boyuchengz/canvas-mcp

Worth trying if you already live in an MCP-capable AI assistant and you want coursework questions answered without clicking through Canvas modules and submission pages. It is less compelling if you dislike running your own server or your school restricts personal access tokens.

The problem

A student wants a straight answer — what is due this week, what is still missing, what score does the final need to be to hold an A — but Canvas spreads that across course dashboards, the To Do list, gradebooks and syllabus pages. The usual workflow is to click through each course, open assignments, and cross-check submission status by hand. Here the question moves into the AI client already in use: the assistant calls this server, which turns each request into Canvas REST API reads and returns a compact answer. The result is the same information the student could already see, assembled across courses in one reply.

What's different

The design centers on the read-only boundary. All 26 tools issue GET requests, inbox threads and discussions are fetched without being marked read, and the server claims no code path writes to Canvas read-only design. A client reaches it through a URL containing a long random connector secret, and the server turns each tool call into Canvas API requests, follows pagination and trims the response how it works. Because it communicates over Streamable HTTP, it can be added as a custom connector in web and mobile clients, not just desktop apps. It is also stateless: every request gets a fresh instance, with nothing cached or stored.

The practical benefit is less setup than building a Canvas integration from scratch — three runtime dependencies and no build step. The trade-off is that this is a server you deploy, not a plugin you install. The connector URL acts like a password, since anyone who has it can read the owner's Canvas data, and rotating MCP_SECRET is the documented response to a leak security notes.

Who should try it

A good fit is a single student comfortable with a Node.js deployment to Railway, Render, Fly.io or a VPS, who wants an AI assistant to answer cross-course questions such as upcoming deadlines, missing work and grade weights. The one-user-per-deployment model means a study group cannot share a single instance; each person needs their own token and deployment. A poor fit is a student without a place to host Node.js 20+ or one whose institution restricts personal access tokens — the README explicitly says to check the school's acceptable-use policy first.

Requirements and limitations

You need Node.js 20+, a Canvas personal access token from Account → Settings, and a host that can serve HTTPS; a deployment guide covers Railway, Render, Fly.io, VPS and local setups quick start. Ongoing care is mostly secret handling: the token never leaves the server, but the connector URL must be treated as a password, and the Canvas token must be deleted under Approved Integrations if compromised.

Expect gaps in content. PDFs, slides and Office files are not parsed — get_file returns a temporary download link — and New Quizzes appear under assignments rather than quizzes, with quiz questions never exposed to students. Lists cap at 500 items and long text at 20,000 characters, and calendar events without a course_id cover at most 10 courses. For a student in many courses or a class that distributes material as slides, the assistant will frequently hand back links rather than summaries.

HotRepo's take

HotRepo recorded 101 total stars and #9 on the NEW-REPOSITORY board for JavaScript on 2026-10-26, a single dated snapshot rather than daily growth. There is insufficient comparable history to judge whether interest persists. Before deploying, verify that your institution permits personal Canvas access tokens, since that single policy point decides whether the rest is usable.