Common Cartridge viewer for safer LMS preflight

A practical guide to local package inspection

How this Common Cartridge viewer works

An IMS Common Cartridge file is a ZIP-based exchange package that usually ends in .imscc. Inside it, an imsmanifest.xml document describes course organizations, items, resources, and the files those resources expect. Cartridge Compass opens that package in your browser, validates conservative archive limits, reads the manifest, and turns the relationships into a human-readable inventory. The selected package is not sent to an upload service. This makes the viewer useful when a course designer, LMS administrator, or migration specialist needs an early structural check before attempting an import in a target system.

The result is a preflight report, not a rendered course and not an LMS emulator. You can see the declared cartridge version, counts for the main manifest objects, referenced local paths, and resource types. You can also download the same findings as JSON for your own local review. The report is designed to help locate concrete package work, such as a resource that names a missing file or an item that points to an identifier that does not exist.

What the IMSCC preflight checks

The first layer protects the browser from unexpectedly expensive or unsafe archive structures. Cartridge Compass caps compressed size, expanded size, individual entry size, entry count, and compression ratio. It rejects encrypted entries, ZIP64 packages, symbolic links, absolute paths, parent-directory traversal, backslashes, control characters, and case-colliding file paths. It also rejects XML documents that declare a DOCTYPE or entity, because this lightweight browser tool does not need those features to inventory a cartridge.

Manifest relationships and package inventory

After the archive passes those gates, the inspector locates the root manifest and records its metadata. It checks duplicate identifiers, organization-to-item relationships, item-to-resource references, declared file references, and resource entry-point hrefs. A referenced local file that is not present becomes an error. An external URL, an LTI dependency, or an unfamiliar resource type becomes a warning that needs target-LMS review rather than a claim that the package is broken.

How to inspect an authorized package

Start with a cartridge that you own or have permission to inspect. Drop the file onto the preflight panel or choose it with the file picker. The browser analyzes the package and replaces the built-in sample report with results for your selection. Review errors first, then warnings, then informational inventory. If you only want to understand the interface, reload the included sample fixture; it intentionally contains representative issues and does not include third-party course material.

A repeatable migration workflow

Treat the output as one step in a controlled migration. Save the JSON report locally, repair the source package or export settings, rerun the preflight, and finally import into a non-production sandbox for the exact LMS and version you intend to use. Keep the original cartridge unchanged so you can compare attempts. This sequence separates package-structure problems from target-system behavior and gives a migration team a small, reproducible checklist rather than a vague import failure.

Reading errors, warnings, and information

Errors identify conditions that Cartridge Compass can establish from the archive itself, such as a missing manifest, an unsafe ZIP path, a duplicate identifier, a missing referenced file, or an item whose resource identifier cannot be resolved. Warnings call attention to dependencies or compatibility questions that need context: web URLs can change, LTI links may require credentials or platform registration, and uncommon resource types may be handled differently by different LMS products. Information entries summarize what was found, including manifest version and inventory totals.

A large warning count is not automatically worse than a small one, and a zero-error report is not proof of a successful import. Read the actual messages, compare them with the manifest and source export, and confirm behavior in the destination platform. Cartridge Compass deliberately avoids a single pass/fail score because that would hide the difference between a deterministic missing file and a context-dependent external integration.

What Cartridge Compass does not guarantee

The tool does not authenticate to an LMS, execute course scripts, fetch external resources, verify LTI credentials, reproduce vendor-specific import transforms, or certify conformance with a 1EdTech specification. It is independent and is not affiliated with, endorsed by, or operated by an LMS vendor or standards body. A report cannot predict every accessibility, licensing, rendering, assessment, or enrollment issue that may appear after import. It also does not modify the cartridge or create a repaired copy.

Those limits are intentional. A small local inspector can be predictable about archive and manifest structure without pretending to know private platform configuration. Read more about the project and its boundaries on the About page, and review the conditions for authorized use in the Terms.

Privacy, limits, and responsible use

Course bytes, file names, paths, titles, manifest text, issue counts, and report details stay out of the analytics collector. The site records only four fixed anonymous funnel events: sample loaded, file selected, preflight completed, and report downloaded. Where a source is needed, it is limited to the fixed categories picker, drop, or sample. The collector rejects arbitrary event names and extra properties. The full boundary is documented in the Privacy notice.

Browser-local processing reduces exposure, but it does not replace your organization’s security and records-handling rules. Do not inspect a cartridge on an untrusted device, do not share exported reports without reviewing their local contents, and do not use the tool on material you are not authorized to access. If a package is close to the published safety limits, use a controlled desktop workflow and keep a known-good backup before making changes elsewhere.