrations cannot be installed.\n- unchecked: the classic REST error envelope (exception, errorcode, message) and per-function paging, which were not read first-hand on this pass; the function list page is the read-only 3.11-era wiki.\n- unchecked: the moodle/moodle GitHub Actions status on main and the open issue count; the repository feed gave the last commit date (30 October 2026) only, and the GitHub API was rate-limited.\n- unchecked: the MoodleCloud terms of service, which its site does not link, and the status page's history.\n- Which parts of Moodle the 5.3 REST API covers; the user docs say only a few, with more planned, and the per-component route list was not read.\n- firstReleased is Moodle 1.0 on 20 August 2002 from the releases page; the web services framework arrived later (the function list's \"introduced in\" column starts at 2.x).\n- Investors. Moodle's own MoodleNet sustainability page records an investment received in 2017 from Education For The Many; the amount and stake are reported only by press, so the humans file names the investor from the Moodle page and the figure from EdSurge as press.\n- The audit's lead, \"external services API, administrator setup\", holds; it predates the 5.3 personal access tokens and OAuth 2 server of 5 October 2026.\n\n### Sources\n\n- external services overview: \u003chttps://moodledev.io/docs/apis/subsystems/external\u003e (seen 2026-11-03)\n- external function definitions: \u003chttps://moodledev.io/docs/6.0/apis/subsystems/external/functions\u003e (seen 2026-11-03)\n- external function security: \u003chttps://moodledev.io/docs/6.0/apis/subsystems/external/security\u003e (seen 2026-11-03)\n- web service API function list: \u003chttps://docs.moodle.org/dev/Web_service_API_functions\u003e (seen 2026-11-03)\n- creating a web service client: \u003chttps://docs.moodle.org/dev/Creating_a_web_service_client\u003e (seen 2026-11-03)\n- enabling web services and creating tokens: \u003chttps://docs.moodle.org/en/How_to_create_and_enable_a_web_service\u003e (seen 2026-11-03)\n- REST API tokens (5.3): \u003chttps://docs.moodle.org/503/en/REST_API_tokens\u003e (seen 2026-11-03)\n- personal access tokens (5.3): \u003chttps://docs.moodle.org/503/en/Personal_access_tokens\u003e (seen 2026-11-03)\n- routing subsystem: \u003chttps://moodledev.io/docs/5.3/apis/subsystems/routing\u003e (seen 2026-11-03)\n- routing scopes: \u003chttps://moodledev.io/docs/5.3/apis/subsystems/routing/scopes\u003e (seen 2026-11-03)\n- releases and support calendar: \u003chttps://moodledev.io/general/releases\u003e (seen 2026-11-03)\n- Moodle 5.3 release notes: \u003chttps://moodledev.io/general/releases/5.3\u003e (seen 2026-11-03)\n- deprecation policy: \u003chttps://moodledev.io/general/development/policies/deprecation\u003e (seen 2026-11-03)\n- security process: \u003chttps://moodledev.io/general/development/process/security\u003e (seen 2026-11-03)\n- security advisories: \u003chttps://moodle.org/security/\u003e (seen 2026-11-03)\n- security.txt: \u003chttps://moodle.org/.well-known/security.txt\u003e (seen 2026-11-03)\n- privacy notice: \u003chttps://moodle.com/privacy-notice/\u003e (seen 2026-11-03)\n- MoodleCloud plans: \u003chttps://www.moodlecloud.com/standard-plans/\u003e (seen 2026-11-03)\n- MoodleCloud home: \u003chttps://www.moodlecloud.com/\u003e (seen 2026-11-03)\n- MoodleCloud status page (Uptime Kuma): \u003chttps://status.moodlecloud.com/\u003e (seen 2026-11-03)\n- webservice_mcp marketplace plugin (third-party): \u003chttps://marketplace.moodle.com/plugins/webservice_mcp\u003e (seen 2026-11-03)\n- moodle/moodle tags and main commit feed: \u003chttps://github.com/moodle/moodle/commits/main.atom\u003e (seen 2026-11-03)\n- about page and leadership: \u003chttps://moodle.com/about/leadership/\u003e (seen 2026-11-03)\n- robots.txt: \u003chttps://moodle.org/robots.txt\u003e (seen 2026-11-03)\n- official MCP registry search (community servers only): \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=moodle\u003e (seen 2026-11-03)\n- RDAP for moodle.org: \u003chttps://rdap.publicinterestregistry.org/rdap/domain/moodle.org\u003e (seen 2026-11-03)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/moodle/history.json\n\n- 2026-11-03: graded 67.7 B (methodology 0.7)\n\n## Who's behind it (provenance 76/100, checked 2026-11-03)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Moodle Pty Ltd | 20/20 |\n| Domain age | moodle.org, registered 2002-04-02 (24 years) | 15/15 |\n| Endpoint on the vendor's domain | \u003csite\u003e is not on moodle.org | 0/15 |\n| Terms of service | not found | 0/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.moodlecloud.