Canvas Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Canvas Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.admin978/canvas-mcp -->
Local-first MCP server for Canvas LMS. Stdio transport, no network round-trips beyond the official Canvas API.
Status: alpha. Single-user, no warranty, API surface may still shift. File issues if it breaks.
Canvas is built for instructors. As a student you get a fragmented UI, no cross-course search, and notifications that arrive late or never. This server exposes the Canvas REST API as MCP tools so you can drive the LMS from any MCP-compatible client (Claude Code, Claude Desktop, etc.).
[client] ──stdio──> [server.py] ──https──> [Canvas API]~/.canvas.env (chmod 600)list_courses, list_assignments, list_modules, list_announcements, get_page, get_file_info, get_grades, planner_items, upcoming_events, todo.
In Canvas: Account → Settings → Approved Integrations → + New Access Token. Copy the token shown — it is not retrievable afterwards.
From PyPI (recommended):
pip install canvas-local-mcpOr from source:
git clone https://github.com/admin978/canvas-mcp.git && cd canvas-mcp
python3 -m venv .venv && source .venv/bin/activate
pip install -e .Then create the env file:
curl -fsSL https://raw.githubusercontent.com/admin978/canvas-mcp/main/.canvas.env.example -o ~/.canvas.env
chmod 600 ~/.canvas.env
# edit ~/.canvas.env: set CANVAS_BASE_URL (institution root, no /api/v1)
# and paste the token into CANVAS_TOKENClaude Code:
claude mcp add canvas-local -- canvas-local-mcpClaude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"canvas-local": {
"command": "canvas-local-mcp"
}
}
}canvas-local-mcp-dump downloads every file the user has access to (course materials, syllabi). Useful for offline indexing.
canvas-local-mcp-dump # all active courses
canvas-local-mcp-dump 12345 67890 # specific course IDsOutput goes to ./canvas-dump/ by default. Override with CANVAS_DUMP_DIR=/path/to/dir.
MIT — see LICENSE.
Built by AGENTE 404 S.L. · [email protected]
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.