canvas-parent-mcp 2.1.2 → 2.1.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "2.1.2"
+    "version": "2.1.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "2.1.2",
+      "version": "2.1.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -29,6 +29,8 @@ Mirrors the read-only parent-portal scope of sibling [`infinitecampus-mcp`](http
 
 Tools that the harness will gate as write/IO operations: `canvas_download_file`.
 
+`canvas_download_file` only fetches `/files/…` URLs on your `CANVAS_BASE_URL` host (https), so your Canvas credential is never sent anywhere else, and it only writes inside a download directory: `CANVAS_OUTPUT_DIR` if set, otherwise `~/Downloads`. A relative `destinationPath` is resolved against that directory.
+
 ## Configuration
 
 Set `CANVAS_BASE_URL` plus one of four auth modes. `canvas-parent-mcp` tries them in priority order:

package/dist/bundle.js

@@ -4858,7 +4858,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve2) {
+    function isRecursive2(inst, stack, resolve5) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4868,7 +4868,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve2);
+          const answer = isRecursive2(child, stack, resolve5);
           if (answer > result)
             result = answer;
         }
@@ -4879,7 +4879,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve2) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve5) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -4943,7 +4943,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -26980,7 +26980,7 @@ var require_websocket_server = __commonJS({
 });
 
 // src/index.ts
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/@chrischall/mcp-utils/dist/cancel/index.js
@@ -31399,14 +31399,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve5, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve5();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -32200,7 +32200,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve5, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -32268,7 +32268,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve2(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve5(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -32280,11 +32280,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve2(this._resolveNonCompleteResult(decoded, flow));
+          return resolve5(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve2(parseResult.data);
+          if (parseResult.success) resolve5(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -35196,7 +35196,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve2.call(this, root, ref);
+    let _sch = resolve5.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -35222,7 +35222,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve2(root, ref) {
+  function resolve5(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -35672,47 +35672,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve2(baseURI, relativeURI, options) {
+  function resolve5(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved2 = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved2, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative2, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative2 = parse3(serialize(relative2, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative2.scheme) {
+      target.scheme = relative2.scheme;
+      target.userinfo = relative2.userinfo;
+      target.host = relative2.host;
+      target.port = relative2.port;
+      target.path = removeDotSegments(relative2.path || "");
+      target.query = relative2.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (!relative.path) {
+        if (!relative2.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative2.query !== void 0) target.query = relative2.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative2.path[0] === "/") target.path = removeDotSegments(relative2.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative2.path;
+            else if (!base.path) target.path = relative2.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative2.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -35720,7 +35720,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative2.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -35846,7 +35846,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve2,
+    resolve: resolve5,
     resolveComponent,
     equal,
     serialize,
@@ -41219,7 +41219,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve5, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -41234,14 +41234,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve2();
+        resolve5();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve2();
+        resolve5();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -41295,14 +41295,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve2) => {
+    return await new Promise((resolve5) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve2(true);
+        resolve5(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve2(false);
+        resolve5(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -46738,7 +46738,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve2) {
+function isRecursive(inst, stack, resolve5) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -46748,7 +46748,7 @@ function isRecursive(inst, stack, resolve2) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve2);
+      const answer = isRecursive(child, stack, resolve5);
       if (answer > result)
         result = answer;
     }
@@ -46759,7 +46759,7 @@ function isRecursive(inst, stack, resolve2) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve2) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve5) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -46823,7 +46823,7 @@ function isRecursive(inst, stack, resolve2) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -61639,6 +61639,8 @@ function runMcp(opts) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
   const env = opts.env ?? process.env;
@@ -61665,6 +61667,15 @@ function parseBoolEnv(key, opts = {}) {
     return false;
   return fallback;
 }
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
 async function loadDotenvSafely(opts = {}) {
   try {
     const mod = await import(
@@ -61682,6 +61693,41 @@ async function loadDotenvSafely(opts = {}) {
   }
 }
 
