Canvas MCP

MCP server that exposes Canvas LMS as tools — courses, modules, files, pages, assignments, submissions/grades, announcements, upcoming deadlines, and syllabus.

Designed to be consumed by Ada (chat tool loop / edge functions) and any other MCP client (Claude Desktop, Cursor, etc.).

Setup

cd mcps/canvas
npm install
npm run build

Create .env (or pass through your MCP client config):

CANVAS_BASE_URL=https://canvas.asu.edu/api/v1
CANVAS_TOKEN=your_canvas_personal_access_token

Generate the token in Canvas: Account → Settings → New Access Token.

Related MCP server: Canvas LMS MCP Server

Run

Stdio transport (default for MCP clients):

CANVAS_BASE_URL=... CANVAS_TOKEN=... node dist/index.js

Tools

Claude Desktop config

{
  "mcpServers": {
    "canvas": {
      "command": "node",
      "args": ["/absolute/path/to/ada/mcps/canvas/dist/index.js"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.asu.edu/api/v1",
        "CANVAS_TOKEN": "..."
      }
    }
  }
}

Cloudflare Workers (HTTP transport)

src/worker.ts exposes the same toolset over HTTP for hosting on Cloudflare Workers. Deploy with:

npx wrangler deploy

Set the secrets once via wrangler secret put:

echo "https://canvas.asu.edu/api/v1" | npx wrangler secret put CANVAS_BASE_URL
echo "your_canvas_token"            | npx wrangler secret put CANVAS_TOKEN

The Worker accepts JSON-RPC tools/list and tools/call POSTs.

Multi-tenant headers (override env per request — Ada uses these):

Authorization:    Bearer <user's canvas PAT>
X-Canvas-Base-Url https://canvas.<institution>.edu/api/v1
X-Ada-Service-Key <ADA_SERVICE_KEY>          # required when env.ADA_SERVICE_KEY is set

When no headers are present, the worker falls back to the CANVAS_BASE_URL / CANVAS_TOKEN secrets (single-tenant mode). Set ADA_SERVICE_KEY to gate header-based requests behind a shared secret:

echo "$(openssl rand -hex 32)" | npx wrangler secret put ADA_SERVICE_KEY

Notes

• Canvas pagination is followed automatically via the Link header up to per-call caps.

• get_file_text decodes as UTF-8; binary formats (PDF, DOCX) need upstream extraction.

• Single-tenant by env var. For multi-user (Ada), spawn one process per user or swap stdio for an HTTP transport that accepts a per-request token.