Canvas Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Canvas Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
canvas-mcp)<!-- mcp-name: io.github.admin978/canvas-mcp -->
Ask Claude about your Canvas courses, assignments, deadlines, modules, and grades from one place.
canvas-mcp is a local-first MCP server for Canvas LMS users (students, instructors, and MCP builders). It turns Canvas REST API actions into MCP tools that work from Claude Code, Claude Desktop, and other MCP-compatible clients.
Status: alpha. Single-user, no warranty, API surface may still shift. File issues if it breaks.
12345.”12345.”syllabus from course 12345.”Prerequisite: Python 3.10+.
In Canvas: Account → Settings → Approved Integrations → + New Access Token. Copy the token shown (Canvas does not show it again later).
From PyPI (recommended):
pip install canvas-local-mcpOr from source:
git clone https://github.com/admin978/canvas-mcp.git && cd canvas-mcp
python3 -m venv .venv && source .venv/bin/activate
pip install -e .~/.canvas.envcurl -fsSL https://raw.githubusercontent.com/admin978/canvas-mcp/main/.canvas.env.example -o ~/.canvas.env
chmod 600 ~/.canvas.env
# edit ~/.canvas.env: set CANVAS_BASE_URL (institution root, no /api/v1)
# and paste the token into CANVAS_TOKENFor token safety guidance (least privilege, file permissions, rotation/revocation, and vulnerability reporting), see SECURITY.md.
Claude Code:
claude mcp add canvas-local -- canvas-local-mcpClaude Desktop:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json{
"mcpServers": {
"canvas-local": {
"command": "canvas-local-mcp"
}
}
}list_courseslist_assignmentslist_moduleslist_announcementsget_pageget_file_infoget_gradesplanner_itemsupcoming_eventstodocanvas-local-mcp-dump downloads course files and related content for offline indexing.
canvas-local-mcp-dump # all active courses
canvas-local-mcp-dump 12345 67890 # specific course IDsOutput goes to ./canvas-dump/ by default. Override with CANVAS_DUMP_DIR=/path/to/dir.
~/.canvas.env (CANVAS_BASE_URL, CANVAS_TOKEN).No demo GIF is currently committed yet. You can still verify the workflow quickly:
After registering the MCP server, ask Claude:
Placeholder: add a short terminal/GIF walkthrough here in a future PR.
Requires Python 3.10+.
pip install -e ".[dev]"
ruff check canvas_local_mcp tests # lint
pytest # tests run against a mocked Canvas API — no token neededCI runs lint + tests on Python 3.10–3.13 for every push and pull request.
Follow this order to publish a new version (e.g. 0.1.4) consistently across PyPI and the MCP Registry.
Update all three files to the new version string in a single PR:
| File | Field |
|---|---|
pyproject.toml | [project].version |
canvas_local_mcp/__init__.py | __version__ |
server.json | root version and packages[0].version |
The CI test test_server_json_version_matches_package and the workflow validation step will fail if any of these three disagree.
mainWait for all CI checks to pass before merging.
canvas-local-mcp to PyPIThe project uses Trusted Publisher (OIDC) for PyPI uploads. Trigger the PyPI publish workflow (or run python -m build && twine upload dist/* if you have credentials configured) before creating the tag, so the package is available when the MCP Registry fetches it.
vX.Y.Zgit tag v0.1.4
git push origin v0.1.4This triggers the Publish to MCP Registry workflow, which:
server.json, pyproject.toml, and the tag all declare the same version.server.json to the MCP Registry via GitHub OIDC (no secrets needed).https://pypi.org/project/canvas-local-mcp/https://registry.modelcontextprotocol.io/?q=canvas-mcphttps://github.com/admin978/canvas-mcp/actionsImportant: never reuse or move an existing tag. If you need to re-publish after a mistake, bump to the next patch version (e.g. 0.1.4) and start from step 1.If this project helps you manage Canvas with Claude, please try the flow above and consider giving it a ⭐ so other students and educators can find it.
MIT — see LICENSE.
Built by AGENTE 404 S.L. · [email protected]
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.