v0.0.2

Bug fixes, security hardening, and the first external contributions.

📖 Documentation · uvx canvas-api-mcp

Fixed

• whats_due now honours days. It accepted the horizon, echoed it back, and filtered nothing — asking for 1 day returned items due a year out. Reported by @jiahao6635 in #11. Undated work is kept and flagged undated: true rather than dropped, since a to-do with no due date is still outstanding.
• canvas_request can reach Canvas GraphQL — /api/graphql was being rewritten to /api/v1/graphql. (#1)
• The missing-token error names your own Canvas instead of printing a literal <your-canvas> placeholder.

Security

_normalise_path now rejects absolute URLs of any scheme, .. traversal, CR/LF header smuggling, backslashes, and empty input. It's the single place a caller-supplied string becomes a request URL, and canvas_request takes arbitrary paths from a model while a bearer token rides on every request.

Changed

• whoami reads GET /users/self/profile and returns calendar_feed_url — thanks @basil-boh (#12). That .ics URL is credential-bearing; moving it out of whoami is tracked in #13.
• Windows and Linux client config paths documented, stating only what could be verified. (#5)

Added

Animated header demonstrating the gateway, plus SECURITY.md, CONTRIBUTING.md, issue/PR templates, and examples/ with validated per-client configs.

126 tests, up from 97.

Full changelog: https://github.com/JohannsenLum/canvas-api-mcp/blob/main/CHANGELOG.md