+// node_modules/@chrischall/mcp-utils/dist/fs/confine.js
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
+function isInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function realPathAllowingMissing(p) {
+  const abs = resolve2(p);
+  let existing = abs;
+  const tail = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing)
+      break;
+    tail.unshift(existing.slice(parent.length).replace(/^[/\\]+/, ""));
+    existing = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(existing);
+  } catch {
+    real = existing;
+  }
+  return tail.length > 0 ? resolve2(real, ...tail) : real;
+}
+function assertPathWithinRoots(path, roots) {
+  const target = realPathAllowingMissing(expandPath(path));
+  for (const root of roots) {
+    if (isInside(realPathAllowingMissing(expandPath(root)), target))
+      return target;
+  }
+  throw new Error(`Path is outside the allowed directories: ${path}`);
+}
+
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
 function buildQueryString(params) {
   const parts = [];
@@ -63495,7 +63541,7 @@ var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
   const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve5, reject) => {
     let timer;
     const clearBindTimer = () => {
       if (timer) {
@@ -63511,7 +63557,7 @@ async function electRole(opts) {
           server.close();
         } catch {
         }
-        resolve2({ role: "peer" });
+        resolve5({ role: "peer" });
       } else {
         reject(e);
       }
@@ -63519,7 +63565,7 @@ async function electRole(opts) {
     const onListening = () => {
       clearBindTimer();
       server.removeListener("error", onError);
-      resolve2({ role: "host", server });
+      resolve5({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -63798,13 +63844,13 @@ async function awaitSessionReady(ready, opts) {
 // node_modules/@fetchproxy/server/dist/extension-trust.js
 import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join3 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink, link, lstat } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
-import { isAbsolute, join } from "node:path";
-import { homedir } from "node:os";
+import { isAbsolute as isAbsolute3, join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
 var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 function envIdentityDir() {
@@ -63812,12 +63858,12 @@ function envIdentityDir() {
   if (raw === void 0)
     return void 0;
   const dir = raw.trim();
-  if (dir === "" || !isAbsolute(dir))
+  if (dir === "" || !isAbsolute3(dir))
     return void 0;
   return dir;
 }
 function defaultIdentityDir() {
-  return envIdentityDir() ?? join(homedir(), ".fetchproxy", "identity");
+  return envIdentityDir() ?? join2(homedir2(), ".fetchproxy", "identity");
 }
 function safeIdentityFileBase(serverName) {
   if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
@@ -63826,7 +63872,7 @@ function safeIdentityFileBase(serverName) {
   return serverName.replace(/\//g, "_");
 }
 function identityFilePath(dir, serverName) {
-  return join(dir, `${safeIdentityFileBase(serverName)}.json`);
+  return join2(dir, `${safeIdentityFileBase(serverName)}.json`);
 }
 async function generateIdentity() {
   const x = await generateX25519();
@@ -63880,7 +63926,7 @@ async function sweepStagingFiles(dir, serverName, opts = {}) {
   }
   const cutoff = opts.olderThanMs === void 0 ? null : Date.now() - opts.olderThanMs;
   await Promise.all(names.filter((name) => staging.test(name)).map(async (name) => {
-    const path = join(dir, name);
+    const path = join2(dir, name);
     if (cutoff !== null) {
       const st = await lstat(path).catch(() => null);
       if (st === null || st.mtimeMs > cutoff)
@@ -63961,7 +64007,7 @@ function envTrustDir(env = process.env) {
   if (raw === void 0)
     return void 0;
   const dir = raw.trim();
-  if (dir !== "" && isAbsolute2(dir))
+  if (dir !== "" && isAbsolute4(dir))
     return dir;
   console.warn(`[fetchproxy] ignoring ${TRUST_DIR_ENV}=${JSON.stringify(raw)}: it is not an absolute path. The extension pin will be written beside the identity instead, which is not where you pointed it \u2014 if that directory is read-only, no pin is ever kept.`);
   return void 0;
@@ -64009,13 +64055,13 @@ function decideExtensionTrust(args) {
   };
 }
 function extensionTrustPath(serverName, dir = defaultTrustDir()) {
-  return join2(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
