Skip to content

Releases: JohannsenLum/canvas-api-mcp

Release list

v0.0.2

v0.0.2 Latest
Latest

Choose a tag to compare

View all tags
@JohannsenLum JohannsenLum released this 07 Aug 16:54
v0.0.2
a1a4d68

Bug fixes, security hardening, and the first external contributions.

📖 Documentation · uvx canvas-api-mcp

Fixed

  • whats_due now honours days. It accepted the horizon, echoed it back, and filtered nothing — asking for 1 day returned items due a year out. Reported by @jiahao6635 in #11. Undated work is kept and flagged undated: true rather than dropped, since a to-do with no due date is still outstanding.
  • canvas_request can reach Canvas GraphQL — /api/graphql was being rewritten to /api/v1/graphql. (#1)
  • The missing-token error names your own Canvas instead of printing a literal <your-canvas> placeholder.

Security

_normalise_path now rejects absolute URLs of any scheme, .. traversal, CR/LF header smuggling, backslashes, and empty input. It's the single place a caller-supplied string becomes a request URL, and canvas_request takes arbitrary paths from a model while a bearer token rides on every request.

Changed

  • whoami reads GET /users/self/profile and returns calendar_feed_url — thanks @basil-boh (#12). That .ics URL is credential-bearing; moving it out of whoami is tracked in #13.
  • Windows and Linux client config paths documented, stating only what could be verified. (#5)

Added

Animated header demonstrating the gateway, plus SECURITY.md, CONTRIBUTING.md, issue/PR templates, and examples/ with validated per-client configs.

126 tests, up from 97.

Full changelog: https://github.com/JohannsenLum/canvas-api-mcp/blob/main/CHANGELOG.md

Contributors

jiahao6635 and basil-boh
Assets 2
Loading

v0.0.1 — first release

v0.0.1 — first release

Choose a tag to compare

View all tags
@JohannsenLum JohannsenLum released this 07 Aug 10:23
v0.0.1
c113b86

First release. Student-scoped, personal use. Early software — the version number is deliberate.

An MCP server for Canvas LMS: 15 curated tools for everyday student work, plus a 2-tool gateway reaching all 1,116 endpoints on a stock Instructure deployment.

📖 Documentation · install guide · tool reference

Install

claude mcp add canvas -s user \
  -e CANVAS_BASE_URL=https://canvas.yourschool.edu \
  -e CANVAS_TOKEN=your-token \
  -- uvx canvas-api-mcp

You need a Canvas personal access token — the install guide walks through creating one, and your institution must allow students to create them.

What's in it

  • 17 tools — whats_due, my_grades, list_assignments, get_assignment, my_submission, submit_assignment, course_announcements, course_content, list_files, read_file, get_page, read_discussion, post_discussion_reply, whoami, my_courses, plus search_canvas_api + canvas_request
  • 3 Agent Skills — npx skills add JohannsenLum/canvas-api-mcp
  • 3 prompts, 3 resources
  • Endpoint catalog generated from your own instance's OpenAPI spec
  • RFC 5988 Link pagination with explicit truncation, rate-limit throttling, and error translation
  • 97 tests, green on Python 3.11 and 3.12

Known limitations

  • No curated educator tools. Not a capability gap — Canvas enforces permissions per token, so the gateway works with a teacher token today.
  • Personal use only. Canvas's API Policy requires OAuth for multi-user apps, and Canvas OAuth supports neither PKCE nor public clients, so locally-installed software can't implement it. See Compliance.
  • GraphQL unreachable via canvas_request — #1
  • No init command yet — #6

Contributions welcome, including four issues tagged good first issue.

Loading