canvas-parent-mcp 1.3.0 → 1.4.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.3.0"
+    "version": "1.4.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.3.0",
+      "version": "1.4.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -3314,8 +3314,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
-      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP2) {
+      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -3804,7 +3804,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -3853,9 +3853,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP2 = ipv6result.isIPV6;
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -3872,7 +3872,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
@@ -3886,7 +3886,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP2);
             }
           }
           if (parsed.path) {
@@ -7199,7 +7199,7 @@ var require_permessage_deflate = __commonJS({
       acceptAsServer(offers) {
         const opts = this._options;
         const accepted = offers.find((params) => {
-          if (opts.serverNoContextTakeover === false && params.server_no_context_takeover || params.server_max_window_bits && (opts.serverMaxWindowBits === false || typeof opts.serverMaxWindowBits === "number" && opts.serverMaxWindowBits > params.server_max_window_bits) || typeof opts.clientMaxWindowBits === "number" && !params.client_max_window_bits) {
+          if (opts.serverNoContextTakeover === false && params.server_no_context_takeover || params.server_max_window_bits && (opts.serverMaxWindowBits === false || typeof opts.serverMaxWindowBits === "number" && opts.serverMaxWindowBits > params.server_max_window_bits) || typeof opts.clientMaxWindowBits === "number" && (typeof params.client_max_window_bits === "number" ? opts.clientMaxWindowBits > params.client_max_window_bits : !params.client_max_window_bits)) {
             return false;
           }
           return true;
@@ -37096,6 +37096,7 @@ function classifyBridgeError(err) {
 }
 
 // node_modules/@fetchproxy/server/dist/ws-server.js
+import { isIP } from "node:net";
 function envWsPort() {
   const raw = process.env.FETCHPROXY_WS_PORT;
   if (raw === void 0 || raw.trim() === "")
@@ -37107,6 +37108,15 @@ function envWsPort() {
     return void 0;
   return port;
 }
+function envWsHost() {
+  const raw = process.env.FETCHPROXY_WS_HOST;
+  if (raw === void 0)
+    return void 0;
+  const host = raw.trim();
+  if (host === "" || isIP(host) === 0)
+    return void 0;
+  return host;
+}
 var FetchproxyProtocolError = class extends Error {
   constructor(message) {
     super(message);
@@ -37355,7 +37365,7 @@ var FetchproxyServer = class {
     }
     this.opts = {
       port: opts.port ?? envWsPort() ?? 37149,
-      host: opts.host ?? "127.0.0.1",
+      host: opts.host ?? envWsHost() ?? "127.0.0.1",
       serverName: opts.serverName,
       version: opts.version,
       domains: [...opts.domains],
@@ -37641,6 +37651,7 @@ var FetchproxyServer = class {
     return {
       role: this.role,
       port: this.opts.port,
+      host: this.opts.host,
       serverVersion: this.opts.version,
       fetchTimeoutMs: this.opts.fetchTimeoutMs ?? 0,
       bridgeReviveDelayMs: this.opts.bridgeReviveDelayMs ?? 0,
@@ -39226,7 +39237,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "1.3.0",
+  version: "1.4.0",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -39274,8 +39285,8 @@ var package_default = {
   },
   dependencies: {
     "@chrischall/mcp-utils": "^0.17.1",
-    "@fetchproxy/bootstrap": "^2.0.0",
-    "@fetchproxy/server": "^2.0.0",
+    "@fetchproxy/bootstrap": "^2.2.0",
+    "@fetchproxy/server": "^2.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
     zod: "^4.4.3"
@@ -40491,7 +40502,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "1.3.0",
+  version: "1.4.0",
   // x-release-please-version
   tools: [
     (server) => {

package/dist/index.js

@@ -46,7 +46,7 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '1.3.0', // x-release-please-version
+    version: '1.4.0', // x-release-please-version
     tools: [
         (server) => {
             if (resolved) {

package/mint.yaml

@@ -63,16 +63,31 @@ env:
       $MCP_DATA_DIR/.canvas-parent-mcp/session.json.
 egress:
   allow:
-    # Canvas is multi-tenant per district: the base URL is a *.instructure.com
-    # host (cms.instructure.com is the CMS district). Narrow this to YOUR
-    # district's host if you prefer.
+    # Only hosts the SERVER process actually fetches; hosts that appear solely
+    # in a URL this server builds and returns are excluded. Matching is EXACT:
+    # an apex entry covers no subdomain, and `*.` covers labels beneath it but
+    # not the apex — which is why the wildcard below is a wildcard.
+    #
+    # Canvas is multi-tenant per district: CANVAS_BASE_URL is a
+    # <district>.instructure.com host (cms.instructure.com is the CMS district)
+    # and every API call, the form login and the OAuth refresh go to it.
+    # Narrow the wildcard to YOUR district's host if you prefer. A self-hosted
+    # Canvas (a CANVAS_BASE_URL outside instructure.com) is env-selected and
+    # must be added here by hand.
+    #
+    # canvas_download_file follows the file URL Canvas returns, and a hosted
+    # district's download 302s to Instructure's file store, whose host carries
+    # the region (inst-fs-iad-prod.inscloudgate.net, -dub-, -syd-, …). The
+    # exact host is discovered at runtime, hence the wildcard.
     #
     # sso.canvaslms.com is deliberately NOT here: the hosted server never
     # contacts it. session-login.ts only INSPECTS a redirect's Location for
     # that host, and qr-login.ts is the separate canvas-parent-mcp-qr-login
-    # bin, not the child this manifest configures.
-    - instructure.com
+    # bin, not the child this manifest configures. The fetchproxy fallback
+    # lifts cookies through the browser bridge, which is not a dial either.
+    - "*.instructure.com"
     - cms.instructure.com
+    - "*.inscloudgate.net"
 
 state:
   dataDir: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -48,8 +48,8 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.17.1",
-    "@fetchproxy/bootstrap": "^2.0.0",
-    "@fetchproxy/server": "^2.0.0",
+    "@fetchproxy/bootstrap": "^2.2.0",
+    "@fetchproxy/server": "^2.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
     "zod": "^4.4.3"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.3.0",
+  "version": "1.4.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.3.0",
+      "version": "1.4.0",
       "transport": {
         "type": "stdio"
       },