What's New in v1.6.0

Changes

• chore: bump version to 1.6.0
• docs: v1.6.0 release notes — complete the Unreleased section
• fix: associate_rubric never attached the rubric (#181) + shared write-confirmation guard (#189)
• ci: run Ruff checks in CI (#186)
• docs: session log 2026-07-30 — shipped #170/#171/#179/#180; four PRs merged + deployed
• docs: mark #170/#171/#179/#180 shipped in Current Focus
• feat: Tier 1 student write tools with per-course faculty gate (#170) (#185)
• fix(privacy): anonymization tiers — gate /conversations and /pages; cover missed email keys (#179) (#184)
• fix: self-identity tools; stop check_enrollment answering NO when it cannot know (#171) (#183)
• fix(rubrics): bookmark created rubrics into the course so Canvas shows them (#180) (#182)
• docs: session log 2026-07-29 — UMich triage blitz, #166 PII fix shipped (#177), safer defaults (#178), hosted spec drafted
• docs: refresh impact stats (2026-07-29 collection)
• docs: update test count from 328 to 550+ (#176)
• fix(security): safer defaults — code exec opt-in, image anonymization opt-out (#178)
• fix(security): recursive identity scrub for the anonymizer (#166) (#177)
• chore: add Canvas token rotation script + ignore .env backups
• docs: session log 2026-07-21 — fastmcp 3.4.4 shipped (#145/PR #167), #142 re-scoped, GRC follow-up sent
• fix: upgrade fastmcp 2.14.7 -> 3.4.4 (PYSEC-2026-2475/2476) (#145) (#167)
• docs: session log 2026-07-21 — #164 anonymization bypass fixed/merged/deployed, fastmcp CVE flagged
• docs: refresh impact stats (2026-07-20 collection)
• fix: anonymization bypass for /courses/-scoped student-data endpoints (#165)
• docs: session log 2026-07-10 — /doctor cleanup, #142 to Ash, #157 downgraded
• docs: move release checklist to internal/ to trim always-loaded CLAUDE.md
• docs: session log — #159 fixed (stateless HTTP), deployed and live-verified
• fix: run HTTP transport stateless to eliminate stale-session hangs (#159) (#160)
• docs: session log — Tech Services review doc sent, impact stats refresh
• chore(impact): refresh stats 2026-07-06 (stars 154, forks 47)
• docs: wrap session — v1.5.0 released, PR queue cleared, branches pruned
• chore: sync uv.lock to v1.5.0

Released: July 30, 2026

For installation instructions, see the README.

