canvas-parent-mcp 1.1.5 → 1.1.7

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.1.5"
+    "version": "1.1.7"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.1.5",
+      "version": "1.1.7",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Hall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,9 @@
 # canvas-parent-mcp
 
+[![CI](https://github.com/chrischall/canvas-parent-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/chrischall/canvas-parent-mcp/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/canvas-parent-mcp)](https://www.npmjs.com/package/canvas-parent-mcp)
+[![license](https://img.shields.io/npm/l/canvas-parent-mcp)](LICENSE)
+
 MCP server for Canvas LMS (Instructure), scoped for parent observers and student self-access. Targets `https://cms.instructure.com` by default but works against any Canvas instance.
 
 Mirrors the read-only parent-portal scope of sibling [`infinitecampus-mcp`](https://github.com/chrischall/infinitecampus-mcp). Users interact via the `canvas_*` tool prefix.

package/dist/auth.js

@@ -14,17 +14,20 @@
 //      most reliable mode but most schools have disabled token creation
 //      for non-admins. Unchanged from pre-fetchproxy behavior.
 //
-//   2. OAuth refresh token (existing)
-//      CANVAS_CLIENT_ID + CANVAS_CLIENT_SECRET + CANVAS_REFRESH_TOKEN →
-//      `grant_type=refresh_token` against `/login/oauth2/token`, bootstrap
-//      via the bundled QR-login helper. Unchanged.
-//
-//   3. Username/password session-scrape (existing)
+//   2. Username/password session-scrape (existing)
 //      CANVAS_USERNAME + CANVAS_PASSWORD → scrape `authenticity_token`
 //      from `/login/canvas`, POST creds, capture `canvas_session` +
 //      `pseudonym_credentials` cookies. Brittle (breaks on SSO/2FA and
 //      every Canvas login-page restyling) but works for direct Canvas
-//      accounts. Unchanged from pre-fetchproxy behavior.
+//      accounts. Takes precedence over OAuth (path 3) — see the
+//      precedence order in `loadAccount()` (config.ts), which returns the
+//      username/password account before checking the OAuth triple.
+//      Unchanged from pre-fetchproxy behavior.
+//
+//   3. OAuth refresh token (existing)
+//      CANVAS_CLIENT_ID + CANVAS_CLIENT_SECRET + CANVAS_REFRESH_TOKEN →
+//      `grant_type=refresh_token` against `/login/oauth2/token`, bootstrap
+//      via the bundled QR-login helper. Unchanged.
 //
 //   4. fetchproxy fallback (new)
 //      When no env vars are set, lift the user's session out of their