Unofficial

Canvas MCP Server

Connects an AI assistant to your Instructure Canvas account, so it can see your courses, assignments, deadlines and grades — and, when you approve it, submit work and post replies.

Runs on your own computer. Your Canvas token is stored locally and is never sent to this site or anywhere else. Not affiliated with Instructure.

Read this before you install it

This tool can submit coursework under your name. Plenty of courses forbid AI-written work outright, and plenty more will give it a zero if they spot it. Those consequences land on you, not on the assistant.

So the server makes the course’s own rules impossible to skip: before it will write anything to Canvas, the assistant has to fetch what your syllabus and assignment actually say about AI use, and state in writing how the submission squares with it. You see that statement in the approval prompt before anything is sent.

It is a speed bump built out of prompts and required arguments, not a lock. A determined person gets past it. It is here so that nobody submits AI-written coursework without having been shown their own course’s rule about it first. How it works ↓

What you need

  • Node.js 18 or newer on the machine running your assistant.
  • A Canvas account at a school that has not disabled self-service access tokens.
  • Optional but recommended: pdftotext (apt install poppler-utils, or brew install poppler). Most syllabi are uploaded PDFs, and without it the AI-policy check cannot read them. It will say so rather than pretend the course has no policy, but it will not be able to check for you.
  • An assistant that can run a local MCP server. See the per-tool setup below.

There is no account to make here and nothing to pay for.

1. Install

This works in any harness — it is a plain npm package served from this site.

npm install -g https://canvas.twc.arachnida-apps.com/canvas-mcp-unofficial-1.0.3.tgz

That gives you a canvas-mcp command. Check it:

canvas-mcp --version

Prefer not to install anything? Every config below can use npx -y https://canvas.twc.arachnida-apps.com/canvas-mcp-unofficial-1.0.3.tgz as the command instead. It re-downloads the package on each start, so the assistant takes a second or two longer to come up.

2. Connect your Canvas account

Run this with your school’s Canvas web address:

canvas-mcp setup https://yourschool.instructure.com

It opens a page in your browser with a link straight to your Canvas token settings and a box to paste into. Create the token in Canvas, paste it there, done. If the browser does not open — over SSH, say — the command prints a link to open yourself.

You can also do this from inside a conversation by asking your assistant to run the canvas_setup tool. It opens the same page. Never paste your Canvas token into a chat — it belongs in that page, not in a transcript.

Why a token and not a normal login?

Canvas does support proper OAuth sign-in, but it requires a “developer key” issued by a Canvas administrator, separately for each institution. Students cannot get one. So a personal access token is the only route available to an ordinary account, and no tool can honestly offer you a one-click Canvas login without your school having set one up first.

The token is written to ~/.config/canvas-mcp/config.json with permissions 0600. You can revoke it any time from the same Canvas settings page you made it on. If you would rather not have it on disk, set CANVAS_TOKEN and CANVAS_BASE_URL in the environment instead — those win over the file.

There is no “+ New Access Token” button

Your institution has turned off self-service tokens. There is no way around that from this end — the API will refuse anything you try. Ask your Canvas administrator whether they will issue you one.

3. Point your assistant at it

Anything that speaks MCP over stdio works. The command is canvas-mcp with no arguments. Here are the ones people ask about.

Claude Code

claude mcp add --scope user --transport stdio canvas -- canvas-mcp

Use --scope user to have it in every project, or --scope project to write a .mcp.json that lives with one repo. Then see permissions below to auto-approve the read tools.

Claude Desktop

Settings → Developer → Edit Config, then add this to claude_desktop_config.json and restart the app:

{
  "mcpServers": {
    "canvas": {
      "command": "canvas-mcp"
    }
  }
}

If it does not appear, give the full path instead of canvas-mcp — the desktop app does not always inherit your shell’s PATH. Find it with which canvas-mcp.

Codex CLI

codex mcp add canvas -- canvas-mcp

Or by hand in ~/.codex/config.toml:

[mcp_servers.canvas]
command = "canvas-mcp"

ChatGPT

ChatGPT on the web cannot run this. It connects only to remote MCP servers over HTTPS and has no way to launch a local one.

That is a deliberate omission rather than a gap to fill. A hosted version would mean every student’s Canvas token — which can read their grades and submit their coursework — sitting on somebody else’s server. Running locally is the entire reason the credential stays yours.

The ChatGPT desktop app shares MCP configuration with Codex CLI on the same machine, so the Codex setup above generally covers it.

Anything else

Cursor, Zed, Windsurf, Continue and the rest take the same shape — a server name, a command, and optionally arguments:

{
  "command": "canvas-mcp",
  "args": [],
  "env": {}
}

4. Auto-approve reading, not writing

Tool names are the mechanism here. Everything that only reads starts with get_, list_ or check_. Everything that changes something starts with submit_, post_, reply_, send_ or upload_. So one rule per prefix covers a whole class, and a rule that auto-approves reads cannot catch a write by accident.

Every read tool is also marked readOnlyHint in the protocol, which some clients use to decide this for themselves.

Claude Code — in ~/.claude/settings.json for every project, or .claude/settings.json inside one:

{
  "permissions": {
    "allow": [
      "mcp__canvas__get_*",
      "mcp__canvas__list_*",
      "mcp__canvas__check_*"
    ],
    "ask": [
      "mcp__canvas__submit_*",
      "mcp__canvas__post_*",
      "mcp__canvas__reply_*",
      "mcp__canvas__send_*",
      "mcp__canvas__upload_*",
      "mcp__canvas__canvas_setup"
    ]
  }
}

The server name in each rule (canvas) has to match what you called it when you added it. If you named it something else, change it in all of them.