What's New in v1.5.0

Changes

• release: v1.5.0 — get_syllabus, create_rubric_from_csv, update_discussion_topic; fastmcp 2.x; security hardening
• docs: MCP Apps interactive-UI feasibility (analytics pilot) (#117)
• security: upgrade deps, gate dependency-scan CI, harden ts container sandbox (#156)
• build(docker): install the [hosted] extra so the image supports the access-approval flow (#153)
• docs: remove SBC 511 course tasks from session log; reconcile PR #155 merged
• docs: bump role tool counts and add CHANGELOG entry for update_discussion_topic
• docs: wrap session — update_discussion_topic draft PR #155 open
• Add update_discussion_topic tool to edit discussion prompts via MCP (#154).
• docs: wrap session — Canvas token renewed + verified, SBC 511 launch audit queued
• docs: wrap session — fixed Claude Desktop connector auth (Entra manifest), Canvas token expired
• docs: wrap session — pulled PR #152 (fastmcp 2.x migration), tests verified green
• refactor: migrate to fastmcp 2.x (#145, PR 1 of 2) (#152)
• docs: wrap session — PR #150 merged, #151 closed as false positive, ruleset fixed
• feat: self-service access-approval flow for the hosted (Entra-gated) server (#150)
• docs: wrap session — Adam email sent, compliance PDF/HTML regenerated (overflow fix), hosted server verified live
• docs: wrap session — #146 closed, compliance doc overhauled for IT/LRA review, Aptos email standard
• chore(gitignore): broaden internal/docs .local pattern to .local.* (was .local.md only)
• chore: untrack internal/SECURITY-COMPLIANCE.md (operator-only, not public)
• docs(compliance): lead with course-ops-at-scale as primary use case
• docs(compliance): add risk-graded deployment tiers + model-portability framing
• docs(compliance): reflect live Entra auth — P0 IT05/FO-36 identity gap resolved
• chore(impact): refresh stats 2026-06-29 (stars 153, forks 45)
• docs(internal): point README at hosted ops runbook (#146 OAuth troubleshooting)
• docs: slim CLAUDE.md — relocate architecture + #146 post-mortem
• refactor: rename canvas_api_url_raw to canvas_api_url_configured (#149)
• fix: normalize CANVAS_API_URL to canonical /api/v1 form (#148)
• docs: include /api/v1 in Desktop Extension Canvas API URL example (#143)
• docs: wrap session — 2 faculty added to hosted allowlist (7→9 OIDs), onboarding-simplification thread
• docs: refresh impact stats (stars 150, forks 42; 2026-06-22 datapoint)
• docs: log hosted .mcpb npx/PATH launch fix (vendored mcp-remote)
• docs: wrap session — public-site leak fix, hosted access lockdown, onboarding, hosted .mcpb
• fix(site): stop publishing local-only ops/compliance docs
• docs: adversarial architecture review + move internal docs off the public site (#139)
• chore: refresh Canvas API docs link + pin mypy <2 (#141)
• fix(courses): honor CANVAS_ROLE in list_courses, scope to active enrollments (#140)
• feat: add create_rubric_from_csv tool for native CSV imports (#132)
• test: cover code_execution security helpers and Canvas User-Agent (#138)
• feat(courses): add get_syllabus tool for full untruncated syllabus body (#137)
• docs: fix dead Troubleshooting anchor (#configuration -> #local-installation) (#133)
• docs: wrap session — v1.4.0 released, Desktop Extension, repo sanitized
• chore: sync uv.lock to v1.4.0

Released: July 05, 2026

For installation instructions, see the README.

What's New in v1.4.0

Changes

• chore(release): v1.4.0 — check_enrollment, Desktop Extension, Entra hosting
• feat(mcpb): distribute the Desktop Extension via GitHub Releases
• feat(mcpb): scaffold Claude Desktop Extension (.mcpb) packaging
• docs: untrack internal compliance email drafts from the public repo
• docs: move private hosted-deployment details out of the public repo
• docs: canvas-mcp hosted deployment live (custom domain, rename, CI)
• docs(tools): document check_enrollment across AGENTS/README/manifest
• ci(azure): point deploy workflows at canvas-mcp (renamed from gies-canvas-mcp) (#129)
• ci(azure): auto-deploy to prod on merge to main + staging-slot pipeline (#128)
• feat(enrollment): check_enrollment capability (core + MCP tool) (#126)
• docs: wrap session — Entra v2 cutover, mcp-remote blocker, custom-domain pivot
• feat(http): Entra ID platform-auth identity path (App Service header-reader) (#125)
• docs(auth): add Entra OAuth identity plan + trim VPN from compliance memo (#124)
• fix(http): fail closed when access-key gate is unconfigured + FERPA compliance docs (#123)
• docs: wrap session — #115 v1 validated end-to-end + 3 teammates onboarded
• docs: add Cheng (L&D) as MCP_ACCESS_KEYS holder #4
• docs: #115 v1 validated end-to-end — TA Lalitha connected via Claude Desktop (2026-06-14)
• docs: note MCP_ACCESS_KEYS holders (operator/Lalitha/Ash) + Claude Desktop mcp-remote setup
• docs: correct AcrPull authority — subscription Owner (Adam/Business Server Admins), not Ash
• impact: refresh stats (data through 2026-06-08; stars 142, forks 39)
• docs: record #115 v1 deploy (Azure staging hosted-deployment facts + 2026-06-13 session log)
• feat(http): token-only fail-closed auth for hosted multi-user HTTP MCP (#115) (#121)
• refactor: drop import-time config singleton + fix stdout anonymization warnings (#120)
• Weekly maintenance: SSRF fix, EXECUTE_TYPESCRIPT_ENABLED kill switch, doc/dep/import cleanup (#118)
• impact: refresh stats + harden PyPI fetch against silent-0 failures
• Fix/timezone aware format date (#113)
• docs: log 2026-06-05 session (hosted-server retirement, #115), archive 05-14
• docs: mark hosted server retired in README/AGENTS, add CHANGELOG Security note
• docs: remove decommissioned hosted-server install path from website
• docs: mark mcp.illinihunt.org hosted server decommissioned (→ #115)
• docs: refresh impact stats (2026-06-01 snapshot) + cron heartbeat sentinel
• docs: log 2026-05-14 session (PRs #105, #107), archive 05-07 entry
• ci: split publish-mcp into PyPI + Registry jobs with propagation poll (#107)
• docs: refresh impact stats (2026-05-11 snapshot)
• chore: housekeeping — dev deps, remove unused requests, bump setup-python (#105)
• docs: fix hosted config instructions for Claude Desktop
• Initial plan
• docs: refresh impact stats, log 2026-05-07 session, archive 05-02 entry
• docs: log v1.3.0 release session, archive 2026-04-21 entry
• chore: refresh uv.lock to canvas-mcp 1.3.0

