Docs

Getting started

Sign in at /sign-in. The workspace opens on Home: your next exam, study queues, activity, and courses. Set up your academic plan under Planning — pick a known programme or upload a curriculum, transcript, or screenshots and review the extracted draft before anything is saved.

• Courses — maintained material per course: chapters, mastery items, mock exams, tutorials.
• Practice — questions, flashcards, mistakes, and timed mocks in one place.
• Calendar — month, week, day, and agenda views over your exams, deadlines, institution dates, and timetable feeds; search and filter by type or course.
• Planning — programme, courses and attempts, documents, progress, and the scenario planner.
• Tutor — saved conversations, source-backed answers, approved study actions and shared context.
• Settings — connections, AI allowance, API access, AI activity and data export/reset.
• Account — your profile.

Studying

Course material. Search and filter the original files in a course’s Materials tab. Select a title to preview notebooks, code, ZIP contents, spreadsheets or slide text. Notebook code is never executed; spreadsheets show saved values, and large previews are explicitly limited. Download the original for complete data or exact Office layout. The file’s More menu opens feedback.

Open a chapter to read it with the outline and the source-grounded tutor. Every published question can be answered and graded; answers below 7/10 go to the mistake bank, and every graded question joins the spaced-repetition deck. Mastery on each course item is yours to set. Activity (answers, reviews, mocks, resolved mistakes, chapters read) feeds the streak and weekly totals on Home.

AI supports Tutor, requested practice and diagnostics, document reading and course-rule extraction; allowances are shown under Settings → AI usage.

Documents and calendars

Manage → Documents accepts a transcript, exam schedule, timetable, academic calendar, curriculum, or an .ics file at any time. The reader proposes a change set for results, grades, exam dates, courses, events, and programme details. Only the lines you select are applied. Reading the same document again proposes nothing that is already in your plan, while the revision desk retains the dated parsed versions.

Calendar links (https://… or webcal://… feeds) are managed in Settings → Connections. Saved links show their last sync and can be refreshed or removed. Institution-wide dates maintained for your programme appear read-only in Calendar with an “Add to my plan” action.

Academic transcripts and Academic Work documents are read for structured updates; their originals are not stored. Private Tutor attachments and course source uploads retain their originals for later retrieval and can be removed separately. Document reads count against the intake allowance; calendar feeds do not use AI.

Course requests and ingestion

When a current course has no maintained content, Home still shows the course and opens a request page. You can attach slides, a syllabus or course manual, practice sheets, past or mock exams, images, notes, and public URLs. These files are private intake by default. A separate optional checkbox lets you offer them for shared editorial review, records why you may provide them, and can be withdrawn from the request; original files are never published automatically.

A request follows eight explicit gates: collect and verify, extract and normalise, map the course, build the course-scoped retrieval index, create study pages, create exercises and mocks, quality review, and publish and maintain. The versioned course map also records evidence-backed assessment components, weights, minimums, deadlines, pass rules, attendance requirements, and resit rules from the syllabus and introductory deck. Missing or contradictory rules remain flagged for human review.

API keys

Create keys under Settings → API access. A key acts as you, limited to its scopes: read (every GET), write (study mutations and plan changes), admin (editorial content; administrators only). Keys are shown once and stored hashed; they cannot manage other keys, reset data, or delete the account.

curl -H "Authorization: Bearer wsk_…" https://study.wicker.life/api/courses

Connect your agent

Use https://study.wicker.life/api/mcp with Streamable HTTP over HTTPS. This is the recommended connection for Codex, Claude Code and other compatible clients. No Wicker npm package, Node.js installation or separate skill download is needed.

Codex

codex mcp add wicker-study --url https://study.wicker.life/api/mcp
codex mcp login wicker-study --scopes read,write

Complete sign-in and approve the displayed permissions in your browser. Restart your agent session to load the connection.

Claude Code

claude mcp add --scope user --transport http wicker-study https://study.wicker.life/api/mcp

Open Claude Code, run /mcp, select wicker-study and authenticate. Sign in to Wicker Study and review the requested permissions.

Already using the package? Remove the old registration before adding the hosted connection. Use the scope where the Claude entry was installed; project or local scope may override user scope. Your account and study data stay in place.

# Codex
codex mcp remove wicker-study

# Claude Code (standard user installation)
claude mcp remove --scope user wicker-study

For another client, enter the HTTPS URL and choose OAuth. The client needs Streamable HTTP and OAuth dynamic client registration with PKCE. API-key clients can instead use a scoped key in the Bearer authorization header. Never put credentials in a chat or URL. Manage connected services; revoke old package keys separately in API access if nothing still uses them.

Updates: tools and workflow guidance update on the server. Reconnect to refresh discovery, then call wicker_status and wicker_guidance. No separate package or skill update is required for hosted connections. Request and transport token budgets apply; respect Retry-After when limited.