+  return join3(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join2(defaultTrustDir(), "<server-name>.extension-trust.json");
+    return join3(defaultTrustDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -64168,8 +64214,8 @@ async function startHost(opts) {
   let rejectOwnSession;
   let ownSessionReady;
   function resetSessionPromise() {
-    ownSessionReady = new Promise((resolve2, reject) => {
-      resolveOwnSession = resolve2;
+    ownSessionReady = new Promise((resolve5, reject) => {
+      resolveOwnSession = resolve5;
       rejectOwnSession = reject;
     });
     ownSessionReady.catch(() => {
@@ -64571,7 +64617,7 @@ async function startHost(opts) {
     });
   });
   return {
-    close: () => new Promise((resolve2) => {
+    close: () => new Promise((resolve5) => {
       for (const client of wss.clients) {
         try {
           client.terminate();
@@ -64579,7 +64625,7 @@ async function startHost(opts) {
         }
       }
       wss.close(() => {
-        opts.httpServer.close(() => resolve2());
+        opts.httpServer.close(() => resolve5());
       });
     }),
     sendOwnInner: async (inner) => {
@@ -64619,11 +64665,11 @@ async function startPeer(opts) {
     maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
   });
   const dialTimeoutMs = opts.dialTimeoutMs ?? PEER_DIAL_TIMEOUT_MS;
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve5, reject) => {
     let timer;
     const onOpen = () => {
       cleanup();
-      resolve2();
+      resolve5();
     };
     const onError = (e) => {
       cleanup();
@@ -64711,10 +64757,10 @@ async function startPeer(opts) {
   let sessionPromiseSettled = false;
   function resetSessionPromise() {
     sessionPromiseSettled = false;
-    sessionPromise = new Promise((resolve2, reject) => {
+    sessionPromise = new Promise((resolve5, reject) => {
       resolveFirstReady = (st) => {
         sessionPromiseSettled = true;
-        resolve2(st);
+        resolve5(st);
       };
       rejectFirstReady = (e) => {
         sessionPromiseSettled = true;
@@ -65864,8 +65910,8 @@ var FetchproxyServer = class {
   async _fetchOnceWithTimeout(init, fetchOpts = {}) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = this.guardPending(new Promise((resolve2) => {
-      this.pending.set(id, resolve2);
+    const pending = this.guardPending(new Promise((resolve5) => {
+      this.pending.set(id, resolve5);
     }));
     try {
       await this.sendInnerFrame(inner, {
@@ -65888,12 +65934,12 @@ var FetchproxyServer = class {
     try {
       return await Promise.race([
         pending,
-        new Promise((resolve2) => {
+        new Promise((resolve5) => {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
             const error62 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
-            resolve2({
+            resolve5({
               ok: false,
               error: error62,
               kind: "timeout",
@@ -66037,9 +66083,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute3 = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute6 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute3) {
+    if (isAbsolute6) {
       try {
         host = new URL(path).host;
       } catch {
@@ -66048,7 +66094,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url4 = isAbsolute3 ? path : `https://${host}${path}`;
+    const url4 = isAbsolute6 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url4, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -66313,8 +66359,8 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = this.guardPending(new Promise((resolve2) => {
-      this.pendingReadCookies.set(id, resolve2);
+    const pending = this.guardPending(new Promise((resolve5) => {
+      this.pendingReadCookies.set(id, resolve5);
     }));
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
@@ -66372,8 +66418,8 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66443,8 +66489,8 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