Other clients differ — some have a per-tool “always allow” toggle you click once, some ask every time. Whatever yours does, the useful habit is the same: let the reads through, read the writes. An approval prompt you have stopped reading is not a safeguard.

What it can do

Reading — safe to auto-approve

get_connection_statusWhich Canvas account this is connected to
get_profileYour own name, login and time zone
list_coursesYour courses, active or past
get_courseOne course, including its syllabus text
get_syllabusA course syllabus as plain text
check_course_ai_policyWhat the course says about AI use — see below
list_assignmentsAssignments, due dates, point values
get_assignmentOne assignment: full instructions and rubric
list_upcoming_workEverything due soon, in your time zone, with what is already handed in
get_gradesCurrent and final scores
get_submissionYour own submission status and grader comments
list_modulesCourse modules and the items in them
list_announcementsInstructor announcements
list_discussionsDiscussion topics in a course
get_discussionOne discussion: the prompt and the replies
list_course_filesFiles in a course, including ones only linked from a module
read_course_fileThe text of a course file — a syllabus PDF, a handout, a Word document
get_pageA course wiki page as plain text

Writing — approve these yourself, every time

submit_assignmentSubmit text, a URL, or uploaded files to an assignment
upload_submission_fileUpload a local file so it can be attached to a submission
post_discussion_entryPost a reply to a discussion topic
reply_to_discussion_entryReply to somebody else’s post in a thread
send_conversation_messageSend a Canvas inbox message

There is no tool that deletes anything, changes your profile, or acts on anyone else’s account. Submissions and discussion posts are visible to your instructor the moment they land and generally cannot be taken back.

The academic integrity guardrail

check_course_ai_policy reads your course syllabus and, if you name an assignment, that assignment’s instructions. It quotes back every passage that mentions AI, and tells the assistant how to act on what it found:

The course prohibits AI use

The assistant declines to produce the work and says why. It can still explain the material, work a different example, or check reasoning you did yourself. If you keep pushing after it declines — rephrasing, insisting it is fine, asking for “just a draft” — it is instructed to stop negotiating and disengage, and to end the conversation if its harness allows that.

AI use is allowed but penalised — “AI-generated work receives a zero”

Technically permitted, almost certainly not what you want. The assistant is instructed to quote the rule, tell you plainly what the consequence would be, note that schools do run detection software, and wait for you to confirm — before it writes anything, not in a preamble attached to the finished work.

AI use is permitted with conditions

It states the conditions, works inside them, and makes sure any required citation or disclosure actually ends up in the submitted text rather than left for you to remember.

The course says nothing about AI

Silence is not permission. It tells you nothing was found, that this is not the same as being allowed, and that asking your instructor is the reliable move. Institution-wide integrity policies often live outside the syllabus and would not show up here.

Where it is honestly weak

  • Reading PDFs depends on pdftotext being installed. It does find and read uploaded syllabi — PDF and Word, including ones only linked from a module and whose filename says nothing about being a syllabus, which is common. But without that tool the syllabus goes unread. It reports the document as unread rather than treating it as empty, which is the safe direction and still not an answer. PowerPoint and legacy .doc are not extracted at all.
  • A scanned syllabus still defeats it. A PDF that is photographs of pages has no text to extract, and no OCR is attempted.
  • The first-pass reading is keyword matching. It is wrong in both directions, which is why the quoted passages are returned alongside it and the assistant is told the quotes are the evidence and the label is not.
  • It is not enforcement. The gate is a required tool call and a required written justification. Anyone determined to route around it can. What it reliably prevents is the accident: submitting AI-written work without ever having seen the rule.
  • Your approval is the real checkpoint. The written justification appears in the prompt precisely so a human reads it before anything is sent.

Where your data goes

  • The server runs on your machine and talks straight to your school’s Canvas.
  • Nothing is sent to this website. It hosts a download and this page. It has no database, no accounts and no analytics.
  • Your token is stored locally at ~/.config/canvas-mcp/config.json, mode 0600, and is never returned by any tool — so it cannot end up in a transcript.
  • Course content the assistant reads does go to whichever AI provider you are using, the same as anything else you show it. If that matters for your coursework, check your provider’s terms.
  • Revoke access any time from Canvas → Account → Settings → Approved Integrations.

When it does not work

“Canvas is not connected yet” — run canvas-mcp setup <your-canvas-url>.

401 from Canvas — the token was deleted or expired. Make a new one with canvas-mcp setup.

403 “Rate Limit Exceeded” — not an auth problem, your token is fine. Wait a minute. Asking for every assignment in every course at once is the usual cause.

404 on something you can see in Canvas — Canvas returns 404 rather than 403 for things your account cannot access through the API. Course Files are commonly hidden from students this way.

The assistant does not see the tools — check it actually launched: canvas-mcp status should report a connection. In Claude Desktop, use the full path from which canvas-mcp.

Not affiliated with Instructure

This is an independent, unofficial tool. It is not affiliated with, endorsed by, sponsored by or connected to Instructure, Inc., the makers of Canvas, or any school or university that uses Canvas. Instructure and Canvas are named here only to say what this software talks to. All trademarks belong to their owners.

It uses the public Canvas REST API with a token you create yourself, and it can do nothing your own account cannot already do.

It comes with no warranty. It will not do your homework for you, it will not save you from a missed deadline, and it will not argue with your instructor on your behalf. Verify anything that matters in Canvas itself.