Local work: an agent with shell and file access can parse documents, inspect folders, verify hashes and generate study content itself. The hosted study_generation_* tools provide the current prompts, evidence and schemas and accept the results. Your own model costs apply; these local generation steps do not call Wicker’s hosted model.

Download originals: call prepare_original_download for a direct transfer using the agent’s own HTTP/file tools. It returns a URL and a temporary file-scoped header, with size and SHA-256 verification and resumable ranges. Keep that capability and binary bytes out of chat/logs. Downloads expire after ten minutes and support originals up to 1 GiB, with a separate 4 GiB daily account budget. File bytes do not consume MCP text-token budgets. read_original_chunk remains a fallback.

Official client instructions: Codex MCP configuration · Claude Code MCP configuration.

Optional discovery skill

MCP supplies its current workflow guide through wicker_guidance and wicker://guidance/current. You do not need an installed skill to use the connection. The optional SKILL.md is a small hint that helps an agent discover Wicker Study; it is not a separately maintained copy of the pipeline instructions.

After connecting, ask the agent to call wicker_status, wicker_guidance and list_courses. Reconnect after platform updates to refresh tool discovery and guidance.

Tutor and shared context

Tutor keeps conversations and retrieves relevant past discussions within your account and active programme. It checks indexed documents and Canvas announcements, including explicit later amendments to course rules. Answers show a short summary, source-backed widgets and reviewable actions; secondary catch-up is collapsed. Live activity and partial text appear while an answer is prepared, then the saved final answer replaces them.

MCP includes focused tools for full assignment briefs/comments, actual source passages, announcements, attendance coverage, study work, practice readiness, diagnostics, saved conversations and private sources. Use prepare_original_download and the agent’s HTTP/file tools for a verified, resumable original download. The optional helper’s download_course_original remains available to local clients. Indexed passages are not the complete original. Prefer these direct reads to a hosted tutor_ask call for a simple lookup. In-app Docs lists the tools.

Every individual write needs explicit confirmation. Connecting an account is not approval for later changes. The MCP workflow guide instructs the agent to proactively propose updates for lasting preferences, project decisions and availability, without waiting for a reminder. It checks existing context and saves only after confirmation. For preferences or availability, read tutor_sources, call tutor_prepare_context, show the exact wording/dates/weekdays, then call tutor_confirm_update only after approval. For attendance, start with get_attendance and tutor_prepare_attendance_update using actual completed-session IDs. Prepared reviews expire after 30 minutes; retries return the same receipt.

“I work Tuesdays and Fridays this semester” can become dated availability shared with future Tutor conversations, without another model call. It guides advice and never marks a class missed automatically. Inspect and remove preferences, availability or other context in Tutor → Sources. Expired context stops contributing. Tasks, project milestones and focused practice use concrete proposed actions; email drafts are never sent and Canvas work is never submitted by Tutor.

Reconnect hosted MCP to refresh tools and call wicker_guidance for the current workflows. No separate skill update is required.

AI activity

Settings → AI activity shows requests that reach Wicker through your personal API keys from this release onward. Filter reads, writes, prepared changes and failures; inspect the time, tool/client label, HTTP result, duration and server-confirmed review reference.

Tool names and client-reported confirmation are labelled separately from authenticated key identity and confirmed reviews. One tool can make multiple requests. Earlier requests and local operations that never reach Wicker are not reconstructed. Arguments, query text, responses and credentials are excluded. Activity is private, included in account export, and removed with account-data erasure.

Canvas updates

Assignment links open Updates with independently loaded instructions, due/unlock dates, submission status, rubric, grade and submission comments. Attachment downloads and inline document annotations may still open in Canvas; personal task completion does not change Canvas submission status.

With collection enabled, automatic refresh defaults to every 30 minutes for announcements and assignments, and every six hours for materials. Change both frequencies or turn automation off in Settings → Connections → Manage → Automatic refresh. Course selection follows period transitions without opening the app. During breaks, including summer, it watches the ending year and newly available next-year courses. Marking your programme completed pauses automation; change it back when studying resumes. A missing active programme also pauses it. Retakes refresh only the latest current edition. Historical editions remain searchable and manually syncable. Paused courses and withdrawn consent are respected; unchanged versioned files reuse saved originals and indexes. These intervals schedule work and do not guarantee upstream completion time.

Canvas sync has individual Stop/Retry controls and a log portal. Retries resume stored checkpoints rather than discarding completed downloads.

Once a Canvas connection is saved in Settings → Connections, Updates in the sidebar becomes a read-only board over your Canvas account: announcements, assignments with their submission state, Canvas course events, and — where your institution publishes them — current grades. Nothing is written back to Canvas, and nothing is copied into your academic record.

Which courses count as current. A Canvas course stays readable for years after teaching stops, so its own end date says nothing about whether you are taking it. Wicker Study uses the teaching term instead, plus any course you have starred on your Canvas dashboard, plus the standing faculty and programme spaces that have no term at all. Starring a course in Canvas is therefore the way to keep a retake or a course you are still finishing on the board. All courses widens the board to every enrolment.