Released: June 18, 2026

For installation instructions, see the README.

What's New in v1.3.0

Changes

• release: v1.3.0
• docs: refresh impact stats (2026-04-27)
• docs: add Claude memory lookup + external-action approval policy to AGENTS.md
• fix: "Event loop is closed" on user-scoped tools (get_my_todo_items, get_my_upcoming_assignments, etc.) (#99)
• feat: Add create_rubric tool using bracket-notation form-data encoding (#100)
• safety: add limit + dry_run to bulk_delete_announcements, note permanence in delete docstrings (#96)
• docs: amend session log — canvas-mcp-meets-skills-sh article dropped
• docs: log PR #93 (fastmcp phantom dep cleanup) in 2026-04-21 session entry
• chore: drop unused standalone fastmcp dependency (#93)
• fix: remove dead code and bump dependency version floors (#92)
• docs: log CLI config-writer DRY refactor in 2026-04-18 session entry
• refactor: extract shared scaffolding in cli config-writer
• docs: update session log for 2026-04-18 wrap-up
• chore: defensive .gitignore additions for OS/editor cruft
• chore: move session-history.md to docs/ (P4)
• chore: revert unintended article commit from b72b210
• chore: delete P3 duplicate markdown guides, link to HTML site (-842 lines)
• chore: delete P2 UIUC security cluster from audit (-914 lines)
• chore: delete P1 orphan docs from audit (-2,421 lines)
• chore: delete P0 stale files from audit (-3,937 lines)
• chore: untrack .claude/ from public repo
• chore: acknowledge @DomBarker99 and tighten .gitignore
• docs: bump tool count to 88 after adding read_course_file (#90)
• feat(files): add read_course_file tool for remote MCP deployments (#90)
• fix(admin_tools): rewrite get_student_analytics to return real per-student engagement
• Weekly maintenance: fix tool count, remove duplicate dev deps, add logging, add test coverage (#89)
• docs: update session log for rubric rationalization session
• chore: remove 11 stale markdown files (~160k, 4766 lines) (#87)
• refactor: rationalize rubric tools 11 → 6, remove 540 lines (#86)
• docs: add rubric tool rationalization implementation plan
• docs: add rubric tool rationalization spec
• docs: update session log and roadmap for v1.2.0 release
• chore: update uv.lock for v1.2.0
• docs: fix tool count (92), test count (328), add role-based filtering to site

Released: May 02, 2026

For installation instructions, see the README.