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n| People named | 3 named with their role, none with a public profile | 7/10 |\n| Support route | a support address, help pages, a community | 5/5 |\n\nMoodle Pty Ltd is named in the privacy notice (last updated October 2025, PO Box 303, West Perth) and in the trademark notice on moodle.com. The software licence is GPL-3.0-or-later, which stands in for terms; no terms of service for self-hosted use exist, and MoodleCloud's site links only cookie, privacy and trademark policies.\n\nThe privacy notice links a standard data processing agreement (February 2026 PDF) and a register of GDPR information, and names dpo@moodle.com and privacy@moodle.com.\n\nmoodle.org/.well-known/security.txt names the report form at moodle.org/security/report/ and the policy at moodledev.io/general/development/process/security, with Expires 10 May 2027.\n\nmoodle.org/robots.txt disallows search pages and /plugins/*/*, sets Content-Signal ai-train=no, search=yes, ai-input=no and asks for a 10-second crawl delay; docs.moodle.org asks for 5 seconds. Both were followed. moodledev.io, moodle.com and www.moodlecloud.com allow all.\n\nThe endpoint sits on each owner's own site, not on a Moodle domain, so endpointOnVendorDomain is false. status.moodlecloud.com (Uptime Kuma) covers MoodleCloud only.\n\nRDAP at Public Interest Registry gives moodle.org a registration date of 2 April 2002; moodle.com dates from 22 February 1999.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0.\n\n\n**Privacy policy** (https://moodle.com/privacy-notice/), read 2026-11-03, dated 2025-10-01, states 8 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2025-10-01.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. privacy@moodle.com.\n- Also in the text (2026-11-03). Customers buying on behalf of others must sign a Data Processing Agreement with Moodle and also with their own students, employees or customers. \"If you obtain products or services directly from us on behalf of others we will ensure you enter into a Data Processing Agreement (DPA) with us. You will also need to enter into a DPA with your students/employees/customers when using our systems.\"\n- Also in the text (2026-11-03). The notice does not cover self-hosted Moodle installations, where requests go to the organisation controlling the site. \"Where we are not involved with your personal data, such as where the Moodle software has been self-hosted, you should address your requests to the Data Controller of the website since we have no access to your personal data.\"\n\n## Humans behind the project (researched 2026-11-03 from public pages, not part of the grade)\n\n### Key people\n\n- Martin Dougiamas, Founder and Chairperson\n- Scott Anderberg, Chief Executive Officer\n- Marie Achour, Chief Product Officer\n- Note: From moodle.com/about/leadership/, read 3 November 2026, which lists the board (Martin Dougiamas, Pierre Guerin, Gary Cige, Scott Anderberg, Rohan Hardie) and the senior leadership team (Scott Anderberg, Marie Achour, Liz Carlin, Dan Lehner, Tamara Smith, Rohan Hardie). The page links no personal LinkedIn or X accounts, so none is recorded. The company is Moodle Pty Ltd of West Perth, Australia, a certified B Corporation per moodle.com. Ownership is private. The one outside investment found is from Education For The Many, which Moodle's own MoodleNet sustainability page (docs.moodle.org, last edited 25 March 2019) records as received in 2017; the amount ($6 million for a minority stake and a board seat) comes from EdSurge's report of 2 October 2017, and no moodle.com announcement was found on the news hub or by search.\n- Moodle Pty Ltd: LinkedIn https://www.linkedin.com/company/moodle X https://x.com/moodle GitHub https://github.com/moodle\n\n### Ownership and investors\n\n- Raised: $6M in total, as of October 2017 (source https://www.edsurge.com/news/2017-10-02-the-world-s-most-popular-lms-provider-moodle-raises-money-for-the-1st-time)\n- Backed by: Education For The Many\n\n### Getting support\n\n- Support email: privacy@moodle.com\n- Help: https://docs.moodle.org/en/\n- Help: https://moodle.org/security/report/\n- Help: https://status.moodlecloud.com/\n- Community (moodle.org community forums): https://moodle.org/\n- Community (Moodle developer docs): https://moodledev.io/\n- Sources: https://moodle.com/about/leadership/, https://moodle.com/about-us/, https://moodle.com/privacy-notice/, https://moodle.org/.well-known/security.txt, https://docs.moodle.org/dev/MoodleNet/Sustainability, https://www.edsurge.com/news/2017-10-02-the-world-s-most-popular-lms-provider-moodle-raises-money-for-the-1st-time\n\n## Live (updated 2026-11-04 19:34 UTC)\n\n- Right now: down, n/a, checked 2026-11-04 19:34 UTC (get on `https://\u003csite\u003e/webservice/rest/server.php`)\n- Uptime 24h 0.0% (43 probes) · 30 days 0.0% (43 probes) · p50 n/a · p95 n/a\n- Vendor status page: unknown, no machine-readable status found\n- security.txt: valid, expires 2027-05-10T01:00:00.000Z\n- Always current: https://www.anchorterminal.com/api/v1/live/moodle.