0.1.4 — let your agent set it up

Give your agent a link and let it handle the first steps:

https://liltaket.github.io/folava-mcp/install.md

The homepage now puts a copyable setup prompt and guide link first. The guide installs this published wheel, preserves existing MCP configuration and starts with a synthetic demo. Real Canvas authentication remains a separate private step; credentials stay outside the conversation.

• Friendlier homepage language, with manual commands still available.
• Light, Dark and System themes, keyboard access, reduced motion and mobile layouts retained.
• Anonymized public validation narratives and package metadata. The website uses fictional examples and has no connection to a student account.
• New publication tripwires for common credential, private-path and email patterns, alongside manual review. These are not a general personal-data detector or a claim that historical copies have been erased.

Validation: 254 local tests; Ruff; Chromium prompt/link copying and denied-clipboard recovery; 16 generated pages/94 operations; installed-wheel official SDK stdio checks; independent current-tree/site/package privacy review. The wheel/source archive metadata and all 87 text members passed the scoped privacy checks. All six hosted platform jobs passed on main after an explicit UTF-8 test-fixture correction. That correction changes test decoding only; package runtime is unchanged. Pages deployment passed, and public-network checks verified the guide, copying controls, themes and release digests.

uv tool install --force https://github.com/liltaket/folava-mcp/releases/download/v0.1.4/folava_mcp-0.1.4-py3-none-any.whl

Includes the stricter read boundaries from 0.1.3. No new Canvas resource capability is added. Ordinary Canvas logs/derived-state updates remain possible on GET; unchanged remote state is not promised.

Independent development preview, Apache-2.0. No PyPI publication, Instructure approval, complete institution compatibility, real OAuth consent or full Codex/T3 GUI validation is claimed.

0.1.3 — stricter reads and coherent themes

Superseded by 0.1.4. Use the current release before connecting a real account. It includes the stricter GET boundary introduced in 0.1.3 and anonymized public documentation. Some older uploaded downloads have been withdrawn during privacy cleanup. Original validation notes below describe the earlier preview.

Upgrade from earlier previews before connecting a real account. Canvas GET requests can have side effects; this release tightens the resource policy substantially.

• Removed assignment/module-item detail routes that can record progress, quiz-submission reads that can grade or repair records, and both submission read-state includes. Supported collections provide the safer alternatives.
• Conservatively removed direct page/front-page reads after an unresolved live progress observation. Page bodies remain available through permitted page collections. Revision-detail reads with a repair-write branch are also excluded.
• Attachment content now uses the fixed, permission-checked public URL API and direct S3 REST storage only, without Canvas authorization or cookies. Canvas UI, InstFS, CDN, custom and local-storage fallback downloads fail closed.
• Added persistent System, Light and Dark themes, subtle motion, reduced-motion support and expanded keyboard/mobile/contrast checks.
• Added an opt-in, bounded live-check harness and a scenario guide with actual Canvas/stdio evidence and explicit limitations.

Validation: 247 local tests; Ruff; 15 generated pages/94 operations; Chromium theme, storage, keyboard, mobile, copy and search scenarios; built wheel/source distribution; installed-wheel official SDK stdio smoke; independent Sol and GPT-6 Astra reviews. A dated pip-audit check found no known advisories in 45 runtime dependencies selected on Linux. All six hosted jobs passed on Linux Python 3.11–3.14, Windows 3.14 and macOS 3.14: CI evidence. Pages build and deployment also passed.

Real Canvas reads and SDK stdio initialization worked. No live attachment content was downloaded. One module-requirement comparison was inconclusive; no completion transition or page causality was established. Canvas can record access logs and refresh derived state on GET. This release does not promise unchanged account state.

Install or replace an older isolated installation:

uv tool install --force https://github.com/liltaket/folava-mcp/releases/download/v0.1.3/folava_mcp-0.1.3-py3-none-any.whl

Guide · Test evidence · Read-safety review

Independent development preview, Apache-2.0. No PyPI publication, Instructure approval, complete institution compatibility, real OAuth consent or full Codex/T3 GUI validation is claimed.

Folava MCP 0.1.2 — desktop authentication fixes

Superseded by 0.1.4. Use the current release before connecting a real account. It includes the stricter GET boundary introduced in 0.1.3 and anonymized public documentation. Some older uploaded downloads have been withdrawn during privacy cleanup. Original validation notes below describe the earlier preview.

Folava MCP 0.1.2 fixes two desktop authentication problems found by expanded hosted CI:

• OAuth loopback startup no longer performs reverse DNS for its numeric address. On macOS that lookup could delay callback readiness.
• Windows profile and poll locks no longer write a lock byte before acquiring the byte-range lock. Concurrent token refreshes now wait instead of failing with access denied.

