canvas-mcp

What it does

• 26 read-only tools across five areas — courses (syllabus, modules, wiki pages, staff, groups), coursework (upcoming, to-do, missing, assignments with rubric and feedback, classic quizzes, calendar), grades with full breakdown (assignment groups, weights, drop rules, every score), files, and communication (announcements, discussions, inbox, recent activity)
• Secret-in-URL connector security — the MCP endpoint lives behind a long random secret compared in constant time, wrong secrets get the same 404 as any unknown URL, the Canvas token is only ever sent to your Canvas instance, and pagination links pointing off-host are ignored
• Stateless by design — a fresh server instance per request, nothing cached or stored, only errors logged; three runtime dependencies, no build step, no database; runs anywhere Node.js 20+ can accept HTTPS traffic, with Railway the quickest path and Render, Fly.io, VPS and local setups documented
• Documented end to end — every tool's parameters and output fields are spelled out in docs/tools.md, READMEs in English and 简体中文, node:test suites run without network access, and the MCP Inspector connects for interactive debugging

When to use it

Course logistics without clicking through Canvas — the README's own example prompts map to distinct tools rather than one blob search: "What's due this week, and which of it have I already submitted?", "What do I need on the final to keep an A in CS 225?", "Summarize the announcements from the last two weeks", "Did the TA leave any comments on my last lab?"

Getting started

Create a Canvas access token (Account → Settings → Approved Integrations → + New Access Token), generate a random secret (node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"), deploy to any Node.js 20+ host with CANVAS_BASE_URL, CANVAS_API_TOKEN and MCP_SECRET set, then connect:

Claude Code:
claude mcp add --transport http canvas https://<your-domain>/<MCP_SECRET>/mcp

Claude.ai / desktop / mobile: Settings → Connectors → Add custom connector, paste the same URL, leave the OAuth fields empty. ChatGPT: enable developer mode, add a connector, choose No authentication.

Things to know

One deployment serves one user — the server acts as whoever owns the token, so run a separate instance per person, and treat the connector URL like a password (if it leaks, change MCP_SECRET and redeploy). PDFs, slides and Office files are not parsed; get_file returns a temporary download link for them instead. New Quizzes appear under list_assignments rather than list_quizzes, and the Canvas API never exposes quiz questions to students. Lists cap at 500 items per call and long text at 20,000 characters; get_calendar_events without a course_id covers at most 10 courses. Some institutions restrict personal access tokens — check your school's acceptable-use policy before deploying.