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| MoodleCloud Starter (50 users, 1GB), yearly | $13.33 | per month (plan) | USD 160 a year (AUD 230); hosted by Moodle Pty Ltd, plugins not installable |\n| MoodleCloud Standard (750 users, 50GB), yearly | $174.17 | per month (plan) | USD 2,090 a year (AUD 3,000) |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- About 800 to 900 external functions with typed, described parameters and returns, generated into a reference on every site\n- Moodle 5.3 adds personal access tokens with scopes and 7-day to 1-year expiry, OAuth 2 clients and a SwaggerUI for the new REST API\n- Services can expose only chosen functions to authorised users, with IP restriction and expiry on tokens\n- Releases every April and October, point releases every two months, 5.3 LTS supported with security fixes to October 2029\n- Ten dated security advisories with CVEs between 9 September and 15 October 2026, under GPL-3.0-or-later source\n\n## Weaknesses\n\n- A site administrator has to enable web services, build a service and issue a token before any call; nothing is self-serve\n- The classic token goes in the `wstoken` query or POST parameter, is all-powerful within the user's capabilities and has no scopes\n- No public OpenAPI or llms.txt; the machine-readable reference exists only inside a running site\n- The 5.3 REST API reaches only a few parts of Moodle, so most work still goes through the classic functions\n- No official client SDK or MCP server from Moodle HQ; sample clients and community servers only\n\n\n\n## Before you call it (notes for agents)\n\n1. Ask the site administrator for a token on a custom service limited to the functions you need, with an IP restriction and a valid-until date; don't use the mobile service token for broader work\n2. Call https://\u003csite\u003e/webservice/rest/server.php with wsfunction, wstoken and moodlewsrestformat=json, sending the token in the POST body rather than the URL\n3. On a 5.3 site, prefer a personal access token or OAuth 2 client for the /api/rest/v2 routes it covers, and expect an access_denied error naming the missing scope\n4. Read each function's parameters in the site's API Documentation page; array parameters are flattened as users[0][username] in REST\n5. Check the site's Moodle version and the upgrade notes before relying on a function; deprecated external functions are removed outright\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X POST \"https://\u003csite\u003e/webservice/rest/server.php\" -d wstoken=\u003cTOKEN\u003e -d wsfunction=core_course_get_courses -d moodlewsrestformat=json\n```\n\nThrough letme: https://letme.dev/moodle (letme picks it for learning.courses, the top-graded tool for the job, letme picks it for learning.lms, the top-graded tool for the job, letme picks it for learning.progress, the top-graded tool for the job, letme picks it for learning.quiz, the top-graded tool for the job). letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Instructure Canvas | C | 59.5 | 622 | learning.lms, learning.courses, learning.quiz, learning.progress | no | https://www.anchorterminal.com/tools/canvas-lms.md |\n| Learnosity | C | 60.2 | 581 | learning.quiz, learning.progress, learning.courses | no | https://www.anchorterminal.com/tools/learnosity.md |\n| Kahoot! | C | 55.2 | 842 | learning.quiz, learning.progress, learning.lms | no | https://www.anchorterminal.com/tools/kahoot.md |\n| Quizgecko | F | 33 | 1263 | learning.quiz, learning.courses | no | https://www.anchorterminal.com/tools/quizgecko.md |\n| Preply | C | 57.4 | 741 | same category (Learning, tutoring \u0026 assessment) | no | https://www.anchorterminal.com/tools/preply.