Security model

The design keeps writes off by default and never shares a password.

Writes are gated

Read tools are always registered. Write tools exist only when MOODLE_ALLOW_WRITE=true, so a misconfiguration cannot silently expose destructive operations.

Token, never a password

The AI authenticates with a web service token that an admin generates. The token is read from the environment only and is never logged. It is sent to Moodle over HTTPS.

Capability-scoped

The token is bound to one Moodle user. The AI can only do what that user's capabilities allow. Use a dedicated service account with least privilege.

Upgrade-safe plugin

The plugin uses Moodle's own add_moduleinfo() helper and never touches activity tables directly, so it survives upgrades.