Jsoncanvas Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Jsoncanvas Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A remote Model Context Protocol server for working with JSON Canvas files — the open infinite-canvas format used by Obsidian. Create, validate, read, edit, export, and search .canvas files, with an inline interactive canvas viewer.
Hosted by MCPCentral at `https://jsoncanvas.mcpcentral.io/mcp` (Streamable HTTP). This repository is the public listing for the MCP Registry; the server itself is closed-source.
<!-- Registry validation marker — must match server.json name. --> mcp-name: io.mcpcentral/jsoncanvas
The endpoint requires Microsoft Entra OAuth via the MCPCentral gateway (login.mcpcentral.io). MCP clients perform the standard OAuth flow automatically: an unauthenticated request returns 401 with a WWW-Authenticate pointing at the RFC 9728 metadata at /.well-known/oauth-protected-resource, and the client takes you through sign-in. Canvases are stored privately per authenticated user.
Claude Code
claude mcp add jsoncanvas --transport http https://jsoncanvas.mcpcentral.io/mcpClaude Desktop / other clients via `mcp-remote`
{
"mcpServers": {
"jsoncanvas": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://jsoncanvas.mcpcentral.io/mcp"]
}
}
}Any MCP client that supports remote Streamable HTTP servers with OAuth (Claude, Goose, OpenAI connectors, MCP Inspector) can connect.
| Tool | Description |
|---|---|
create_canvas | Create a canvas from nodes (+ optional edges); stored under a date-prefixed .canvas name. |
validate_canvas | Validate canvas data against the JSON Canvas 1.0 spec. |
read_canvas | Read a stored canvas and return its nodes and edges. |
list_canvases | List your stored canvases. |
edit_canvas | Atomic batch add/update/remove of nodes and edges (removing a node cascades its edges). |
export_canvas | Export to markdown, svg, mermaid, or png (full-fidelity raster via Browser Rendering). |
search_canvases | Case-insensitive field-level search across your canvases. |
create_canvas, read_canvas, and edit_canvas carry MCP Apps UI metadata so supporting hosts render the result inline in an interactive pan/zoom viewer.
canvas://schema — JSON Schema for canvas files.canvas://examples/basic — a simple two-node example canvas.ui://canvas/viewer.html — the interactive read-only viewer (MCP Apps UI).SSRF-blocked PNG renderer (the headless browser cannot be coerced into outbound requests).
for security reports.
MIT.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.