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Each external function is a class with execute_parameters(), execute() and execute_returns(), typed with PARAM_* values, VALUE_REQUIRED, VALUE_OPTIONAL or VALUE_DEFAULT and nested single and multiple structures, with descriptions; a running site publishes the generated reference under Site administration, Server, Web services, API Documentation (source: \u003chttps://moodledev.io/docs/6.0/apis/subsystems/external/functions\u003e)\n- The function catalogue runs to about 800 to 900 functions across core_course, core_user, core_grades, mod_quiz (start, save and process attempts, best grade), mod_assign (assignments, submissions, grades) and more; XML-RPC was removed from core in 4.1 and REST answers XML or JSON by moodlewsrestformat (source: \u003chttps://docs.moodle.org/dev/Web_service_API_functions\u003e)\n- Moodle 5.3 LTS (5 October 2026) adds an OAuth 2 server, personal access tokens and scoped routes for a REST API under /api/rest/v2, with a SwaggerUI reference under Site administration, Development; only a few parts of Moodle are reachable through it so far (source: \u003chttps://moodledev.io/general/releases/5.3\u003e)\n- Releases every six months (April and October) with point releases every two months; 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 on 5 October 2026, 5.3.x security fixes until 1 October 2029 (source: \u003chttps://moodledev.io/general/releases\u003e)\n- Ten security advisories from 9 September to 15 October 2026 (MSA-26-0036 to MSA-26-0045, three serious), with CVEs, fixes across supported branches and a Bugcrowd-linked report form; no paid bounty (source: \u003chttps://moodle.org/security/\u003e)\n- Deprecated external functions are marked with execute_is_deprecated() and removed outright at final deprecation, about two major versions after the deprecation; every deprecation needs an upgrade note (source: \u003chttps://moodledev.io/general/development/policies/deprecation\u003e)\n- No Moodle HQ MCP server found. A third-party marketplace plugin, webservice_mcp (last release 23 July 2026, 644 installs), turns external functions into MCP tools over JSON-RPC, and community Moodle MCP servers sit in the official registry under individual namespaces (source: \u003chttps://marketplace.moodle.com/plugins/webservice_mcp\u003e)\n- moodle.org/robots.txt carries Content-Signal ai-train=no, search=yes, ai-input=no and a 10-second crawl delay; moodledev.io and moodle.com allow all (source: \u003chttps://moodle.org/robots.txt\u003e)\n\n- #1 of 6 in Best learning, tutoring and assessment tools for AI agents: https://www.anchorterminal.com/best/learning/index.md\n- All 10 learning comparisons: https://www.anchorterminal.com/compare/learning/index.md\n\n## Compare\n\n- [Kahoot! vs Moodle](https://www.anchorterminal.com/compare/kahoot-vs-moodle.md): C 55.2 vs B 67.7\n- [Learnosity vs Moodle](https://www.anchorterminal.com/compare/learnosity-vs-moodle.md): C 60.2 vs B 67.7\n- [Moodle vs Quizgecko](https://www.anchorterminal.com/compare/moodle-vs-quizgecko.md): B 67.7 vs F 33\n- [Instructure Canvas vs Moodle](https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.md): C 59.5 vs B 67.7\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on moodle.org or moodle.com or one of their subdomains, or the README at the root of github.com/moodle/moodle. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"moodle\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/moodle\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/moodle.svg\" alt=\"Moodle on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Moodle on Anchor Terminal](https://www.anchorterminal.com/badges/moodle.svg)](https://www.anchorterminal.com/tools/moodle)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/moodle\"\u003eMoodle on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Moodle is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/moodle-dark.png\n- Light: https://www.anchorterminal.com/assets/share/moodle-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Learning, tutoring \u0026 assessment", "url": "https://www.anchorterminal.com/categories/learning" }, { "name": "Moodle", "url": "" } ], "description": "Moodle is an open-source learning management system that schools and companies run themselves or through MoodleCloud. Its web services expose 800 functions for courses, quizzes, assignments and grades, and Moodle 5.3 adds a scoped REST API with personal access tokens.", "facts": [ "rank #280 of 1349", "OAuth or key auth", "0 desk reviews" ], "h1": "Moodle", "image": "https://www.anchorterminal.com/assets/og/tools-moodle.png", "path": "/tools/moodle", "published": "2026-10-01", "section": "tools", "title": "Moodle review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/tools/moodle" }, "tokens": { "markdown": 8050, "slim": 1730 }, "version": 1 }