@@ -66502,8 +66548,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingCapture.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingCapture.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66550,8 +66596,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingRedirect.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingRedirect.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66646,8 +66692,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingDownload.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingDownload.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66707,8 +66753,8 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingIdb.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingIdb.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
@@ -66747,8 +66793,8 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
@@ -66793,8 +66839,8 @@ var FetchproxyServer = class {
       op: "read_dom_list",
       init: { origin, name: opts.name }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingDomList.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingDomList.set(id, { resolve: resolve5, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingDomList, id, origin);
@@ -66839,8 +66885,8 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingGraphql.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve5, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve5, reject });
     }));
     const retrySafe = opts.retryOnTimeout === true;
     await this.sendInnerFrame(inner, { resendable: retrySafe });
@@ -67535,7 +67581,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "2.1.2",
+  version: "2.1.3",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -67844,9 +67890,9 @@ function registerCredentialHealthcheckTool(args) {
 import { writeFile as writeFile3, stat } from "fs/promises";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, join as join3, resolve } from "node:path";
-import { homedir as homedir2 } from "node:os";
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "node:path";
+import { homedir as homedir3 } from "node:os";
 import { randomBytes as randomBytes3, createHmac } from "node:crypto";
 function bindingDigest(secret, salt) {
   return createHmac("sha256", salt).update(secret).digest("hex").slice(0, 32);
@@ -67868,7 +67914,7 @@ function createFileStatePersistence(opts) {
   const secret = opts.boundTo;
   return {
     load() {
-      if (!existsSync(filePath))
+      if (!existsSync2(filePath))
         return null;
       try {
         const raw = JSON.parse(readFileSync(filePath, "utf8"));
@@ -67898,9 +67944,9 @@ function createFileStatePersistence(opts) {
       }
     },
     save(state) {
-      const dir = dirname(filePath);
+      const dir = dirname2(filePath);
       const tmp = `${filePath}.tmp-${randomBytes3(6).toString("hex")}`;
-      const dirExisted = existsSync(dir);
+      const dirExisted = existsSync2(dir);
       try {
         mkdirSync(dir, { recursive: true, mode: 448 });
         if (!dirExisted)
@@ -67917,7 +67963,7 @@ function createFileStatePersistence(opts) {
         chmodSync(filePath, 384);
       } catch (err) {
         try {
-          if (existsSync(tmp))
+          if (existsSync2(tmp))
             unlinkSync(tmp);
         } catch {
         }
@@ -67926,7 +67972,7 @@ function createFileStatePersistence(opts) {
     },
     clear() {
       try {
-        if (existsSync(filePath))
+        if (existsSync2(filePath))
           unlinkSync(filePath);
       } catch {
       }
@@ -67934,11 +67980,11 @@ function createFileStatePersistence(opts) {
   };
 }
 function homeOf(env) {
-  return readEnvVar("HOME", { env }) ?? homedir2();
+  return readEnvVar("HOME", { env }) ?? homedir3();
 }
 function resolveStateDir(opts = {}) {
   const env = opts.env;
-  return join3(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
+  return join4(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
 }
 function resolveStateFile(opts) {
   const override = opts.envVar !== void 0 ? readEnvVar(opts.envVar, { env: opts.env }) : void 0;
@@ -67946,13 +67992,13 @@ function resolveStateFile(opts) {
     if (override === "~")
       return homeOf(opts.env);
     if (override.startsWith("~/"))
-      return join3(homeOf(opts.env), override.slice(2));
-    return resolve(override);
+      return join4(homeOf(opts.env), override.slice(2));
+    return resolve3(override);
   }
   const dirOpts = { env: opts.env };
   if (opts.subdir !== void 0)
     dirOpts.subdir = opts.subdir;
-  return join3(resolveStateDir(dirOpts), opts.fileName);
+  return join4(resolveStateDir(dirOpts), opts.fileName);
 }
 var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
 function isPersistedCookieSession(raw) {
@@ -68242,7 +68288,8 @@ function reportCacheWriteFailure(err) {
 }
 
