MMCPMarkets
DM

dmontgomery40/mcp-canvas-lms

开发工具

本页由 AI 翻译，技术细节请以原文为准。 查看原文

104 stars 39 forks 质量 70 趋势 19
Repository Install

版本 2.2 - 可用54个工具——一个MCP服务器，用于与Canvas LMS API交互。该服务器允许你在Canvas内管理课程、作业、注册和成绩。

概览

该项目是一个独立的 Canvas LMS API MCP 服务器。它与 Instructure 或 Canvas 没有关联、认可或维护。 2025年6月，在开发MCP期间，我在 bootcampspot.instructure.com 发现了Canvas环境中的一个访问控制失效问题。该问题暴露了我课程中其他学生的个人身份信息。 我于2025年6月5日通过Bugcrowd报告了这个问题，并直接联系了Instructure和Canvas的安全渠道。Bugcrowd的报告后来被关闭为“不适用”。在后续的通信中，Instructure表示 bootcampspot.instructure.com 环境已超出其控制范围。 - 披露帖：https://www.reddit.com/r/cybersecurity/comments/1t6wmkw/reported_a_broken_access_control_bug_to/ - Bugcrowd活动时间线：https://imgur.com/gallery/canvas-vuln-declared-n-11-months-ago-zYfHnBs - 后续Instructure / BootcampSpot通信：https://imgur.

概述（AI 翻译）

安全与披露历史

该项目是一个独立的 Canvas LMS API MCP 服务器。它与 Instructure 或 Canvas 没有关联、认可或维护。

2025年6月，在开发MCP期间，我在 bootcampspot.instructure.com 发现了Canvas环境中的一个访问控制失效问题。该问题暴露了我课程中其他学生的个人身份信息。

我于2025年6月5日通过Bugcrowd报告了这个问题，并直接联系了Instructure和Canvas的安全渠道。Bugcrowd的报告后来被关闭为“不适用”。在后续的通信中，Instructure表示 bootcampspot.instructure.com 环境已超出其控制范围。

公开参考资料：

本页由 AI 翻译，技术细节请以原文为准。

README

以下为原文 README 节选，完整内容请查看原文。

Canvas MCP Server v2.3.0

Security and disclosure history

This project is an independent MCP server for Canvas LMS APIs. It is not affiliated with, endorsed by, or maintained by Instructure or Canvas.

In June 2025, during development of this MCP, I identified a Broken Access Control issue in the Canvas environment at bootcampspot.instructure.com. The issue exposed personally identifiable information for other students enrolled in my course.

I reported the issue through Bugcrowd on June 5, 2025, and also contacted Instructure / Canvas security channels directly. The Bugcrowd report was later closed as “Not Applicable.” In subsequent correspondence, Instructure stated that the bootcampspot.instructure.com environment was outside its control.

Public references:

This repository does not publish exploit steps, affected tenant details beyond what is already public, live URLs, screenshots containing student data, or proof-of-concept abuse flows.

Separately, Instructure publicly disclosed a Canvas security incident in May 2026, and public reporting has linked the incident to ShinyHunters claims. This repository makes no claim that the June 2025 report caused, enabled, predicted, or is technically connected to the May 2026 incident.

This disclosure is documented here for project history and transparency only.

What this is

A comprehensive Model Context Protocol (MCP) server for Canvas LMS with complete student, instructor, and account administration functionality

🚀 What’s New in v2.3.0

  • 🌐 NEW: Streamable HTTP transport support (MCP_TRANSPORT=streamable-http)
  • 🖥️ Preserved: First-class stdio transport for local MCP clients
  • 🧪 Added: Behavior tests for lifecycle, transports, and structured failure-path errors
  • 🧱 Improved: Stricter tool schemas and codemode-oriented tool descriptions
  • 🔧 FIXED: Course creation “page not found” error (missing account_id parameter)
  • 👨‍💼 Account Management: Complete account-level administration tools
  • 📊 Reports & Analytics: Generate and access Canvas account reports
  • 👥 User Management: Create and manage users at the account level
  • 🏢 Multi-Account Support: Handle account hierarchies and sub-accounts
  • ✅ API Compliance: All endpoints now follow proper Canvas API patterns

🎯 Key Features

🎓 For Students

  • Course Management: Access all courses, syllabi, and course materials
  • Assignment Workflow: View, submit (text/URL/files), and track assignments
  • Communication: Participate in discussions, read announcements, send messages
  • Progress Tracking: Monitor grades, module completion, and calendar events
在 GitHub 查看完整 README

安装

npx -y canvas-mcp-server
新手？先看 mcpskill.org 教程 →

配置

{ "mcpServers": { "canvas-mcp-server": { "command": "npx", "args": ["-y", "canvas-mcp-server"], "env": { "CANVAS_API_TOKEN": "your_token_here", "CANVAS_DOMAIN": "your_school.instructure.com" } } } }