canvas-api-mcp

Never miss an assignment deadline again.

Ask your AI what's due and it reads the answer straight from Canvas:
real deadlines, real submission status, no copying anything across.

An MCP server for Canvas LMS. 16 curated tools for everyday student work, plus a gateway that reaches every endpoint your Canvas instance exposes.

📖 Documentation: mcp.johannsenlum.com/canvas-lms · install guide · tool reference · skills · compliance

Personal-use software. Canvas's API Policy requires OAuth for applications used by multiple people, and Canvas OAuth cannot be implemented safely by locally installed software (no PKCE, and client_secret cannot be shipped in a package). Use this with your own token on your own account. See Compliance.

What you can ask it

Real prompts, and which tool answers them.

You: What's due this week? Claude: (calls whats_due): You have 3 things due: Problem Set 4 (Thu, CS3230), a discussion reply (Fri, IS4302), and the Milestone 2 report (Sun, EE2211).

You: How am I doing in my databases course, and what's on the syllabus for week 6? Claude: (calls my_grades, then get_syllabus, then course_content for the week 6 module): You're at 87% overall. Week 6 covers normalization and has a reading plus a lab file due Friday.

You: Summarize the PDF lecture notes for lecture 8 and pull up my submission for the essay so I can see the feedback. Claude: (calls list_files + read_file for the PDF, then my_submission for the essay): ...

You: Reply to the "Project teams" discussion and say I'm free after 3pm for the group meeting. Claude: (calls post_discussion_reply ✏️): Posted to the thread.

You: Has Canvas ever given me quiz statistics broken down by question, across the whole semester? Claude: (calls search_canvas_api to find the right endpoint, then canvas_request to call it): ...

The last example is the point of the gateway tools: if an endpoint exists on your Canvas instance, search_canvas_api can find it and canvas_request can call it, even though only 16 tools are hand-curated.

Install

Prerequisites

• Python 3.11+

• A Canvas personal access token. Your institution must allow students to create them: check Canvas → Account → Settings → Approved Integrations for a "+ New access token" button. Full walkthrough with screenshots: mcp.johannsenlum.com/canvas-lms/install.

  Note that the token expires. Since Instructure's October 2025 security update, accounts holding only student roles must set an expiry no more than 120 days out, and institutions often cap it lower (NUS allows 90). Write the date down: an expired token makes every tool return 401 at once, which looks like a broken install rather than a credential that simply ran out.

Running the server

canvas-api-mcp is published on PyPI. Run it with:

uvx canvas-api-mcp

Install from source (contributors / unreleased main). Not part of the normal install path above, only needed if you want the latest unreleased code instead of the published PyPI release:

uvx --from git+https://github.com/JohannsenLum/canvas-api-mcp canvas-api-mcp

Or run from a local clone:

git clone https://github.com/JohannsenLum/canvas-api-mcp
cd canvas-api-mcp
uv sync

Quick install (one-click)

One-click deeplinks exist for Cursor, VS Code, and LM Studio only. No other client has a documented install-link format. These prefill the config below but still need CANVAS_BASE_URL and CANVAS_TOKEN filled in afterward.

All clients (manual config)

Your token stays on your machine, in your own config file. It is never transmitted anywhere except directly to your Canvas instance.

{
  "mcpServers": {
    "canvas": {
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

{
  "mcpServers": {
    "canvas": {
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

{
  "mcpServers": {
    "canvas": {
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

{
  "servers": {
    "canvas": {
      "type": "stdio",
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

{
  "mcpServers": {
    "canvas": {
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

{
  "context_servers": {
    "canvas": {
      "source": "custom",
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

{
  "mcpServers": {
    "canvas": {
      "command": "uvx",
      "args": ["canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.yourschool.edu",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

Tools

✏️ writes to Canvas. That's 3 write tools total: submit_assignment, post_discussion_reply, and canvas_request when called with a non-GET method (GET calls through canvas_request are read-only).

search_canvas_api + canvas_request reach all ~1,116 endpoints your instance exposes. What they may do is decided by Canvas from your token's permissions: a teacher token unlocks educator endpoints with no change to this server.

Prompts

week_ahead, study_pack, grade_check.

Resources

canvas://me, canvas://courses, canvas://api/catalog.

Skills

If your client supports the skills convention:

npx skills add JohannsenLum/canvas-api-mcp

Other institutions

Works with any Canvas instance: set CANVAS_BASE_URL. The catalog of ~1,116 endpoints ships inside the package at canvas_api_mcp/data/catalog.json. To match your deployment's exact feature set, regenerate it:

python scripts/build_catalog.py https://canvas.yourschool.edu -o data/catalog.json

Compliance

• Academic integrity. submit_assignment can submit anything, including AI-generated work. Submitting work that is not your own breaches the academic integrity rules of essentially every institution, and Canvas's API Policy explicitly prohibits use that violates them. That is on you.
• Rate limiting. The client throttles against Canvas's published quota. Do not remove it: overloading the API is prohibited.
• Course material. read_file fetches materials for your own study. Do not redistribute them.
• Your token is password-equivalent. It can read your grades and submit work as you. Set an expiry. Never commit it.
• Personal-use scope. Phase 1 targets a single student using their own token. There are no curated educator tools; Canvas's OAuth flow has no PKCE, so this locally-installed server cannot implement the multi-user OAuth that Canvas's API Policy requires for anything broader. Do not repackage this as a multi-tenant service.

Development

uv sync
uv run pytest -v

# Live tests against your real account (read-only)
CANVAS_LIVE_TESTS=1 uv run pytest tests/test_live.py -v

Environment variables: CANVAS_BASE_URL, CANVAS_TOKEN, optional CANVAS_MAX_PAGES (default 10) and CANVAS_TIMEOUT (seconds, default 30). See env.template.

Contributing

Issues and pull requests are welcome: see CONTRIBUTING.md for setup, the architectural rules worth knowing before you change anything, and the bar for adding a new curated tool.

Found a security problem? Do not open a public issue. See SECURITY.md for private reporting, particularly important here, since this project handles password-equivalent Canvas tokens.

Changes are recorded in CHANGELOG.md.

Licence

MIT © 2026 Johannsen Lum.

Use it, change it, redistribute it, build something commercial on it: the only condition is that you keep the copyright notice and licence text. It comes with no warranty of any kind.

Contributions are accepted under the same licence.