Install

How to install and configure the Canvas LMS MCP server, including token creation.

Prerequisites

Python 3.11+ — the server is a Python package, run via uvx.
Your Canvas base URL — the address you normally log in at, without any path. For NUS that's https://canvas.nus.edu.sg.
A Canvas access token — walkthrough below.

This is personal-use software: your token, on your machine, reaching only your own Canvas account. See Compliance for what that means and why.

Get your Canvas access token

Canvas has no "log in with Canvas" flow for locally-installed tools, so you create a token yourself once and paste it into your AI client's config. It takes about a minute.

Open your Canvas account settings

Go to https://<your-canvas>/profile/settings directly — for NUS that's canvas.nus.edu.sg/profile/settings.

Or click through: Account in the left sidebar → Settings.

Scroll to "Approved Integrations"

It's near the bottom, below Web Services. You'll see a table of apps you've already authorised — things like Canvas for iOS or Panopto — and a + New access token button underneath it.

No "Approved Integrations" section, or no button? Your institution has disabled student token creation. Nothing in this guide will work, and there's no workaround — ask your IT service desk whether API access tokens can be enabled for your account.

Click "+ New access token"

Fill in the two fields:

Field	What to put
Purpose	Something you'll recognise later, e.g. `canvas-api-mcp`
Expires	A date, not blank — see below

Set an expiry. Leaving it blank creates a token that never expires, which is convenient right up until it leaks. Pick something that matches how long you actually expect to use it — the end of the semester is a sensible default. You can always mint a new one.

Copy the token immediately

Canvas shows the token exactly once. Close the dialog without copying it and you cannot retrieve it — you'll have to delete it and start again.

It looks like a long string beginning with a number and a tilde:

7~aBcDeF1234567890aBcDeF1234567890aBcDeF1234567890aBcDeF1234

Paste it straight into your client config in the next section. Don't put it in a note, a chat, or a file you might commit.

Treat this like your password. The token can read your grades, your submissions and your private instructor messages, and can submit work as you. It is not scoped and Canvas cannot restrict what it reaches. Anyone holding it is you, as far as the API is concerned — so never paste it into a shared repo, an issue, or a screenshot.

Revoke one any time from the same Approved Integrations table: click the bin icon next to it. Revoking is instant and breaks nothing except that token.

One-click install

These clients support installing an MCP server from a link. Each button opens the client with canvas-api-mcp pre-filled — replace your-token-here in the client's add-server dialog with your own token from the prerequisites above before saving.

Install in Cursor

Install in VS Code

Install in LM Studio

VS Code's insiders build uses the same encoding under vscode-insiders:mcp/install?... instead — build the link yourself from the manual VS Code config if you're on Insiders. LM Studio's deeplink requires LM Studio 0.3.17 or later.

Claude Code, Claude Desktop, Windsurf, and Zed have no install-from-link mechanism for arbitrary servers — configure them by hand in Manual configuration below.

Manual configuration

Add canvas-api-mcp to your MCP client's config, using uvx so nothing needs a separate install step. Fill in your own CANVAS_BASE_URL and the token you minted above.

Easiest via the CLI, which writes the config for you:

claude mcp add canvas-api-mcp --scope project \
  --env CANVAS_BASE_URL=https://canvas.nus.edu.sg \
  --env CANVAS_TOKEN=your-token-here \
  -- uvx --from git+https://github.com/JohannsenLum/canvas-api-mcp canvas-api-mcp

Swap --scope project for --scope user to register the server globally, or omit --scope entirely for the local/private default.

Or edit the config directly — project-shared config lives in <project>/.mcp.json; user and local (private, per-project) config both live inside ~/.claude.json:

.mcp.json

{
  "mcpServers": {
    "canvas-api-mcp": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/JohannsenLum/canvas-api-mcp", "canvas-api-mcp"],
      "env": {
        "CANVAS_BASE_URL": "https://canvas.nus.edu.sg",
        "CANVAS_TOKEN": "your-token-here"
      }
    }
  }
}

No deeplink/URL-install scheme is documented for Claude Code.

Not yet on PyPI

canvas-api-mcp is not published to PyPI. Every config on this page installs straight from the GitHub repository using uvx --from git+https://github.com/JohannsenLum/canvas-api-mcp canvas-api-mcp, which downloads and runs the package with no separate install step. uvx canvas-api-mcp on its own will not work until the package is published.

Verify the connection

Restart your MCP client so it picks up the new server, then ask it to call whoami — or, if your client exposes a tool list in its UI, check that canvas-api-mcp's 17 tools appear there. A correct whoami response names the Canvas account the token belongs to and that account's role in each course. You can also ask something like "what's due this week on Canvas?" — if it calls whats_due and returns real deadlines, the token and base URL are both correct.

Troubleshooting

"Invalid token" / 401 errors. The token is wrong, expired, or was revoked. Mint a new one at Account → Settings → Approved Integrations → "+ New access token" and update your client's config with it.

My institution doesn't show "Approved Integrations". Student personal-access-token generation isn't guaranteed everywhere — it varies by Canvas deployment and by institution policy. Ask your institution's IT whether student token generation is enabled; if it's disabled, this server cannot be used against that Canvas instance until it is.

Python version too old. The server requires Python 3.11+. uvx normally resolves an appropriate interpreter on its own, but if it fails, check your installed Python version and upgrade if it's below 3.11.

Server doesn't appear in the client. Confirm you fully restarted the client (for Claude Desktop, quit with Cmd+Q or the tray icon's Exit — closing the window is not enough) and that the config file is valid JSON in the exact shape shown above for your client — a missing "type": "stdio" on VS Code, a command that isn't a plain string on Zed, or a stray trailing comma anywhere will keep the server from loading. If the client logs a JSON parse error, fix the file and restart again. If it loads but calls fail, the server's own startup diagnostics name the missing or malformed environment variable.

Configuration reference

Variable	Required	Purpose
`CANVAS_BASE_URL`	yes	Your institution's Canvas root URL, e.g. `https://canvas.nus.edu.sg`. No trailing slash, no `/api/v1`.
`CANVAS_TOKEN`	yes	The personal access token from the prerequisites above.
`CANVAS_MAX_PAGES`	no	Pagination cap for list responses. Default `10`.

CANVAS_BASE_URL must use https:// — access tokens are password-equivalent and must not travel over plain http.

Where your token goes

Your token is supplied through your MCP client's own env block and stays in that client's local config file, on your machine. It is read by the local canvas-api-mcp process and sent as a bearer token on requests made directly to your own CANVAS_BASE_URL — nowhere else. No hosted service, and no third party, ever sees it. That also means nobody else can rotate or revoke it for you: if it leaks, you're the one who deletes it from Canvas.

On this page