Filter by course, search the text, choose how far back to look (14 days to a year), and sort by date, course, title, points, or status. Assignment statuses distinguish graded, submitted, missing, overdue, upcoming, undated, excused, and items Canvas never receives — an in-class checkpoint or a project defence carries points and a date but cannot be handed in through Canvas, so it is never reported as missing.

Canvas deadlines and Canvas course events also appear on Calendar as their own categories, alongside your exam attempts, personal events, institution calendar, and timetable feeds. Announcement bodies are stripped of scripts and framing on the server and re-checked against a tag allow-list in the browser before they are shown.

Answers are cached for ten minutes per account, so the board refreshes itself without re-polling Canvas on every visit; Refresh bypasses the cache.

Import a Canvas course

Students connect Canvas in Settings → Connections, then use canvas_sync_course through hosted MCP to queue an accessible course edition. Read the saved materials with canvas_course_materials and download originals with prepare_original_download. The following local-folder workflow is part of the optional administrator/import toolkit: canvas_import_remote_course uses the encrypted account connection, and admin_import_canvas_course supports separate administrator imports. It downloads files and creates readable records for pages, assignments, discussions, quizzes, and external links; it does not crawl linked third-party sites. The default is local-only, so you can inspect the generated README.md and hidden import manifest before anything reaches Wicker Study.

For the separate local terminal/administrator workflow, the command prompts for the course URL and destination folder, then asks you to copy the token and press Return. On macOS, it reads the clipboard once and stores the token only in your user Keychain, scoped to the Canvas host, so later local imports reuse it.

# Local terminal prompts: URL and folder; then copy the token and press Return
npm run canvas:sync

# Or pre-fill the URL and output folder; a hidden token prompt still appears when needed
npm run canvas:sync -- \
  --course-url https://canvas.maastrichtuniversity.nl/courses/25806/modules \
  --output /absolute/path/to/BCS-course-canvas

# a configured MCP agent supplies courseUrl + outputFolder and reuses this Mac's
# host-scoped Keychain token; accessTokenEnv remains an explicit alternative

# Remove the saved Keychain token for one Canvas host
npm run canvas:sync -- --forget-token --course-url https://canvas.maastrichtuniversity.nl/courses/25806/modules

To submit the snapshot, explicitly set syncToWicker: true, rightsConfirmed: true, and dryRun: false. Files arrive as private rights-review candidates; accepting, extracting, generating, and publishing are all separate admin actions. Re-run the importer into the same folder whenever new weekly material is published, then sync only the changed files.

HTTP API

One JSON API serves the web app, agents, and administrators. Send Content-Type: application/json; errors return { "error": "…" } with 401 (key), 403 (scope), 404, 409 (stale revision), or 501 (editorial write without a hosted database). The complete, versioned list of endpoints with body shapes is at /api/agent/manifest.

Security

Protected API routes need a session or a scoped, expiring API key stored as a hash. Requests are rate-limited per IP and per identity (tighter budgets for mutations, AI routes, uploads, key minting, and account resets), failed authentication is throttled, cookie-authenticated mutations must originate from this site, HTML is served with a strict Content Security Policy and HSTS, and server-side fetches of user-supplied URLs are confined to public hosts. Report a suspected vulnerability privately to security@study.wicker.life. Details: docs/SECURITY.md in the repository.

Feedback and review

Use Feedback in workspace navigation or report an issue from Tutor, course material, assignments, announcements, practice or syncs. Review exactly what will be shared before submitting. Attach up to four screenshots or paste and edit relevant Tutor conversation text; these attachments are optional, and the full conversation and private originals are not forwarded. My feedback shows public replies and status, and lets you withdraw shared attachments.

Helpful/not-helpful ratings send only the rating and answer reference. Diagnostic and optional timing preferences are in My feedback. Local agents use the same prepare and individually confirmed submit workflow. Reviewers work in Admin → Feedback review.

Administrators

The fixed owner account is an administrator. Additional administrators are configured either with Clerk user IDs in ADMIN_USER_IDS or through the Clerk private-metadata role wickerStudyRole: "admin". Administration → Programmes → a course → Production provides a private versioned workspace for source manifests, rights decisions, extraction and OCR, assessment mapping, token estimates, generated drafts, evidence review, quality reports, and explicit publication. The same workflow is available through the admin API and MCP, including direct local-folder synchronisation and the local Canvas importer for Claude or Codex. Legacy active-release endpoints remain for small reviewed corrections; new or substantially updated courses should use the staged workspace.

# Codex
codex mcp add wicker-study-admin -- npx -y wicker-study-mcp@2.20.0

# Claude Code
claude mcp add --scope user wicker-study-admin -- npx -y wicker-study-mcp@2.20.0