What's New in v1.2.0

Changes

• chore: bump to v1.2.0 — role-based filtering, accessibility, security hardening
• docs: update session log and archive older entries
• docs: update impact stats data
• fix: resolve npx.cmd Windows incompatibility in execute_typescript (#85)
• refactor: consolidate CI workflows — remove 3 redundant checks
• fix: make CI workflows fork-aware and add OAuth token check
• fix: reset invalid CANVAS_ROLE in validate_config and show resolved role in --config
• feat: role-based tool filtering and tool annotations (#84)
• feat: add fix_accessibility_issues tool for automated remediation
• feat: expand accessibility scanner from 4 to 20 WCAG checks
• docs: update session log, archive stale entries, delete completed plans
• fix: harden file I/O across codebase against path traversal and symlink attacks
• fix: prevent path traversal in generate_peer_review_report filename parameter
• Initial plan
• Add Drew Rozema testimonial to website and update impact stats
• Update session log: impact tracker implemented, speaker profile saved
• Add live Impact section to website with automated stats collection
• Update session log for Mar 20 (InstructureCon proposal, impact metrics, README refresh)
• Add header image, impact metrics snapshot, and README cleanup
• Update session log for Mar 13 (event loop fix, concurrency limiter, workshop)
• Update workshop page with enhanced setup instructions
• fix: event loop closed error on first MCP call + add concurrency limiter
• Add workshop Canvas course URL and access callouts
• Update session log for Mar 12 (CLI package, workshop, light theme)
• Switch entire site to light theme, update workshop for Codex desktop app
• feat: add workshop setup guide page for Codex + Canvas MCP
• feat(cli): add README, design spec, and implementation plan
• chore(cli): bump to v1.1.0 for npm publish (1.0.0-1.0.1 were ghost versions)
• feat(cli): add CLI entry point with setup command and help
• feat(cli): add interactive setup wizard with token/URL/client prompts
• test(cli): add config writer tests (JSON, TOML, merge, backup)
• feat(cli): add config writer with JSON/TOML merge and backup
• feat(cli): add client registry with paths for 6 MCP clients
• feat(cli): scaffold npm package for canvas-mcp setup wizard
• Add CLI setup wizard design spec
• Update session log for Mar 5 (analytics beacon, auto-deploy investigation)
• Add Cloudflare Web Analytics beacon to guide pages
• Update session log and roadmap for Cloudflare Pages migration
• Migrate site to Cloudflare Pages, add Learning Designer guide
• Trigger GitHub Pages rebuild
• Add FERPA privacy disclaimers for hosted server
• Add hosted server documentation to README, AGENTS.md, and GitHub Pages
• Update deploy configs for Cloudflare Full SSL mode
• Add HTTP transport with per-request credentials for hosted deployment
• Update README release date and add token optimization to v1.1.0 notes
• Check off v1.1.0 release in Current Focus

Released: April 10, 2026

For installation instructions, see the README.

What's New in v1.1.0

Learning Designer Tools & Skills

• New MCP tool: get_course_structure — full module→items tree with summary stats
• New MCP tool: delete_page — title-match safety check for page deletion
• 3 new agent skills: canvas-course-qc, canvas-accessibility-auditor, canvas-course-builder
• Skills available via skills.sh (40+ agents) and Claude Code slash commands

File Management (Community Contribution)

• feat: download_course_file and list_course_files tools (PR #75 by @Metzpapa)
• fix: Path traversal vulnerability in file downloads
• fix: Streaming downloads for large files, cross-platform temp directory

Token Optimization

• Trimmed MCP tool docstrings across all 91 tools (~35% reduction in MCP context overhead)
• Removed Example Usage blocks, Returns/Raises sections, compressed Args descriptions
• Net: -688 lines, +337 lines across 15 tool files

Codebase Quality

• refactor: Reduce complexity in core modules — type dispatch, structured logging (PR #78)
• fix: Shutdown crash on Python 3.14 (asyncio event loop closed)
• fix: Remove institution-specific defaults for generic distribution
• chore: Improve CLAUDE.md — fix bugs, trim bloat, archive old logs

Documentation & Website

• Updated GitHub Pages site with Learning Designer persona cards and skill cards
• Added skills.sh install command to README hero section
• Audited and fixed 7 documentation disconnects (tool count, test count, analytics, URLs)
• Added Cloudflare Web Analytics beacon

Stats

• 91 MCP tools across 15 modules
• 8 agent skills for skills.sh
• 275+ tests passing

Released: March 4, 2026

For installation instructions, see the README.

