🌐 Canvas LMS MCP: Remote Edition

Use Canvas from your AI assistant on any device: web, desktop and mobile. Always on, password-protected, with automatic failover across several computers.

209 tools · OAuth 2.1 · ngrok tunnel · Multi-computer failover

Website · Quick start · Multi-device guide · Configuration · Tools · Security

🤔 Remote or Local?

Related MCP server: mcp-kg-oauth

✨ Highlights

• 📊 Grade intelligence: what_if_grade, compute_needed_score, grade_impact_ranking, full weighted breakdowns

• 📅 Planning: get_week_ahead, semester_snapshot, study_priority_ranking, cross-course missing work in one call

• 📝 Submissions: submit text, URLs and files, with a dry-run preview first

• 💬 Discussions & inbox: read whole threads in one request and message instructors

• 📁 Content: files, pages, modules, lecture captions and full .imscc course export

• 🔐 Secure remote access: password-gated OAuth 2.1 over an ngrok tunnel

• 🔁 Multi-computer failover: run it on two or more computers, and if one sleeps, another takes over in about a minute

🧭 How it works

 Your AI app (web / desktop / mobile / CLI)
          │  HTTPS + OAuth
          ▼
   your-domain.ngrok-free.dev ──►  supervisor.js  ──►  index.js (127.0.0.1:3939/mcp)  ──►  Canvas API
                                   (keeps it alive,     (209 tools, OAuth,
                                    failover)            rate-limit aware)

🚀 Quick start

You need: Node.js 18+, a Canvas account and a free ngrok account.

1. Download and install

git clone https://github.com/Fireiscoolsolo/canvas-lms-mcp-server.git
cd canvas-lms-mcp-server
npm install

2. Create a Canvas token

In Canvas, go to Account → Settings → Approved Integrations → + New Access Token. Canvas only shows the token once, so copy it right away.

3. Set up ngrok

winget install --id Ngrok.Ngrok -e
ngrok update                                   # the winget version is often too old (ERR_NGROK_121)
ngrok config add-authtoken <your-ngrok-authtoken>

Then claim your free static domain in the ngrok dashboard, e.g. your-name.ngrok-free.dev.

4. Configure .env

Copy .env.example to .env and fill it in. Generate the password and secret with:

node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"

5. Test it

node supervisor.js

Wait until you see active and serving at https://…, then press Ctrl+C.

6. Run it automatically at logon (Windows)

In PowerShell, from the repo folder:

$dir      = (Get-Location).Path
$action   = New-ScheduledTaskAction -Execute "$dir\run-supervisor.cmd" -WorkingDirectory $dir
$trigger  = New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\$env:USERNAME"
$settings = New-ScheduledTaskSettingsSet -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -MultipleInstances IgnoreNew
Register-ScheduledTask -TaskName CanvasSupervisor -Action $action -Trigger $trigger -Settings $settings -Force
Start-ScheduledTask -TaskName CanvasSupervisor

run-supervisor.cmd assumes Node is at C:\Program Files\nodejs\node.exe. If yours is somewhere else, edit that file. On Linux, run it as a systemd user service (example). On macOS, run node supervisor.js under launchd or pm2.

7. Connect your AI app, on every device

In your AI app's settings, add a custom connector (also called a remote MCP server) with the URL https://<your-domain>/mcp, then log in with your password. Apps that sync connectors to your account will show it on your phone and desktop too. Command-line and editor clients can add it as an HTTP MCP server with the same URL.

Then ask your assistant: "Run test_connection."

🔁 Multiple computers

You can run the same server on two or more computers, for example a desktop and a laptop, so it stays online when one is off or asleep. One computer serves; the others wait in standby and take over automatically.

➡️ Follow the step-by-step Multi-Device Setup Guide. It covers copying settings safely, the shared ngrok account, the scheduled task, checking it works, testing failover, updating code and changing secrets.

⚙️ Configuration

All settings are environment variables in .env. See .env.example.

🧰 Tools

🔐 Security

• Confirmation gate: tools that send, submit, post or delete return a preview first and only act when called with confirm: true.

• Prompt-injection fencing: text other people wrote is wrapped in <<<CANVAS_CONTENT>>> markers and labelled as untrusted.

• No quiz-taking: quiz attempt endpoints are deliberately not included.

• Loopback only: the server listens on 127.0.0.1. The only way in from outside is the tunnel.

• OAuth 2.1: login is limited to 10 attempts per 15 minutes per IP, access tokens last 1 hour, and refresh tokens are replaced every time they're used.

• Separate coordination secret: the endpoints the computers use to coordinate need a separate shared secret, compared in constant time.

Never commit .env, oauth-store.json or supervisor.log. They're already listed in .gitignore. See SECURITY.md.

🎓 Responsible use

This is a study and organization tool. It helps you see deadlines, understand your grades and plan your week. It never takes quizzes, and nothing is sent or submitted until you've seen a preview and confirmed it.

• Follow your school's academic integrity and acceptable-use policies. Some schools restrict personal API tokens or third-party tools.

• Want zero risk of accidental changes? Set CANVAS_ALLOW_WRITES=false for read-only mode.

🛠️ Troubleshooting

More issues with several computers are covered in the Multi-Device guide.

Restart cleanly. Stop-ScheduledTask alone can leave processes running:

Stop-ScheduledTask -TaskName CanvasSupervisor -ErrorAction SilentlyContinue
Get-CimInstance Win32_Process -Filter "Name='node.exe'" | Where-Object { $_.CommandLine -match 'supervisor\.js|index\.js' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
Get-Process ngrok -ErrorAction SilentlyContinue | Stop-Process -Force
Start-ScheduledTask -TaskName CanvasSupervisor

Known limits: a student token can't reach admin endpoints, gradebook history, course analytics or quiz statistics. smart_search is a Canvas beta feature and often returns 404.

📄 License

MIT. This project isn't affiliated with Instructure.