CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · README.md

MEDIUM — it fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.

Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted

excerptREADME.md· markdown

155⚠️ **Keep your API token secret!**

156- Never commit your token to git

157- Don't share your token with others

158- Set an expiration date when creating tokens

159- Revoke tokens you no longer use (Canvas Settings → Approved Integrations)

Occurrences

1 occurrence · at L157

How to fix

Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.

Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IMPERATIVE-01sha256d9839cdc44f5a183…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md5.8 KB · Markdown

Canvas LMS MCP Server for Claude

An MCP (Model Context Protocol) server that connects Claude to Canvas LMS, letting you manage your coursework through natural conversation.

Ask Claude things like:

"What assignments do I have due this week?"
"Show me the rubric for my essay assignment"
"What did my professor say in the feedback?"
"List all my courses"
"Are there any overdue assignments?"

Quick Start

1. Get Your Canvas API Token

Log in to Canvas
Click your profile picture → Settings
Scroll to Approved Integrations
Click + New Access Token
Name it (e.g., "Claude") and click Generate Token
Copy the token - you won't see it again!

2. Install the MCP Server

# Clone this repository
git clone https://github.com/lucanardinocchi/canvas-mcp.git
cd canvas-mcp

# Install dependencies
npm install

# Build the project
npm run build

3. Configure Claude Desktop

Open Claude Desktop's config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Add (or merge) this configuration:

{
  "mcpServers": {
    "canvas": {
      "command": "node",
      "args": ["/FULL/PATH/TO/canvas-mcp/dist/index.js"],
      "env": {
        "CANVAS_API_TOKEN": "YOUR_TOKEN_HERE",
        "CANVAS_BASE_URL": "https://your-school.instructure.com"
      }
    }
  }
}

Replace:

/FULL/PATH/TO/canvas-mcp with the actual path where you cloned this repo
YOUR_TOKEN_HERE with your Canvas API token
https://your-school.instructure.com with your Canvas URL

Common Canvas URLs:

University	Canvas URL
University of Sydney	`https://canvas.sydney.edu.au`
Generic Instructure	`https://canvas.instructure.com`
Your school	Check your browser when logged into Canvas

4. Restart Claude Desktop

Quit Claude Desktop completely (Cmd+Q / Alt+F4) and reopen it.

You should now see Canvas tools available in Claude!

What Can It Do?

📚 Courses

List all your enrolled courses
Get course details and syllabi

📝 Assignments

List assignments (filter by upcoming, overdue, etc.)
View full assignment details and instructions
See rubrics and grading criteria
Check your grades and submission status

💬 Discussions

View discussion boards
Post new discussion entries
Reply to classmates

📤 Submissions

Submit text assignments directly
Upload files for submission
View instructor feedback and comments

🔍 Search

Find assignments by due date
Search course content
Get all upcoming work across all courses

All Available Tools

Tool	What it does
`list_courses`	List your enrolled courses
`get_course`	Get details about a specific course
`list_assignments`	List assignments (with filters)
`get_assignment`	Get full assignment details + rubric
`get_rubric`	Get grading rubric for an assignment
`get_submission`	View your submission and feedback
`submit_assignment`	Submit text or URL to an assignment
`upload_file`	Upload a file for submission
`list_modules`	Browse course modules
`list_announcements`	Get course announcements
`list_discussions`	View discussion topics
`get_discussion_entries`	Read discussion posts
`post_discussion_entry`	Post to a discussion
`reply_to_discussion`	Reply to a discussion post
`find_assignments_by_due_date`	Find assignments in a date range
`get_upcoming_assignments`	Get work due in the next N days
`get_overdue_assignments`	Find past-due work
`search_course_content`	Search modules and assignments
`get_all_upcoming_work`	Upcoming work across ALL courses

Troubleshooting

"Canvas tools not showing up"

Make sure you restarted Claude Desktop completely
Check that the path in your config is correct
Verify your claude_desktop_config.json is valid JSON

"401 Unauthorized" errors

Your API token is invalid or expired. Generate a new one in Canvas settings.

"403 Forbidden" errors

You don't have access to that resource. The course may have ended, or you're not enrolled.

"Connection refused" or network errors

Check that your CANVAS_BASE_URL is correct (no trailing slash).

Security Notes

⚠️ Keep your API token secret!

Never commit your token to git
Don't share your token with others
Set an expiration date when creating tokens
Revoke tokens you no longer use (Canvas Settings → Approved Integrations)

Your API token has the same access as your Canvas account - anyone with it can view your grades, submit assignments, etc.

Development

# Install dependencies
npm install

# Build once
npm run build

# Watch mode (auto-rebuild on changes)
npm run dev

Project Structure

canvas-mcp/
├── src/
│   ├── index.ts           # MCP server entry point
│   ├── canvas-client.ts   # Canvas API wrapper
│   ├── tools/             # Tool implementations
│   │   ├── courses.ts
│   │   ├── assignments.ts
│   │   ├── submissions.ts
│   │   ├── discussions.ts
│   │   ├── modules.ts
│   │   └── search.ts
│   └── types/
│       └── canvas.ts      # TypeScript types
├── dist/                  # Compiled output
├── package.json
└── tsconfig.json

Contributing

Contributions welcome! Feel free to:

Report bugs
Suggest new features
Submit pull requests

License

MIT - Use it however you want!

Acknowledgments

Built with:

Canvas Mcp— agent skill

Is Canvas Mcp safe to install?

Canvas LMS MCP Server for Claude

Quick Start

1. Get Your Canvas API Token

2. Install the MCP Server

3. Configure Claude Desktop

4. Restart Claude Desktop

What Can It Do?

📚 Courses

📝 Assignments

💬 Discussions

📤 Submissions

🔍 Search

All Available Tools

Troubleshooting

"Canvas tools not showing up"

"401 Unauthorized" errors

"403 Forbidden" errors

"Connection refused" or network errors

Security Notes

Development

Project Structure

Contributing

License

Acknowledgments

Audit the pieces. Scan the whole. Decide.