What's New in v1.0.8

Changes

• fix: update server.json version and harden release workflows
• chore: release v1.0.8 — security hardening and code quality
• chore: remove unused smithery-wrapper prototype
• chore: remove accidentally committed Build AI Product Sense folder
• chore: enforce ruff linting — fix 464 issues, add pre-commit hook
• fix: resolve all CodeQL code scanning alerts
• feat: Security hardening - PII sanitization, token validation, audit logging, sandbox (#74)
• fix: submission status always shows not submitted even though submitted (#73)
• fix: error argument of type 'int' is not iterable in get_my_upcoming_assignments and get_my_todo_items (#72)
• fix: handle Literal types in validate_params to prevent TypeError
• fix: harden parameter validation and date parsing
• fix: harden README update fallback in release workflow (#68)
• Automate GitHub release creation and README updates on tag push (#61)
• Fix get_my_upcoming_assignments parameter validation (#67)
• Fix datetime comparison error in student tools (#65)
• docs: Broaden AI assistant messaging beyond Claude-only
• chore: Add glama.json for Glama.ai MCP directory listing
• feat: Add SEO and AI discoverability improvements
• docs: Document Smithery publishing attempt and add TS wrapper
• docs: Update to v1.0.7 and redesign GitHub Pages website
• docs: Add git workflow reminder to ask about branching
• docs: Add update_assignment to tool documentation
• feat: Add update_assignment tool and move CLAUDE.md to root
• docs: Update session log for 2026-01-21
• fix: Disable broken rubric API tools (create_rubric, update_rubric)

Released: February 16, 2026

For installation instructions, see the README.

What's New

File Upload Tool 📁

New upload_course_file tool enables uploading files from the local filesystem to Canvas courses.

Features

• Canvas 3-step upload protocol - Handles the complete upload flow transparently
• Comprehensive validation - File existence, readability, size limits (100MB), extension whitelist
• MIME type detection - Automatic content-type detection from file extension
• Filename sanitization - Cleans special characters for safe Canvas storage
• Security-first - Whitelist approach blocks potentially dangerous file types

Usage Example

# Upload a PDF to Canvas
upload_course_file("CS101", "/path/to/syllabus.pdf")
# → "✅ Uploaded! File ID: 12345, Name: syllabus.pdf"

# Then add to a module
add_module_item("CS101", module_id, "File", content_id=12345)

# Or attach to a message
send_conversation("CS101", ["student_id"], "Subject", "Body", attachment_ids=["12345"])

Parameters

• course_identifier - Course code or ID
• file_path - Local filesystem path to upload
• folder_path (optional) - Canvas folder destination
• display_name (optional) - Override filename in Canvas
• on_duplicate - "rename" (default) or "overwrite"

New Files

• src/canvas_mcp/core/file_validation.py - Validation utilities
• src/canvas_mcp/tools/files.py - Upload tool implementation
• tests/tools/test_files.py - 33 unit tests

Testing

• 33 new tests for file upload functionality
• 183 total tests passing

Full Changelog: v1.0.6...v1.0.7

What's New

🎯 Claude Code Skills

Pre-built workflows that combine multiple tools into one-command actions:

🌐 GitHub Pages Website

Beautiful documentation site at vishalsachdev.github.io/canvas-mcp

• Modern dark theme with teal accent
• Responsive design
• Full HTML documentation for Students, Educators, and Developers
• Skills showcase with "Request a Skill" feature

📖 HTML Documentation

• Student Guide
• Educator Guide
• Code Execution API

Want a custom skill? Submit a request describing your repetitive workflow!

Full Changelog: v1.0.4...v1.0.5

Canvas MCP v1.0.4

🚀 Major Features

Code Execution Environment

• TypeScript code execution API for token-efficient bulk operations (99.7% token savings)
• Execute custom TypeScript code for complex Canvas operations
• Dramatically reduces token usage for batch processing

New MCP Tools

• bulk_grade_submissions - Efficient batch grading with optional rubric assessment
• bulk_grade_discussions - Token-efficient discussion grading API
• search_canvas_tools - Discover available MCP tools dynamically

✨ Improvements

• MCP 2.10 Compliance - Updated FastMCP to >=2.10.0
• Structured Logging - Standardized error handling and logging
• Flexible Grading - Rubric assessment now optional for simple grading scenarios
• GitHub Actions Integration - Automated workflows and chat session exports
• Enhanced Validation - Added validation for maxPeerReviewPoints configuration

🐛 Fixes

• Improved error handling with direct API calls
• Concurrent processing optimization
• Better validation and feedback

📚 Documentation

• Complete documentation for all new tools
• Code execution examples
• Bulk operations guides

Token Efficiency: The new code execution environment can reduce token usage by 99.7% for bulk operations compared to traditional tool-based approaches.