Officially published on Moodle.org: local_mrca 🎉
MRCA is a multi-layered risk analysis engine for Moodle™. It scans installed plugins for security risks, privacy compliance gaps, outdated dependencies, and permission misconfigurations — providing administrators with a unified Site Risk Index and actionable alerts.
By default, MRCA only scans third-party plugins. Core Moodle modules and the MRCA plugin itself are excluded to avoid false positives and self-flagging.
Moodle™ is the most widely adopted LMS in the world, with strong presence in European universities and institutions where GDPR (General Data Protection Regulation) compliance is mandatory. Yet there is no built-in mechanism to audit installed plugins for privacy risks, deprecated code, or permission misconfigurations.
MRCA was built to fill this gap — giving administrators a proactive compliance tool instead of relying on reactive audits.
- European universities and schools subject to GDPR
- Corporate Moodle administrators managing large plugin ecosystems
- IT compliance teams needing automated risk assessments
- Moodle hosting providers offering security guarantees
- Any institution in the EU/EEA, UK, or jurisdictions with similar data protection laws (LOPDGDD in Spain, CNIL in France, etc.)
| Feature | Description |
|---|---|
| Privacy Scanner | PII detection, Privacy API compliance, encryption checks |
| Dependency Scanner | Version compatibility, deprecated APIs, outdated plugins |
| Structural Scanner | Code quality, unsafe PHP functions, plugin structure |
| Capability Scanner | Role permissions, privilege escalation risks |
| Correlation Engine | Cross-layer systemic risk detection |
| Site Risk Index | Normalized 0–100 score with 5-level classification |
| Dashboard | Interactive charts, trends, heatmaps, alerts |
| Reports | PDF, CSV, and JSON export |
| Integrations | Webhook and MIH support for SIEM/SOC |
| Privacy API | GDPR-compliant data handling |
- Copy
mrca/tolocal/mrca/in your Moodle directory. - Run
php admin/cli/upgrade.phpor visit Site Administration → Notifications. - Go to Site Administration → Server → MRCA → Dashboard.
# CLI scan
php local/mrca/cli/run_scan_cli.php
# Or use the dashboard: click "Scan Now"Scheduled scans run daily at 2 AM via Moodle cron.
Site Administration → Server → MRCA → Settings:
| Setting | Description | Default |
|---|---|---|
| Auto-scan new plugins | Scan on plugin install/enable | Off |
| Scan core plugins | Include Moodle HQ modules | Off |
| High risk threshold | Score for "high risk" | 60 |
| Medium risk threshold | Score for "medium risk" | 30 |
| Integration method | Webhook / MIH / Disabled | Disabled |
Full documentation in English and Spanish is available in the docs/ directory:
GNU License. See LICENSE.