TCExam runs exams for schools, and it can score the paper ones too

An assessment system, not a quiz form builder

TCExam is a Computer-Based Assessment system, which the project spells out as CBA software for creating, distributing and managing exams, tests, surveys and quizzes, on screen or on paper. The stated audience is schools, universities, recruiting firms and private and public companies, and the people authoring the questions are professors, teachers and examiners.

Two features set it apart from a survey tool, and both are about exam integrity and paper.

The first is unique tests. TCExam can generate a different test for each user by randomly selecting and sorting questions and their alternative answers, which the readme says drastically reduces or eliminates the chances of cheating on the test. The second is paper testing with optical mark recognition. TCExam can generate printable PDF documents for pen-and-paper testing, and the OMR answer sheet can be scanned and uploaded for automatic importing, scoring and reporting. So a candidate who sits an exam on paper and a candidate who sits it on screen end up in the same scoring pipeline.

That second feature is also the answer to the traditional alternative. The project describes itself as simplifying the whole evaluation process compared with pen-and-paper testing, reducing costs and improving the quality and reliability of examinations, and the OMR path is how it reaches that claim without pretending the paper will disappear.

The rest of the feature list is broad: results pages with filters and statistical indexes, exports in several formats, delivery of a result by email or immediately on screen, multimedia question content with a common mark-up language, LaTeX and MathML support for mathematical formulas, and remote authentication through LDAP, RADIUS and CAS as well as single sign-on.

A LAMP stack application with PostgreSQL as an option

The architecture is described in the readme as web-based, and the details matter for whoever hosts it.

TCExam is a server-side PHP application that runs on a standard LAMP-style stack: Linux, Apache, MySQL or MariaDB or PostgreSQL, and PHP 8.2 or newer. Once it is installed on a server, any device on the network can use it through a normal web browser, independently of the client's operating system and with no additional software or plug-in to install on the clients. For an institution, that last part is the argument: the candidate's machine is a browser, nothing more.

The readme recommends Apache with mod_php, and the Dockerfile explains why in a comment: the app ships .htaccess access controls for the install, admin and backup directories, and nginx would silently ignore them. That is a concrete architectural decision rather than a preference, and it is the kind of detail that decides whether your reverse proxy needs rewriting.

Internationalisation is handled through UTF-8, Unicode and TMX, with right-to-left mode supported and translations in 26 languages. Accessibility is a first-class claim rather than an afterthought: the interface uses semantic HTML5 and follows the Web Content Accessibility Guidelines at WCAG 2.1 level AA, with landmarks, skip links, ARIA roles, labelled forms and screen reader cues.

For data interchange, TCExam uses open standard protocols, TSV, XML and PDF, all documented so external applications can extend or use them, and custom filters can be added to import data from other systems.

One make target, and the install runs itself

The recommended way to evaluate the project is the Docker route, and the readme is unusually clear about what it does for you.

make up            # or: docker compose up --build

That starts TCExam, which is Apache with PHP 8.4, on http://localhost:8080/ together with a MariaDB database, and it installs the application automatically. The container entrypoint runs the non-interactive installer, install/install_cli.php, using the database settings from docker-compose.yml, so there is no browser install step. On first start it also generates the PDF fonts and the translation caches in the background, which means PDF export becomes available once the font generation finishes rather than immediately.

The compose file shows the settings that drive it, all of them overridable through the environment.

      TCEXAM_DB_TYPE: MYSQL
      TCEXAM_DB_HOST: db
      TCEXAM_DB_PORT: "3306"
      TCEXAM_DB_NAME: tcexam
      TCEXAM_DB_USER: tcexam
      TCEXAM_DB_PASSWORD: tcexam
      TCEXAM_TABLE_PREFIX: tce_

The state that matters is kept in named volumes, so the installed instance survives docker compose down and up: the database, the PDF fonts, the cache, and the installed configuration including the per instance random K_RANDOM_SECURITY. Running docker compose down -v discards everything and starts fresh. The interactive web installer at /install/ stays available as a fallback, and for PostgreSQL you swap the db service for a postgres image and set TCEXAM_DB_TYPE=POSTGRESQL with TCEXAM_DB_PORT=5432 on the app service.

The credentials that ship are the obvious weak point. The readme says to log in under admin/code/ with the default user admin and the password 1234, and to change it immediately.

