canvas-parent-mcp 1.0.0 → 1.0.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.0.0"
+    "version": "1.0.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -30860,8 +30860,16 @@ var StdioServerTransport = class {
 };
 
 // src/config.ts
+function readVar(env, key) {
+  const raw = env[key];
+  if (typeof raw !== "string") return void 0;
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return void 0;
+  if (/^\$\{[^}]*\}$/.test(trimmed)) return void 0;
+  return trimmed;
+}
 function loadAccount(env = process.env) {
-  const baseUrl = env.CANVAS_BASE_URL;
+  const baseUrl = readVar(env, "CANVAS_BASE_URL");
   if (!baseUrl) {
     throw new Error(
       "Missing required env var: CANVAS_BASE_URL. Set CANVAS_BASE_URL (e.g. https://cms.instructure.com) plus an auth mode."
@@ -30871,13 +30879,13 @@ function loadAccount(env = process.env) {
     throw new Error(`CANVAS_BASE_URL must be an https URL, got: '${baseUrl}'`);
   }
   const cleanBaseUrl = baseUrl.replace(/\/$/, "");
-  const name = env.CANVAS_NAME || new URL(cleanBaseUrl).host;
-  const token = env.CANVAS_TOKEN;
-  const username = env.CANVAS_USERNAME;
-  const password = env.CANVAS_PASSWORD;
-  const clientId = env.CANVAS_CLIENT_ID;
-  const clientSecret = env.CANVAS_CLIENT_SECRET;
-  const refreshToken = env.CANVAS_REFRESH_TOKEN;
+  const name = readVar(env, "CANVAS_NAME") ?? new URL(cleanBaseUrl).host;
+  const token = readVar(env, "CANVAS_TOKEN");
+  const username = readVar(env, "CANVAS_USERNAME");
+  const password = readVar(env, "CANVAS_PASSWORD");
+  const clientId = readVar(env, "CANVAS_CLIENT_ID");
+  const clientSecret = readVar(env, "CANVAS_CLIENT_SECRET");
+  const refreshToken = readVar(env, "CANVAS_REFRESH_TOKEN");
   const oauthSet = [clientId, clientSecret, refreshToken].filter((v) => !!v);
   const hasFullOAuth = oauthSet.length === 3;
   const hasPartialOAuth = oauthSet.length > 0 && oauthSet.length < 3;
@@ -30930,7 +30938,7 @@ function loadAccount(env = process.env) {
       clientId,
       clientSecret,
       refreshToken,
-      accessToken: env.CANVAS_ACCESS_TOKEN
+      accessToken: readVar(env, "CANVAS_ACCESS_TOKEN")
     };
   }
   throw new Error(
@@ -31634,7 +31642,7 @@ try {
 }
 var account = loadAccount();
 var client = new CanvasClient(account);
-var server = new McpServer({ name: "canvas", version: "1.0.0" });
+var server = new McpServer({ name: "canvas", version: "1.0.1" });
 registerProfileTools(server, client);
 registerObserveeTools(server, client);
 registerCourseTools(server, client);

package/dist/config.js

@@ -1,5 +1,23 @@
+/**
+ * Read an env var, trim whitespace, and treat the empty string as unset. Also
+ * defensively rejects values that look like an unsubstituted shell placeholder
+ * (e.g. "${CANVAS_TOKEN}") — these can leak through .mcp.json env blocks when
+ * the host (Claude Code / Desktop) doesn't expand them, and would otherwise
+ * be sent to Canvas as a literal token and rejected with a confusing 401.
+ */
+function readVar(env, key) {
+    const raw = env[key];
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    if (/^\$\{[^}]*\}$/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
 export function loadAccount(env = process.env) {
-    const baseUrl = env.CANVAS_BASE_URL;
+    const baseUrl = readVar(env, 'CANVAS_BASE_URL');
     if (!baseUrl) {
         throw new Error('Missing required env var: CANVAS_BASE_URL. ' +
             'Set CANVAS_BASE_URL (e.g. https://cms.instructure.com) plus an auth mode.');
@@ -8,13 +26,13 @@ export function loadAccount(env = process.env) {
         throw new Error(`CANVAS_BASE_URL must be an https URL, got: '${baseUrl}'`);
     }
     const cleanBaseUrl = baseUrl.replace(/\/$/, '');
-    const name = env.CANVAS_NAME || new URL(cleanBaseUrl).host;
-    const token = env.CANVAS_TOKEN;
-    const username = env.CANVAS_USERNAME;
-    const password = env.CANVAS_PASSWORD;
-    const clientId = env.CANVAS_CLIENT_ID;
-    const clientSecret = env.CANVAS_CLIENT_SECRET;
-    const refreshToken = env.CANVAS_REFRESH_TOKEN;
+    const name = readVar(env, 'CANVAS_NAME') ?? new URL(cleanBaseUrl).host;
+    const token = readVar(env, 'CANVAS_TOKEN');
+    const username = readVar(env, 'CANVAS_USERNAME');
+    const password = readVar(env, 'CANVAS_PASSWORD');
+    const clientId = readVar(env, 'CANVAS_CLIENT_ID');
+    const clientSecret = readVar(env, 'CANVAS_CLIENT_SECRET');
+    const refreshToken = readVar(env, 'CANVAS_REFRESH_TOKEN');
     const oauthSet = [clientId, clientSecret, refreshToken].filter((v) => !!v);
     const hasFullOAuth = oauthSet.length === 3;
     const hasPartialOAuth = oauthSet.length > 0 && oauthSet.length < 3;
@@ -70,7 +88,7 @@ export function loadAccount(env = process.env) {
             clientId: clientId,
             clientSecret: clientSecret,
             refreshToken: refreshToken,
-            accessToken: env.CANVAS_ACCESS_TOKEN,
+            accessToken: readVar(env, 'CANVAS_ACCESS_TOKEN'),
         };
     }
     throw new Error('Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), ' +

package/dist/index.js

@@ -29,7 +29,7 @@ import { registerDiscussionTools } from './tools/discussions.js';
 import { registerFileTools } from './tools/files.js';
 const account = loadAccount();
 const client = new CanvasClient(account);
-const server = new McpServer({ name: 'canvas', version: '1.0.0' });
+const server = new McpServer({ name: 'canvas', version: '1.0.1' });
 registerProfileTools(server, client);
 registerObserveeTools(server, client);
 registerCourseTools(server, client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.0.0",
+  "version": "1.0.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "transport": {
         "type": "stdio"
       },