 // src/client.ts
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute5, join as join5, resolve as resolve4 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/session-login.ts
 var USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
@@ -68340,6 +68387,8 @@ var CanvasClient = class {
    * what keeps the path alive once the browser cookie lapses.
    */
   refreshSession;
+  /** Explicit download root; when unset, resolved per call (see {@link downloadRoot}). */
+  outputDir;
   auth;
   /** Lazily-built shared refresh_token exchanger (oauth mode only). */
   oauthRefresh = null;
@@ -68355,6 +68404,7 @@ var CanvasClient = class {
    */
   constructor(account, opts = {}) {
     this.account = account;
+    this.outputDir = opts.outputDir;
     this.sessionLoginFn = opts.sessionLogin ?? sessionLogin;
     this.refreshSession = opts.refreshSession ?? null;
     this.auth = new CookieSessionManager({
@@ -68396,33 +68446,84 @@ var CanvasClient = class {
     }
     return out;
   }
+  /**
+   * Download a Canvas file to disk.
+   *
+   * Both inputs arrive from tool arguments, which a prompt injection in
+   * classmate/teacher-authored Canvas content can steer, so both are pinned
+   * BEFORE any credential is attached:
+   *  - `path` must resolve to the configured Canvas origin (https, same host —
+   *    the `https://canvas@evil/` userinfo trick parses to a foreign host and is
+   *    refused) and name a `/files/<id>` resource. Only the initial request is
+   *    pinned: Canvas legitimately redirects to its file store, and fetch
+   *    strips Authorization/Cookie on a cross-origin redirect.
+   *  - `destinationPath` must lie inside the download root (see
+   *    {@link downloadRoot}), checked through symlinks; a relative path is
+   *    resolved against that root.
+   */
   async download(path, destinationPath, opts = {}) {
+    const url4 = this.pinDownloadUrl(path);
+    const dest = this.confineDestination(destinationPath);
     let destStat = null;
     try {
-      destStat = await stat(destinationPath);
+      destStat = await stat(dest);
     } catch {
     }
     if (destStat?.isDirectory()) throw new InvalidPathError(destinationPath);
     if (destStat && !opts.overwrite) throw new FileExistsError(destinationPath);
-    const parent = dirname2(destinationPath);
+    const parent = dirname3(dest);
     try {
       await stat(parent);
     } catch {
       throw new ParentDirectoryMissingError(parent);
     }
-    const url4 = /^https?:\/\//i.test(path) ? path : `${this.account.baseUrl}${path}`;
     const res = await this.authedFetch(url4, {});
     if (res.status === 401) throw new TokenExpiredError(this.account.mode);
     if (res.status === 404) throw new Error(`Canvas download 404 for ${path}`);
     if (!res.ok) throw new Error(`Canvas download ${res.status} for ${path}`);
     const buf = new Uint8Array(await res.arrayBuffer());
-    await writeFile3(destinationPath, buf);
+    await writeFile3(dest, buf);
     return {
-      path: destinationPath,
+      path: dest,
       bytes: buf.byteLength,
       contentType: res.headers.get("content-type") ?? "application/octet-stream"
     };
   }
+  /**
+   * The directory downloads are confined to: the constructor's `outputDir`,
+   * else `CANVAS_OUTPUT_DIR`, else `~/Downloads`. Read per call so an env
+   * change needs no client rebuild.
+   */
+  downloadRoot() {
+    return expandPath(this.outputDir ?? readEnvVar("CANVAS_OUTPUT_DIR") ?? join5(homedir4(), "Downloads"));
+  }
+  confineDestination(destinationPath) {
+    const root = this.downloadRoot();
+    const candidate = destinationPath.startsWith("~") || isAbsolute5(destinationPath) ? expandPath(destinationPath) : resolve4(root, destinationPath);
+    try {
+      assertPathWithinRoots(candidate, [root]);
+    } catch {
+      throw new DownloadDestinationRejectedError(destinationPath, root);
+    }
+    return candidate;
+  }
+  pinDownloadUrl(path) {
