Remind from the shell

Remind's web app talks to a single GraphQL endpoint, POST https://www.remind.com/graphql. That endpoint is reachable server-side — no bot wall — so only the credential needs the browser. Capture it once with fpx, then use curl for everything.

Introspection is enabled, so the schema is self-documenting: you can discover any field without guessing (and you should — see the validation-error gotcha below).

Auth model

Two headers, both lifted from a signed-in tab:

Both are required. Only x-csrf-token works — x-xsrf-token and csrf-token are rejected. A named cookie read (fpx cookies csrf_token) returns {} on this site, so header capture is the only route.

One-time setup

Install @fetchproxy/cli (npm i -g @fetchproxy/cli) and the ContextMint Bridge browser extension from https://github.com/nullnet-app/contextmint-bridge/releases (Chrome: load the Chrome zip unpacked; Safari isn't available yet, so use Chrome for now). It's the fetchproxy extension under its new name, same maintainer; source is public there — build it or verify the zip with shasum -a 256 -c contextmint-bridge-chrome-<version>.zip.sha256.

Declare the full scope before the first pairing — widening it later forces a re-pair:

fpx profile add remind --domain remind.com
fpx profile declare remind \
  --capture-header cookie@www.remind.com \
  --capture-header x-csrf-token@www.remind.com

Then capture. The capture waits for the next request the page makes, so load a Remind page while it waits:

fpx session -p remind > ~/.remind-fpx-session.json &   # approve the pair code in ContextMint Bridge
open "https://www.remind.com/"                          # feeds the capture
wait
chmod 600 ~/.remind-fpx-session.json

Use a session file of your own like this one. Do not write into ~/.remind-mcp/ — that is the MCP server's store, with a different schema; overwriting it corrupts its session.

The call pattern

rq() {  # rq '<query>' ['<variables json>']
  local S=~/.remind-fpx-session.json
  local body; body=$(Q="$1" V="${2:-{\}}" node -e '
    process.stdout.write(JSON.stringify({query:process.env.Q,variables:JSON.parse(process.env.V)}))')
  curl -s -X POST https://www.remind.com/graphql \
    -H 'content-type: application/json' \
    -H "cookie: $(node -e 'console.log(require(process.argv[1]).capturedHeaders.cookie)' "$S")" \
    -H "x-csrf-token: $(node -e 'console.log(require(process.argv[1]).capturedHeaders["x-csrf-token"])' "$S")" \
    --data-binary "$body"
}

rq '{ me { uuid first_name last_name email locale } }' | jq .data.me

Start from navigationList — it returns the uuids every other query needs. Ready-to-run documents with jq recipes are in references/graphql-queries.md.

Gotchas

• An expired session returns HTTP 200, with errors[0].message == "Unauthorized". Check the body, never the status. Re-run the capture above to refresh.
• "Unauthorized" also means "this account may not do that" — scheduled messages and org-admin queries are owner/teacher-only, and a subscriber (parent) account gets Unauthorized on them with a perfectly valid session.
• An unknown field reports as Internal service error / GRAPHQL_VALIDATION_FAILED with HTTP 500 metadata, not a readable "no such field". Do not guess field names — introspect:

  rq '{ __type(name:"Class"){ fields { name } } }' | jq -r '.data.__type.fields[].name'
  

• Check permissions.canSend before trying to send; most fields on a subscriber account are read-only.
• Writes deliver to real people and cannot be unsent. This skill is read-oriented on purpose; the mutation shapes live in the references file, clearly marked.