Canvas MCP Server v2.3.0

Security and disclosure history

This project is an independent MCP server for Canvas LMS APIs. It is not affiliated with, endorsed by, or maintained by Instructure or Canvas.

In June 2025, during development of this MCP, I identified a Broken Access Control issue in the Canvas environment at bootcampspot.instructure.com. The issue exposed personally identifiable information for other students enrolled in my course.

I reported the issue through Bugcrowd on June 5, 2025, and also contacted Instructure / Canvas security channels directly. The Bugcrowd report was later closed as "Not Applicable." In subsequent correspondence, Instructure stated that the bootcampspot.instructure.com environment was outside its control.

Public references:

• Disclosure thread: https://www.reddit.com/r/cybersecurity/comments/1t6wmkw/reported_a_broken_access_control_bug_to/
• Bugcrowd activity timeline: https://imgur.com/gallery/canvas-vuln-declared-n-11-months-ago-zYfHnBs
• Later Instructure / BootcampSpot correspondence: https://imgur.com/a/BnhgXme

This repository does not publish exploit steps, affected tenant details beyond what is already public, live URLs, screenshots containing student data, or proof-of-concept abuse flows.

Separately, Instructure publicly disclosed a Canvas security incident in May 2026, and public reporting has linked the incident to ShinyHunters claims. This repository makes no claim that the June 2025 report caused, enabled, predicted, or is technically connected to the May 2026 incident.

This disclosure is documented here for project history and transparency only.

What this is

A comprehensive Model Context Protocol (MCP) server for Canvas LMS with complete student, instructor, and account administration functionality

🚀 What's New in v2.3.0

• 🌐 NEW: Streamable HTTP transport support (MCP_TRANSPORT=streamable-http)
• 🖥️ Preserved: First-class stdio transport for local MCP clients
• 🧪 Added: Behavior tests for lifecycle, transports, and structured failure-path errors
• 🧱 Improved: Stricter tool schemas and codemode-oriented tool descriptions
• 🔧 FIXED: Course creation "page not found" error (missing account_id parameter)
• 👨‍💼 Account Management: Complete account-level administration tools
• 📊 Reports & Analytics: Generate and access Canvas account reports
• 👥 User Management: Create and manage users at the account level
• 🏢 Multi-Account Support: Handle account hierarchies and sub-accounts
• ✅ API Compliance: All endpoints now follow proper Canvas API patterns

🎯 Key Features

🎓 For Students

• Course Management: Access all courses, syllabi, and course materials
• Assignment Workflow: View, submit (text/URL/files), and track assignments
• Communication: Participate in discussions, read announcements, send messages
• Progress Tracking: Monitor grades, module completion, and calendar events
• Quizzes: Take quizzes, view results and feedback
• File Access: Browse and download course files and resources

👨‍🏫 For Instructors

• Course Creation: Create and manage course structure (now with proper account support)
• Grading: Grade submissions, provide feedback, manage rubrics
• User Management: Enroll students, manage permissions
• Content Management: Create assignments, quizzes, discussions

👨‍💼 For Account Administrators (NEW!)

• Account Management: Manage institutional Canvas accounts
• User Administration: Create and manage users across accounts
• Course Oversight: List and manage all courses within accounts
• Reporting: Generate enrollment, grade, and activity reports
• Sub-Account Management: Handle account hierarchies and structures

🛠️ Technical Excellence

• Robust API: Automatic retries, pagination, comprehensive error handling
• Cloud Ready: Docker containers, Kubernetes manifests, health checks
• Well Tested: Unit tests,

... View full README on GitHub