+    const raw = /^[a-z][a-z0-9+.-]*:/i.test(path) ? path : `${this.account.baseUrl}${path}`;
+    let parsed;
+    try {
+      parsed = new URL(raw);
+    } catch {
+      throw new DownloadUrlRejectedError(path, "not a valid URL");
+    }
+    const origin = new URL(this.account.baseUrl).origin;
+    if (parsed.protocol !== "https:" || parsed.origin !== origin || parsed.username || parsed.password) {
+      throw new DownloadUrlRejectedError(path, `must be an https URL on ${origin}`);
+    }
+    if (!/\/files\/[^/]+/.test(parsed.pathname)) {
+      throw new DownloadUrlRejectedError(path, "must name a Canvas file (a /files/<id> path)");
+    }
+    return parsed.href;
+  }
   async doRawRequest(path, opts) {
     const url4 = /^https?:\/\//i.test(path) ? path : `${this.account.baseUrl}${path}`;
     const accept = opts.responseType === "text" ? "text/html, text/plain, */*" : "application/json+canvas-string-ids, application/json";
@@ -68535,8 +68636,8 @@ function parseJsonBody2(text) {
 }
 function injectPerPage(pathOrUrl, perPage) {
   if (/[?&]per_page=/.test(pathOrUrl)) return pathOrUrl;
-  const sep = pathOrUrl.includes("?") ? "&" : "?";
-  return `${pathOrUrl}${sep}per_page=${perPage}`;
+  const sep2 = pathOrUrl.includes("?") ? "&" : "?";
+  return `${pathOrUrl}${sep2}per_page=${perPage}`;
 }
 var TokenExpiredError = class extends Error {
   constructor(mode, detail) {
@@ -68557,6 +68658,26 @@ var CanvasUnreachableError = class extends Error {
   }
   status;
 };
+var DownloadUrlRejectedError = class extends Error {
+  constructor(url4, reason) {
+    super(`DownloadUrlRejected: ${reason}; use the \`url\` from canvas_list_course_files. Got: ${url4}`);
+    this.url = url4;
+    this.name = "DownloadUrlRejectedError";
+  }
+  url;
+};
+var DownloadDestinationRejectedError = class extends Error {
+  constructor(path, root) {
+    super(
+      `DownloadDestinationRejected: destinationPath must be inside ${root} (set CANVAS_OUTPUT_DIR to change it). Got: ${path}`
+    );
+    this.path = path;
+    this.root = root;
+    this.name = "DownloadDestinationRejectedError";
+  }
+  path;
+  root;
+};
 var InvalidPathError = class extends Error {
   constructor(path) {
     super(`InvalidPath: destinationPath must be a filename, not a directory: ${path}`);
@@ -68963,8 +69084,8 @@ var listArgs4 = external_exports.object({
   contentTypes: external_exports.array(external_exports.string()).optional()
 });
 var downloadArgs = external_exports.object({
-  url: external_exports.string().describe("The url field returned by canvas_list_course_files (absolute https URL)."),
-  destinationPath: external_exports.string().describe("Absolute path where the file should be written."),
+  url: external_exports.string().describe("The url field returned by canvas_list_course_files (an https /files/ URL on the configured Canvas host; anything else is refused)."),
+  destinationPath: external_exports.string().describe("Where to write the file. Must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads); a relative path is resolved against it."),
   overwrite: external_exports.boolean().optional()
 });
 function registerFileTools(server, client) {
@@ -68982,8 +69103,8 @@ function registerFileTools(server, client) {
     return textContent(data);
   });
   server.registerTool("canvas_download_file", {
-    description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files; `destinationPath` is required.",
-    annotations: { destructiveHint: true },
+    description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files (only file URLs on the configured Canvas host are accepted); `destinationPath` is required and must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads).",
+    annotations: { destructiveHint: true, openWorldHint: true },
     inputSchema: downloadArgs
   }, async (rawArgs) => {
     const args = downloadArgs.parse(rawArgs);
@@ -68995,8 +69116,8 @@ function registerFileTools(server, client) {
 }
 
