Is Mcp Canvas Lms safe to use?

Mcp Canvas Lms has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment.

How do I install Mcp Canvas Lms?

Mcp Canvas Lms supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Mcp Canvas Lms?

Mcp Canvas Lms is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.

Is Mcp Canvas Lms actively maintained?

Mcp Canvas Lms is less actively maintained - last commit was 165 days ago. It has 104 GitHub stars.

MCP Canvas Lms

Name: MCP Canvas Lms
Author: DMontgomery40

canvas-mcp-server · by DMontgomery40

Version 2.2 - 54 tools available - an MCP server for interacting with the Canvas LMS API. This server allows you to manage courses, assignments, enrollments, and grades within Canvas.

104 1.9k/wk GitHub npm

No known CVEs

No license

Maintained

Last commit 165d ago

Works with most clients

Transport: stdio, http

0 tools

Grade F

MCPpedia last refreshed this data 1d ago

Edit this pageView history

MCP Canvas Lms is an MCP server that version 2.2 - 54 tools available - an MCP server for interacting with the Canvas LMS API. This server allows you to manage courses, assignments, enrollments, and grades within Canvas. Its tool list has not been published yet over stdio and http, requires no API key, and scores 54/100 on MCPpedia's security, maintenance and efficiency rubric.

Education

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "canvas-mcp-server": {
      "env": {
        "CANVAS_DOMAIN": "your_school.instructure.com",
        "CANVAS_API_TOKEN": "your_token_here"
      },
      "args": [
        "-y",
        "canvas-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-canvas-lms)](https://mcppedia.org/s/mcp-canvas-lms)

Read me

What Mcp Canvas Lms does

A comprehensive Model Context Protocol (MCP) server for Canvas LMS with complete student, instructor, and account administration functionality

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

npx -y 'canvas-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

54/100across 5 weighted dimensions

How we score →

0255075100

−46

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked canvas-mcp-server against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Mcp Canvas Lms safe to use?: Mcp Canvas Lms has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment.
How do I install Mcp Canvas Lms?: Mcp Canvas Lms supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Mcp Canvas Lms?: Mcp Canvas Lms is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Is Mcp Canvas Lms actively maintained?: Mcp Canvas Lms is less actively maintained - last commit was 165 days ago. It has 104 GitHub stars.

Similar servers

Others in education

View all →

io.github.mims-harvard/tooluniverse91

2,700+ scientific tools for AI scientists: life science, research, literature, and more.

1.8k 4

Auto Claude Code Research In Sleep91

ARIS ⚔️ (Auto-Research-In-Sleep) — Lightweight Markdown-only skills for autonomous ML research: cross-model review loops, idea discovery, and experiment automation. No framework, no lock-in — works with Claude Code, Codex, OpenClaw, or any LLM agent.

19.1k 5

Daofy90

Daofy for Delphi — MCP Server that compiles Delphi projects and queries knowledge base for AI assistants.

108 10

io.github.Fireiscoolsolo/canvas-lms-mcp-local89

Student-focused Canvas LMS: 237 tools for grades, deadlines, planning, submissions and study plans.

2 1

MCP Security Weekly

Get CVE alerts and security updates for Mcp Canvas Lms and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Education

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "canvas-mcp-server": {
      "env": {
        "CANVAS_DOMAIN": "your_school.instructure.com",
        "CANVAS_API_TOKEN": "your_token_here"
      },
      "args": [
        "-y",
        "canvas-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-canvas-lms)](https://mcppedia.org/s/mcp-canvas-lms)

Read me

What Mcp Canvas Lms does

A comprehensive Model Context Protocol (MCP) server for Canvas LMS with complete student, instructor, and account administration functionality

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

npx -y 'canvas-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Canvas MCP Server v2.3.0

Security and disclosure history

This project is an independent MCP server for Canvas LMS APIs. It is not affiliated with, endorsed by, or maintained by Instructure or Canvas.

In June 2025, during development of this MCP, I identified a Broken Access Control issue in the Canvas environment at bootcampspot.instructure.com. The issue exposed personally identifiable information for other students enrolled in my course.

I reported the issue through Bugcrowd on June 5, 2025, and also contacted Instructure / Canvas security channels directly. The Bugcrowd report was later closed as "Not Applicable." In subsequent correspondence, Instructure stated that the bootcampspot.instructure.com environment was outside its control.

Public references:

Disclosure thread: https://www.reddit.com/r/cybersecurity/comments/1t6wmkw/reported_a_broken_access_control_bug_to/
Bugcrowd activity timeline: https://imgur.com/gallery/canvas-vuln-declared-n-11-months-ago-zYfHnBs
Later Instructure / BootcampSpot correspondence: https://imgur.com/a/BnhgXme

This repository does not publish exploit steps, affected tenant details beyond what is already public, live URLs, screenshots containing student data, or proof-of-concept abuse flows.

Separately, Instructure publicly disclosed a Canvas security incident in May 2026, and public reporting has linked the incident to ShinyHunters claims. This repository makes no claim that the June 2025 report caused, enabled, predicted, or is technically connected to the May 2026 incident.

This disclosure is documented here for project history and transparency only.

What this is

A comprehensive Model Context Protocol (MCP) server for Canvas LMS with complete student, instructor, and account administration functionality

🚀 What's New in v2.3.0

🌐 NEW: Streamable HTTP transport support (MCP_TRANSPORT=streamable-http)
🖥️ Preserved: First-class stdio transport for local MCP clients
🧪 Added: Behavior tests for lifecycle, transports, and structured failure-path errors
🧱 Improved: Stricter tool schemas and codemode-oriented tool descriptions
🔧 FIXED: Course creation "page not found" error (missing account_id parameter)
👨‍💼 Account Management: Complete account-level administration tools
📊 Reports & Analytics: Generate and access Canvas account reports
👥 User Management: Create and manage users at the account level
🏢 Multi-Account Support: Handle account hierarchies and sub-accounts
✅ API Compliance: All endpoints now follow proper Canvas API patterns

🎯 Key Features

🎓 For Students

Course Management: Access all courses, syllabi, and course materials
Assignment Workflow: View, submit (text/URL/files), and track assignments
Communication: Participate in discussions, read announcements, send messages
Progress Tracking: Monitor grades, module completion, and calendar events
Quizzes: Take quizzes, view results and feedback
File Access: Browse and download course files and resources

👨‍🏫 For Instructors

Course Creation: Create and manage course structure (now with proper account support)
Grading: Grade submissions, provide feedback, manage rubrics
User Management: Enroll students, manage permissions
Content Management: Create assignments, quizzes, discussions

👨‍💼 For Account Administrators (NEW!)

Account Management: Manage institutional Canvas accounts
User Administration: Create and manage users across accounts
Course Oversight: List and manage all courses within accounts
Reporting: Generate enrollment, grade, and activity reports
Sub-Account Management: Handle account hierarchies and structures

🛠️ Technical Excellence

Robust API: Automatic retries, pagination, comprehensive error handling
Cloud Ready: Docker containers, Kubernetes manifests, health checks
Well Tested: Unit tests,

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

54/100across 5 weighted dimensions

How we score →

0255075100

−46

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked canvas-mcp-server against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Mcp Canvas Lms safe to use?: Mcp Canvas Lms has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment.
How do I install Mcp Canvas Lms?: Mcp Canvas Lms supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Mcp Canvas Lms?: Mcp Canvas Lms is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Is Mcp Canvas Lms actively maintained?: Mcp Canvas Lms is less actively maintained - last commit was 165 days ago. It has 104 GitHub stars.