Is io.github.chrischall/canvas-parent-mcp safe to use?

io.github.chrischall/canvas-parent-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.chrischall/canvas-parent-mcp?

io.github.chrischall/canvas-parent-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.chrischall/canvas-parent-mcp?

io.github.chrischall/canvas-parent-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.

Is io.github.chrischall/canvas-parent-mcp actively maintained?

io.github.chrischall/canvas-parent-mcp is actively maintained — last commit was 2 days ago.

io.github.chrischall/canvas-parent-mcp

canvas-parent-mcp-qr-login

Canvas LMS (Instructure) for Claude — courses, grades, assignments, planner, files

GitHub npm

No known CVEs

No license

Actively maintained

Last commit 2d ago

Works with most clients

Transport: stdio, sse

0 tools

Grade F

Edit this pageView history

AI / ML Productivity

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-chrischall-canvas-parent-mcp": {
      "args": [
        "-y",
        "canvas-parent-mcp-qr-login"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-chrischall-canvas-parent-mcp)](https://mcppedia.org/s/io-github-chrischall-canvas-parent-mcp)

Read me

What io.github.chrischall/canvas-parent-mcp does

MCP server for Canvas LMS (Instructure), scoped for parent observers and student self-access. Targets https://cms.instructure.com by default but works against any Canvas instance.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'canvas-parent-mcp-qr-login' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

55/100across 5 weighted dimensions

How we score →

0255075100

−45

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked canvas-parent-mcp-qr-login against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.chrischall/canvas-parent-mcp safe to use?: io.github.chrischall/canvas-parent-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.chrischall/canvas-parent-mcp?: io.github.chrischall/canvas-parent-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.chrischall/canvas-parent-mcp?: io.github.chrischall/canvas-parent-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
Is io.github.chrischall/canvas-parent-mcp actively maintained?: io.github.chrischall/canvas-parent-mcp is actively maintained — last commit was 2 days ago.

Similar servers

Others in ai-ml / productivity

View all →

Sequential Thinking MCP Server98

Dynamic problem-solving through sequential thought chains

87.9k 1

Memory MCP Server98

Persistent memory using a knowledge graph

87.9k 5

Gpt Researcher95

An autonomous agent that conducts deep research on any data using any LLM providers

28.0k 5

Ruflo95

🌊 The leading agent orchestration platform for Claude. Deploy intelligent multi-agent swarms, coordinate autonomous workflows, and build conversational AI systems. Features enterprise-grade architecture, distributed swarm intelligence, RAG integration, and native Claude Code / Codex Integration

62.3k 4

MCP Security Weekly

Get CVE alerts and security updates for io.github.chrischall/canvas-parent-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

AI / ML Productivity

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-chrischall-canvas-parent-mcp": {
      "args": [
        "-y",
        "canvas-parent-mcp-qr-login"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-chrischall-canvas-parent-mcp)](https://mcppedia.org/s/io-github-chrischall-canvas-parent-mcp)

Read me

What io.github.chrischall/canvas-parent-mcp does

MCP server for Canvas LMS (Instructure), scoped for parent observers and student self-access. Targets https://cms.instructure.com by default but works against any Canvas instance.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'canvas-parent-mcp-qr-login' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

canvas-parent-mcp

MCP server for Canvas LMS (Instructure), scoped for parent observers and student self-access. Targets https://cms.instructure.com by default but works against any Canvas instance.

Mirrors the read-only parent-portal scope of sibling infinitecampus-mcp. Users interact via the canvas_* tool prefix.

Tools

18 tools across profile, observees, courses, assignments, submissions, grades, calendar, planner, announcements, conversations, discussions, and files.

Domain	Tools
Profile	`canvas_get_profile`
Observees	`canvas_list_observees`
Courses	`canvas_list_courses`, `canvas_get_course`
Assignments	`canvas_list_assignments`, `canvas_list_missing_submissions`
Submissions	`canvas_get_submission`, `canvas_list_recent_submissions` (default 14d window)
Grades	`canvas_list_enrollments`
Calendar	`canvas_list_calendar_events`, `canvas_list_upcoming_events`
Planner	`canvas_list_planner_items`
Announcements	`canvas_list_announcements`
Conversations	`canvas_list_conversations`, `canvas_get_conversation`
Discussions	`canvas_list_discussion_topics`
Files	`canvas_list_course_files`, `canvas_download_file`

Tools that the harness will gate as write/IO operations: canvas_download_file.

Configuration

Set CANVAS_BASE_URL plus one of four auth modes. canvas-parent-mcp tries them in priority order:

CANVAS_TOKEN → personal access token
CANVAS_CLIENT_ID + CANVAS_CLIENT_SECRET + CANVAS_REFRESH_TOKEN → OAuth
CANVAS_USERNAME + CANVAS_PASSWORD → session-scrape (direct Canvas accounts only)
fetchproxy fallback → no env vars needed; reads canvas_session + pseudonym_credentials cookies from your signed-in Canvas tab via the fetchproxy browser extension

If none succeed, you get an error that names every escape hatch.

Mode A — fetchproxy fallback (recommended, zero config)

CANVAS_BASE_URL=https://cms.instructure.com

Install the fetchproxy 0.3.0 Chrome / Safari extension (Chrome Web Store / Safari .dmg), sign into your Canvas instance once, and the MCP reads your session cookies at startup. After that, all Canvas API calls go directly from Node — the extension is not in the request hot path. Works with any auth flow (SSO/SAML/2FA included) because Canvas itself handled the sign-in.

Multiple districts? Declared domain instructure.com matches every *.instructure.com host, so you only pair the extension once. The MCP uses whichever district you set in CANVAS_BASE_URL.

Set CANVAS_DISABLE_FETCHPROXY=1 to opt out (missing creds become a hard error — useful in headless CI).

Mode B — username/password (legacy session-scrape)

CANVAS_BASE_URL=https://cms.instructure.com
CANVAS_USERNAME=me@example.com
CANVAS_PASSWORD=your-canvas-password
CANVAS_NAME=cms                # optional, defaults to host portion of base URL

Direct Canvas accounts only — won't work with SAML/Google/Microsoft SSO or 2FA. Brittle (breaks on every Canvas login-page restyling). Prefer fetchproxy if your tab is already signed in. Treat .env like a password file.

Advanced alternatives

Personal access token — simplest if your admin allows it

CANVAS_BASE_URL=https://cms.instructure.com
CANVAS_TOKEN=your-personal-access-token

Generate via Canvas → Account → Settings → "+ New Access Token". Most institutions have disabled this for non-admins.

OAuth via mobile QR code —

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

55/100across 5 weighted dimensions

How we score →

0255075100

−45

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked canvas-parent-mcp-qr-login against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.chrischall/canvas-parent-mcp safe to use?: io.github.chrischall/canvas-parent-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.chrischall/canvas-parent-mcp?: io.github.chrischall/canvas-parent-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.chrischall/canvas-parent-mcp?: io.github.chrischall/canvas-parent-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
Is io.github.chrischall/canvas-parent-mcp actively maintained?: io.github.chrischall/canvas-parent-mcp is actively maintained — last commit was 2 days ago.