 // src/index.ts
-var __dirname = dirname3(fileURLToPath(import.meta.url));
-await loadDotenvSafely({ path: join4(__dirname, "..", ".env"), override: false });
+var __dirname = dirname4(fileURLToPath(import.meta.url));
+await loadDotenvSafely({ path: join6(__dirname, "..", ".env"), override: false });
 var resolved = null;
 var configError = null;
 try {
@@ -69006,7 +69127,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "2.1.2",
+  version: "2.1.3",
   // x-release-please-version
   tools: [
     // Outside the `if (resolved)` on purpose: an unconfigured server must

package/dist/client.js

@@ -1,7 +1,8 @@
 import { writeFile, stat } from 'fs/promises';
 import { createSessionCache, reportCacheWriteFailure } from './session-cache.js';
-import { dirname } from 'path';
-import { createOAuth2Refresher, parseLinkHeader } from '@chrischall/mcp-utils';
+import { dirname, isAbsolute, join, resolve } from 'path';
+import { homedir } from 'os';
+import { assertPathWithinRoots, createOAuth2Refresher, expandPath, parseLinkHeader, readEnvVar, } from '@chrischall/mcp-utils';
 import { CookieSessionManager } from '@chrischall/mcp-utils/session';
 import { sessionLogin as defaultSessionLogin } from './session-login.js';
 // Re-export the fleet-shared RFC 5988 Link parser so existing importers
@@ -19,6 +20,8 @@ export class CanvasClient {
      * what keeps the path alive once the browser cookie lapses.
      */
     refreshSession;
+    /** Explicit download root; when unset, resolved per call (see {@link downloadRoot}). */
+    outputDir;
     auth;
     /** Lazily-built shared refresh_token exchanger (oauth mode only). */
     oauthRefresh = null;
@@ -34,6 +37,7 @@ export class CanvasClient {
      */
     constructor(account, opts = {}) {
         this.account = account;
+        this.outputDir = opts.outputDir;
         this.sessionLoginFn = opts.sessionLogin ?? defaultSessionLogin;
         this.refreshSession = opts.refreshSession ?? null;
         this.auth = new CookieSessionManager({
@@ -78,24 +82,40 @@ export class CanvasClient {
         }
         return out;
     }
+    /**
+     * Download a Canvas file to disk.
+     *
+     * Both inputs arrive from tool arguments, which a prompt injection in
+     * classmate/teacher-authored Canvas content can steer, so both are pinned
+     * BEFORE any credential is attached:
+     *  - `path` must resolve to the configured Canvas origin (https, same host —
+     *    the `https://canvas@evil/` userinfo trick parses to a foreign host and is
+     *    refused) and name a `/files/<id>` resource. Only the initial request is
+     *    pinned: Canvas legitimately redirects to its file store, and fetch
+     *    strips Authorization/Cookie on a cross-origin redirect.
+     *  - `destinationPath` must lie inside the download root (see
+     *    {@link downloadRoot}), checked through symlinks; a relative path is
+     *    resolved against that root.
+     */
     async download(path, destinationPath, opts = {}) {
+        const url = this.pinDownloadUrl(path);
+        const dest = this.confineDestination(destinationPath);
         let destStat = null;
         try {
-            destStat = await stat(destinationPath);
+            destStat = await stat(dest);
         }
         catch { /* not present, ok */ }
         if (destStat?.isDirectory())
             throw new InvalidPathError(destinationPath);
         if (destStat && !opts.overwrite)
             throw new FileExistsError(destinationPath);
-        const parent = dirname(destinationPath);
+        const parent = dirname(dest);
         try {
             await stat(parent);
         }
         catch {
             throw new ParentDirectoryMissingError(parent);
         }
-        const url = /^https?:\/\//i.test(path) ? path : `${this.account.baseUrl}${path}`;
         const res = await this.authedFetch(url, {});
         if (res.status === 401)
             throw new TokenExpiredError(this.account.mode);
@@ -104,13 +124,54 @@ export class CanvasClient {
         if (!res.ok)
             throw new Error(`Canvas download ${res.status} for ${path}`);
         const buf = new Uint8Array(await res.arrayBuffer());
-        await writeFile(destinationPath, buf);
+        await writeFile(dest, buf);
         return {
-            path: destinationPath,
+            path: dest,
             bytes: buf.byteLength,
             contentType: res.headers.get('content-type') ?? 'application/octet-stream',
         };
     }
+    /**
+     * The directory downloads are confined to: the constructor's `outputDir`,
+     * else `CANVAS_OUTPUT_DIR`, else `~/Downloads`. Read per call so an env
+     * change needs no client rebuild.
+     */
+    downloadRoot() {
+        return expandPath(this.outputDir ?? readEnvVar('CANVAS_OUTPUT_DIR') ?? join(homedir(), 'Downloads'));
+    }
+    confineDestination(destinationPath) {
+        const root = this.downloadRoot();
+        // `~` expands to home; any other relative path is anchored at the root
+        // (not the process cwd, which for a desktop-launched server is often `/`).
+        const candidate = destinationPath.startsWith('~') || isAbsolute(destinationPath)
+            ? expandPath(destinationPath)
+            : resolve(root, destinationPath);
+        try {
+            assertPathWithinRoots(candidate, [root]);
+        }
+        catch {
+            throw new DownloadDestinationRejectedError(destinationPath, root);
+        }
+        return candidate;
+    }
+    pinDownloadUrl(path) {
+        const raw = /^[a-z][a-z0-9+.-]*:/i.test(path) ? path : `${this.account.baseUrl}${path}`;
+        let parsed;
+        try {
+            parsed = new URL(raw);
+        }
+        catch {
+            throw new DownloadUrlRejectedError(path, 'not a valid URL');
+        }
+        const origin = new URL(this.account.baseUrl).origin;
+        if (parsed.protocol !== 'https:' || parsed.origin !== origin || parsed.username || parsed.password) {
+            throw new DownloadUrlRejectedError(path, `must be an https URL on ${origin}`);
+        }
+        if (!/\/files\/[^/]+/.test(parsed.pathname)) {
+            throw new DownloadUrlRejectedError(path, 'must name a Canvas file (a /files/<id> path)');
+        }
+        return parsed.href;
+    }
     async doRawRequest(path, opts) {
         const url = /^https?:\/\//i.test(path) ? path : `${this.account.baseUrl}${path}`;
         const accept = opts.responseType === 'text'
@@ -269,6 +330,25 @@ export class CanvasUnreachableError extends Error {
         this.name = 'CanvasUnreachableError';
     }
 }
+export class DownloadUrlRejectedError extends Error {
+    url;
+    constructor(url, reason) {
+        super(`DownloadUrlRejected: ${reason}; use the \`url\` from canvas_list_course_files. Got: ${url}`);
+        this.url = url;
+        this.name = 'DownloadUrlRejectedError';
+    }
+}
+export class DownloadDestinationRejectedError extends Error {
+    path;
+    root;
+    constructor(path, root) {
+        super(`DownloadDestinationRejected: destinationPath must be inside ${root} ` +
+            `(set CANVAS_OUTPUT_DIR to change it). Got: ${path}`);
+        this.path = path;
+        this.root = root;
+        this.name = 'DownloadDestinationRejectedError';
+    }
+}
 export class InvalidPathError extends Error {
     path;
     constructor(path) {