Includes all 0.1.1 read-path/auth/event hardening and the documentation site at https://liltaket.github.io/folava-mcp/.

Validation: 187 local tests passed, including a deterministic no-reverse-DNS regression and actual local HTTP/TLS fixtures. The wheel/source builds and standalone wheel MCP handshake passed. GitHub Pages was tested through the real public URL in Chromium; tab switching, catalog search and documentation navigation worked on mobile. The software suite also runs on Linux Python 3.11–3.14, Windows 3.14 and macOS 3.14; inspect CI for the exact tagged revision.

Install the attached wheel with uv tool install ./folava_mcp-0.1.2-py3-none-any.whl; use --force to replace an older isolated tool installation.

Independent development preview, Apache-2.0. Live institution Canvas auth, real keyring/browser consent and full Codex/T3 UI flows remain separate, unverified evidence. No Canvas writing capability is added.

Folava MCP 0.1.1 — hardening and documentation

Superseded by 0.1.4. Use the current release before connecting a real account. It includes the stricter GET boundary introduced in 0.1.3 and anonymized public documentation. Some older uploaded downloads have been withdrawn during privacy cleanup. Original validation notes below describe the earlier preview.

This preview is superseded by 0.1.2, which fixes macOS OAuth callback startup and Windows concurrent credential refresh. Use 0.1.2 or newer.

Folava MCP 0.1.1 expands validation and fixes concrete read-path, authentication and change-feed bugs.

• Stricter pagination parsing and finite, complexity-bounded JSON handling.
• Correct handling of quiz submission envelopes, partial downloads and IDN origins.
• Multicast destination rejection and removal of signed attachment URLs from default HTTPX request logs.
• OAuth callback parsing, scope validation, symlink handling and refresh/storage failure coverage.
• Meaningful URL changes remain visible in the change feed.
• A more realistic demo plus one-client agenda reads with a 45-second total deadline and preserved partial results.
• GitHub Pages with install commands, canonical documentation and a searchable catalog generated from the software registry. Deployment verifies its selected installer is already published.

Validation: 186 local tests passed, including real localhost HTTP/TLS fixtures, concurrent refresh and transactional failure tests. Chromium checks passed for keyboard tabs, clipboard success/failure, catalog search/details/empty states, docs navigation and 320/390-pixel layouts. The release wheel was built and exercised through the official MCP SDK outside the source tree. CI and Pages workflow results are linked from the repository; local evidence does not replace those results.

Install the attached wheel with uv tool install ./folava_mcp-0.1.1-py3-none-any.whl. With uv's isolated tool installation already present, add --force when replacing an older Folava install.

This remains an independent development preview. No live institution Canvas account, real OS-keyring/browser consent or complete Codex/T3 UI workflow was used. See the authentication and deployment-limit documentation. No Canvas-writing tools, hosted service or automatic agent wake-up are introduced.

Folava MCP 0.1.0 — development preview

Superseded by 0.1.4. Use the current release before connecting a real account. It includes the stricter GET boundary introduced in 0.1.3 and anonymized public documentation. Some older uploaded downloads have been withdrawn during privacy cleanup. Original validation notes below describe the earlier preview.

Folava MCP is a personal-first, read-only connection between Canvas LMS and agent clients.

This first development preview includes:

• 103 reviewed operation IDs for courses, assignments, your submissions and feedback, modules, pages, discussions, calendars, groups, files and more.
• Eight MCP tools with structured output, provenance, explicit pagination and bounded results.
• Institution-managed OAuth, secure local credential storage, personal development-token mode and credential-free client configuration.
• Protected attachment reads and local export; transactional polling with replayable JSONL events.
• A synthetic demo requiring no account, Linux/macOS/Windows setup guidance, and Apache-2.0 licensing.

Install from the wheel below with uv tool install ./folava_mcp-0.1.0-py3-none-any.whl, or follow the repository's source-install instructions. Start with folava-mcp --help and folava-mcp serve --demo. The package is not published on PyPI.

Validation: 116 local tests passed, real SDK stdio and controlled TLS certificate tests passed, wheel/source builds passed, and a standalone wheel MCP call passed. Independent Sol and Astra findings were addressed with regression tests. GitHub CI passed for Linux Python 3.11–3.14, Windows 3.14 and macOS 3.14 on the released source revision.

This is an independent development preview, not an official or approved Canvas integration. Live institution OAuth, unread-state comparison and full Codex/T3 UI workflows have not been validated. Current Instructure API policy explicitly addresses MCP approval; see the documented deployment limits. Personal testing and hosted/multi-user deployment are distinct. No hosted service or automatic agent wake-up is included.

Files: universal Python wheel, source distribution and SHA-256 checksums. Requires Python 3.11+.