Canvas MCP Server v2.3.0

Security and disclosure history

This project is an independent MCP server for Canvas LMS APIs. It is not affiliated with, endorsed by, or maintained by Instructure or Canvas.

In June 2025, during development of this MCP, I identified a Broken Access Control issue in the Canvas environment at bootcampspot.instructure.com. The issue exposed personally identifiable information for other students enrolled in my course.

I reported the issue through Bugcrowd on June 5, 2025, and also contacted Instructure / Canvas security channels directly. The Bugcrowd report was later closed as "Not Applicable." In subsequent correspondence, Instructure stated that the bootcampspot.instructure.com environment was outside its control.

Public references:

• Disclosure thread: https://www.reddit.com/r/cybersecurity/comments/1t6wmkw/reported_a_broken_access_control_bug_to/
• Bugcrowd activity timeline: https://imgur.com/gallery/canvas-vuln-declared-n-11-months-ago-zYfHnBs
• Later Instructure / BootcampSpot correspondence: https://imgur.com/a/BnhgXme

This repository does not publish exploit steps, affected tenant details beyond what is already public, live URLs, screenshots containing student data, or proof-of-concept abuse flows.

Separately, Instructure publicly disclosed a Canvas security incident in May 2026, and public reporting has linked the incident to ShinyHunters claims. This repository makes no claim that the June 2025 report caused, enabled, predicted, or is technically connected to the May 2026 incident.

This disclosure is documented here for project history and transparency only.

What this is

A comprehensive Model Context Protocol (MCP) server for Canvas LMS with complete student, instructor, and account administration functionality

🚀 What's New in v2.3.0

• 🌐 NEW: Streamable HTTP transport support (MCP_TRANSPORT=streamable-http)
• 🖥️ Preserved: First-class stdio transport for local MCP clients
• 🧪 Added: Behavior tests for lifecycle, transports, and structured failure-path errors
• 🧱 Improved: Stricter tool schemas and codemode-oriented tool descriptions
• 🔧 FIXED: Course creation "page not found" error (missing account_id parameter)
• 👨‍💼 Account Management: Complete account-level administration tools
• 📊 Reports & Analytics: Generate and access Canvas account reports
• 👥 User Management: Create and manage users at the account level
• 🏢 Multi-Account Support: Handle account hierarchies and sub-accounts
• ✅ API Compliance: All endpoints now follow proper Canvas API patterns

🎯 Key Features

🎓 For Students

• Course Management: Access all courses, syllabi, and course materials
• Assignment Workflow: View, submit (text/URL/files), and track assignments
• Communication: Participate in discussions, read announcements, send messages
• Progress Tracking: Monitor grades, module completion, and calendar events
• Quizzes: Take quizzes, view results and feedback
• File Access: Browse and download course files and resources

👨‍🏫 For Instructors

• Course Creation: Create and manage course structure (now with proper account support)
• Grading: Grade submissions, provide feedback, manage rubrics
• User Management: Enroll students, manage permissions
• Content Management: Create assignments, quizzes, discussions

👨‍💼 For Account Administrators (NEW!)

• Account Management: Manage institutional Canvas accounts
• User Administration: Create and manage users across accounts
• Course Oversight: List and manage all courses within accounts
• Reporting: Generate enrollment, grade, and activity reports
• Sub-Account Management: Handle account hierarchies and structures

🛠️ Technical Excellence

• Robust API: Automatic retries, pagination, comprehensive error handling
• Cloud Ready: Docker containers, Kubernetes manifests, health checks
• Well Tested: Unit tests, integration tests, mocking, coverage reports
• Type Safe: Full TypeScript implementation with strict types
• 50+ Tools: Comprehensive coverage of Canvas LMS functionality

Quick Start

Option 1: Claude Desktop Integration (Recommended MCP Setup)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "canvas-mcp-server": {
      "command": "npx",
      "args": ["-y", "canvas-mcp-server"],
      "env": {
        "CANVAS_API_TOKEN": "your_token_here",
        "CANVAS_DOMAIN": "your_school.instructure.com"
      }
    }
  }
}

Option 2: NPM Package

# Install globally
npm install -g canvas-mcp-server

# Configure
export CANVAS_API_TOKEN="your_token_here"
export CANVAS_DOMAIN="your_school.instructure.com"

# Run
canvas-mcp-server

Option 3: Docker

docker run -d \
  --name canvas-mcp \
  -p 3000:3000 \
  -e CANVAS_API_TOKEN="your_token" \
  -e CANVAS_DOMAIN="school.instructure.com" \
  -e MCP_TRANSPORT="streamable-http" \
  -e MCP_HTTP_HOST="0.0.0.0" \
  -e MCP_HTTP_PORT="3000" \
  -e MCP_HTTP_PATH="/mcp" \
  ghcr.io/dmontgomery40/mcp-canvas-lms:latest

Transport Modes

The server supports two explicit transport modes:

• stdio (default): best for Claude Desktop/Codex/Cursor local MCP wiring.
• streamable-http: best for local HTTP integrations and containerized workflows.

