Canvas LMS MCP Server

A Model Context Protocol server that lets Claude read and write Canvas LMS course content — without a Canvas developer key or OAuth2 registration.

How it works

This MCP server authenticates to Canvas using your browser's existing session cookies — the same approach used by the AI Tutor browser extension. No API key or OAuth2 setup is needed. By default, cookies are extracted automatically from your browser. See SECURITY.md for details on the authentication model.

Session lifetime: Canvas sessions typically last days to weeks. When they expire you'll get a 401 error — just log back into Canvas in your browser and restart the server.

Setup

1. Install dependencies

Requires Python 3.10+.

cd canvas_mcp
pip3 install -r requirements.txt

2. Set your Canvas URL

export CANVAS_BASE_URL="https://yourschool.instructure.com"

This must be an https:// URL — the server will refuse to start with plain HTTP.

3. Authenticate

Automatic (recommended): Just log into Canvas in your browser. The server automatically extracts cookies from your default browser at startup. Supported browsers: Chrome, Safari, Edge, Firefox, Brave, Chromium, Arc, Opera, Vivaldi, LibreWolf.

To force a specific browser:

export BROWSER=firefox  # or chrome, edge, brave, safari, etc.

Manual fallback: If automatic extraction fails, copy the Cookie header from your browser DevTools (Network tab → any Canvas request → Request Headers) and set:

export CANVAS_COOKIE="canvas_session=AbCdEfGh...; _csrf_token=...; log_session_id=..."

Make sure the cookie string includes _csrf_token=... — without it, all write operations will fail with HTTP 422.

4. Run the server

python3 server.py            # stdio mode (for Claude Desktop)
python3 server.py --http     # HTTP mode on localhost:8080

Claude Desktop configuration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "canvas": {
      "command": "python3",
      "args": ["/absolute/path/to/canvas_mcp/server.py"],
      "env": {
        "CANVAS_BASE_URL": "https://yourschool.instructure.com"
      }
    }
  }
}

Tip: Use the absolute path to server.py. Relative paths may not resolve correctly depending on how Claude Desktop launches the process.

Available tools (58)

General (students & instructors)

Assignments

Pages

Modules

Communication

Calendar

Grading & submissions

Overrides

Enrollments & sections

Quizzes

Rubrics

Assignment groups

Late policy

Analytics

Files

Example prompts

What courses am I enrolled in?

Show me upcoming assignments for course 12345.

Get the syllabus for my CS 101 course (ID 9988).

Create a page called "Week 5 Overview" in course 12345 with a brief intro.

Post an announcement to course 12345: "Midterm is next Thursday -- review chapters 4-7."

What's on my Canvas planner this week?

Grade student 789's submission for assignment 456 in course 123 with a score of 95.

Create an office hours event for course 12345 on Friday from 2-4pm.

Show me the class roster for course 12345.

Send a message to all students in section 678: "Don't forget to submit your project."

Security

See SECURITY.md for the full security model. Key points:

• Your Canvas session cookie is equivalent to your password — never commit it or share it.
• The server only communicates with your Canvas instance — no other external requests.
• HTTPS is enforced — the server refuses to start with an http:// URL.
• Single-user design — one server instance = one Canvas account. Do not expose

the HTTP server to the public internet.

• Write operations require Teacher or TA enrollment; student accounts are read-only.
• The X-CSRF-Token is automatically extracted from your cookies for write requests.

License

MIT