A manual install is composer, make lang and four writable directories

For institutions that already run PHP under their own web server, the manual path is short and documented.

You install PHP 8.2 or newer with the extensions listed under Requirements, plus a web server, with Apache and mod_php recommended, and a database. Then you install the dependencies and build the bundled assets.

   composer install   # also generates the PDF fonts via the post-install hook
   make lang          # pre-build the translation caches (optional; built lazily otherwise)

The composer step does double duty, because a post-install hook generates the PDF fonts, and make lang pre-builds the translation caches, which the readme notes is optional because they are built lazily otherwise.

Then you point the web server document root at the project directory and make four directories writable by the web user: cache/, install/, admin/backup/ and the parents of the */config/ directories. Finally you run the installer and delete the install directory afterwards, which the readme marks in bold because leaving a live installer on a public server is the kind of thing that ends badly.

That last step is worth remembering as a general rule for this project: TCExam is a server application with a setup phase, and the setup phase has to be closed when it is finished.

The Makefile and the per database test stack

The Makefile is a developer's tool rather than a build system for a compiled binary, and it shows the project's conventions.

It reads the project version and the packaging release number from the VERSION and RELEASE files in the repository root, sets the Docker image tag from the owner and project name, and defines the source directories the project owns, admin, public, shared and index.php, explicitly excluding the bundled third-party libraries. The default port for the development web server is 8080, overridable through PORT.

The test side is the part worth noting. The database engine used by the integration tests is selected by DB_TYPE, defaulting to mysql, and the compose invocation for the test stack combines a base file with a per-database override, docker-compose-test.yml plus docker-compose-test.mysql.yml or docker-compose-test.postgres.yml. It is isolated under its own compose project name so it never clashes with the development stack, and the host uid and gid are passed into the test container so copied-back reports stay owned by the user rather than by root.

The repository also carries an unusual set of quality configuration for a PHP project: mago configuration files for analysis and lint with baselines, a phpcompatinfo.json for tracking PHP version compatibility, phpunit.xml.dist for the unit tests, separate compose files for MySQL and PostgreSQL integration runs, a test.integration.Dockerfile, and a CODEOWNERS file. Two things are missing from the picture, and they are worth noting because they are the kind of gap that shows up in an evaluation: there is no Dockerfile for a production-like build separate from the demo one, and the readme does not describe a supported upgrade path from one release to the next.

AGPL-3.0-or-later, a security channel and a busy release line

The licence is the one that needs a decision. The readme states that TCExam is copyright 2004 to 2026 Nicola Asuni of Tecnick.com LTD and is distributed under GNU AGPL-3.0-or-later, with the LICENSE file at the repository root. The badge in the readme says the same thing. The project describes the AGPL as a feature rather than a constraint, arguing that open source promotes reliability and quality by supporting independent peer review and rapid evolution of the source code.

For a school or a company running this on its own infrastructure, the network clause of the AGPL is the part to think about if you ever expose a modified version to users over a network. That is a question for your own counsel rather than for a review, and the point here is simply that the terms are copyleft and not permissive.

The security channel is defined and sensible. Security reports go to SECURITY.md, and the readme asks explicitly that no public issue be opened, which is what you want from a system that holds exam data.

On activity, the record is busy. The repository is not archived and the last push was on 2026-10-17, the same day as the 17.3.1 and 17.3.0 releases, with 17.2.12 a few days before that. Two releases on one day is a project shipping fixes as they are made rather than on a schedule, and the CHANGELOG and VERSION and RELEASE files at the root are where the detail lives.

Editorial conclusion

TCExam fits an educational institution that already runs its own infrastructure and wants an assessment system it can configure deeply, including a path that keeps printed exams in the same workflow through OMR scanning. It is a poor fit for a small team that wants a hosted product with nothing to operate, and it is a poor fit if your staff are not prepared to change the admin password and the database credentials that the quick start ships with. Check first that PHP 8.2 or newer and an Apache or equivalent stack are available to you, that the OMR workflow matches how your exams are actually collected, and that the AGPL-3.0-or-later terms fit how you intend to run it.

Frequently asked questions

Official sources

1. Issues
2. Project website
3. README
4. Releases
5. tecnickcom/tcexam on GitHub