Transport environment variables

# Required Canvas auth
CANVAS_API_TOKEN=your_token
CANVAS_DOMAIN=your_school.instructure.com

# Transport selection
MCP_TRANSPORT=stdio # or streamable-http

# Streamable HTTP settings
MCP_HTTP_HOST=127.0.0.1
MCP_HTTP_PORT=3000
MCP_HTTP_PATH=/mcp
MCP_HTTP_STATEFUL=true
MCP_HTTP_JSON_RESPONSE=true
MCP_HTTP_ALLOWED_ORIGINS=

💼 Account Admin Workflow Examples

Create a New Course (FIXED!)

"Create a new course called 'Advanced Biology' in account 123"

Now properly creates courses with required account_id parameter

Manage Users

"Create a new student user John Doe with email john.doe@school.edu in our main account"

Creates user accounts with proper pseudonym and enrollment setup

Generate Reports

"Generate an enrollment report for account 456 for the current term"

Initiates Canvas reporting system for institutional analytics

List Account Courses

"Show me all published Computer Science courses in our Engineering account"

Advanced filtering and searching across account course catalogs

🎓 Student Workflow Examples

Check Today's Assignments

"What assignments do I have due this week?"

Lists upcoming assignments with due dates, points, and submission status

Submit an Assignment

"Help me submit my essay for English 101 Assignment 3"

Guides through text submission with formatting options

Check Grades

"What's my current grade in Biology?"

Shows current scores, grades, and assignment feedback

Participate in Discussions

"Show me the latest discussion posts in my Philosophy class"

Displays recent discussion topics and enables posting responses

Track Progress

"What modules do I need to complete in Math 200?"

Shows module completion status and next items to complete

Getting Canvas API Token

1. Log into Canvas → Account → Settings
2. Scroll to "Approved Integrations"
3. Click "+ New Access Token"
4. Enter description: "Claude MCP Integration"
5. Copy the generated token Save securely!

⚠️ Account Admin Note: For account-level operations, ensure your API token has administrative privileges.

Production Deployment

Docker Compose

git clone https://github.com/DMontgomery40/mcp-canvas-lms.git
cd mcp-canvas-lms
cp .env.example .env
# Edit .env with your Canvas credentials
docker-compose up -d

Kubernetes

kubectl create secret generic canvas-mcp-secrets \
  --from-literal=CANVAS_API_TOKEN="your_token" \
  --from-literal=CANVAS_DOMAIN="school.instructure.com"

kubectl apply -f k8s/

Health Monitoring

# Check application health
curl http://localhost:3000/health

# Or use the built-in health check
npm run health-check

Development

# Setup development environment
git clone https://github.com/DMontgomery40/mcp-canvas-lms.git
cd mcp-canvas-lms
npm install

# Start development with hot reload
npm run dev:watch

# Run tests
npm run test
npm run coverage

# Code quality
npm run lint
npm run type-check

📚 Available Tools (50+ Tools)

• canvas_health_check - Check API connectivity
• canvas_list_courses - List all your courses
• canvas_get_course - Get detailed course info
• canvas_list_assignments - List course assignments
• canvas_get_assignment - Get assignment details
• canvas_submit_assignment - Submit assignment work
• canvas_get_submission - Check submission status
• canvas_list_modules - List course modules
• canvas_get_module - Get module details
• canvas_list_module_items - List items in a module
• canvas_mark_module_item_complete - Mark items complete
• canvas_list_discussion_topics - List discussion topics
• canvas_get_discussion_topic - Get discussion details
• canvas_post_to_discussion - Post to discussions
• canvas_list_announcements - List course announcements
• canvas_get_user_grades - Get your grades
• canvas_get_course_grades - Get course-specific grades
• canvas_get_dashboard - Get dashboard info
• canvas_get_dashboard_cards - Get course cards
• canvas_get_upcoming_assignments - Get due dates
• canvas_list_calendar_events - List calendar events
• canvas_list_files - List course files
• canvas_get_file - Get file details
• canvas_list_folders - List course folders
• canvas_list_pages - List course pages
• canvas_get_page - Get page content
• canvas_list_conversations - List messages
• canvas_get_conversation - Get conversation d