Provides tools for searching designs, generating AI designs, editing content, managing folders, collaborating through comments, and uploading assets via the Canva API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Canva MCP Server generate a design for a modern resume"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for Canva integration. Connect Claude Code or any MCP-compatible AI client to your Canva account — search designs, generate AI designs, edit content, manage folders, and collaborate through comments.
git clone https://github.com/your-username/canva-mcp-server.git
cd canva-mcp-server
npm install
cp .env.example .env
# Edit .env with your Canva credentials (see below)
./start.shCreate a new app
Under Authentication, copy your Client ID and Client Secret
Add http://127.0.0.1:8001/auth/callback as a redirect URI
Enable these OAuth scopes: asset:read, asset:write, comment:read, comment:write, design:content:read, design:content:write, design:meta:read, folder:read, folder:write, profile:read
Set your credentials in .env:
CANVA_CLIENT_ID=your_client_id_here
CANVA_CLIENT_SECRET=your_client_secret_here
CANVA_REDIRECT_URI=http://127.0.0.1:8001/auth/callbackRelated MCP server: Canva API MCP Server
claude mcp add --transport sse --scope user canva http://127.0.0.1:8001/mcpThen start the server (./start.sh) before opening Claude Code. On first tool call, the server returns an OAuth URL — visit it in your browser to authenticate.
Tool | Description |
| Search designs by title, sort order, and ownership |
| Get metadata for a specific design |
| List all pages in a design with thumbnails |
| Extract all text content from a design |
| Generate AI design candidates from a text description |
| Convert an AI candidate into an editable design |
| Begin an editing session, returns a transaction ID |
| Update title, replace text, or replace media |
| Save all changes in a transaction |
| Discard all changes in a transaction |
| Get a page thumbnail during editing |
| Create a folder (root or nested) |
| Move a design or folder into another folder |
| Browse folder contents with filtering |
| Add a comment to a design |
| List all comments on a design |
| Reply to a comment thread |
| List all replies to a comment |
| Import an image or video from a URL |
| Retrieve metadata for multiple assets |
This fork hardens the original with:
127.0.0.1 binding — server listens on loopback only, not exposed to the network
Auth middleware — optional Bearer token (MCP_AUTH_TOKEN in .env) secures the MCP endpoint
XSS protection — all UI widget templates use DOM API construction instead of innerHTML with API data
CORS allowlist — configurable via CORS_ORIGINS env var, no wildcard in production paths
Input validation — Zod schemas on all tool inputs, size limits enforced
Error sanitization — Canva API errors logged server-side, not reflected to clients
The src/server/worker.ts file is a development/demo stub for Cloudflare Workers deployment. For production, use the Node.js server (src/server/server.ts).
canva-mcp-server/
├── src/
│ └── server/
│ ├── server.ts # Main Node.js server
│ └── worker.ts # Cloudflare Worker demo stub
├── src/components/ # React widget components (compiled to assets/)
├── ui-components/ # Standalone HTML widget templates
├── assets/ # Compiled widget output (generated by npm run build)
├── .env.example # Environment variable template
├── start.sh # Start script
├── quick-start.sh # First-run setup script
└── README.mdThis fork was security-hardened through a multi-agent parallel review pipeline built by The Funkatorium:
Agent | Role | What they caught |
Michael | Senior Security Specialist | Zero-auth MCP endpoints, |
Reeve | Code Craft Reviewer | Mock import overriding production code, dead if/else branches, AI-generated docs committed to repo, unused hook subscriptions |
Fischer | Static Analysis Specialist | 20+ |
Nikita | Dependency Safety Specialist | Exposed Client ID in |
Three audit rounds. 12-point final gate check. All agents run in parallel — independent concerns, no bottleneck.
This is how MUSE Studio builds software.
Based on EmilyThaHuman/canva-mcp-server. Security-hardened by The Funkatorium.
MIT — see LICENSE
This server cannot be deployed
The Canva MCP server connects AI assistants (like Claude, ChatGPT, and Cursor) to Canva's API, enabling them to create and manage designs directly within chat conversations. Key capabilities include generating new designs from prompts, autofilling templates, searching and resizing existing designs, importing files from URLs, exporting designs as PDFs or images, and managing folders and comments without switching between tools.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Model Context Protocol server for the Apideck Unified API. Connect any MCP-compatible agent framework to 100+ accounting systems, HRIS platforms, file storage providers, and more through one integration. More information https://www.apideck.com/mcp-server
Marketo MCP server for AI. 130 tools to operate Marketo from Claude, Cursor, or ChatGPT.