package/dist/index.js

@@ -47,7 +47,7 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '2.1.2', // x-release-please-version
+    version: '2.1.3', // x-release-please-version
     tools: [
         // Outside the `if (resolved)` on purpose: an unconfigured server must
         // still expose something that can say WHY (see the tool's docblock).

package/dist/tools/files.js

@@ -6,8 +6,8 @@ const listArgs = z.object({
     contentTypes: z.array(z.string()).optional(),
 });
 const downloadArgs = z.object({
-    url: z.string().describe('The url field returned by canvas_list_course_files (absolute https URL).'),
-    destinationPath: z.string().describe('Absolute path where the file should be written.'),
+    url: z.string().describe('The url field returned by canvas_list_course_files (an https /files/ URL on the configured Canvas host; anything else is refused).'),
+    destinationPath: z.string().describe('Where to write the file. Must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads); a relative path is resolved against it.'),
     overwrite: z.boolean().optional(),
 });
 export function registerFileTools(server, client) {
@@ -25,8 +25,8 @@ export function registerFileTools(server, client) {
         return textContent(data);
     });
     server.registerTool('canvas_download_file', {
-        description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files; `destinationPath` is required.",
-        annotations: { destructiveHint: true },
+        description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files (only file URLs on the configured Canvas host are accepted); `destinationPath` is required and must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads).",
+        annotations: { destructiveHint: true, openWorldHint: true },
         inputSchema: downloadArgs,
     }, async (rawArgs) => {
         const args = downloadArgs.parse(rawArgs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "2.1.2",
+  "version": "2.1.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "2.1.2",
+      "version": "2.1.3",
       "transport": {
         "type": "stdio"
       },

package/skills/canvas-parent/SKILL.md

@@ -85,7 +85,7 @@ Precedence when multiple are set: `CANVAS_TOKEN` > username/password > OAuth > f
 
 ### Files
 - `canvas_list_course_files(courseId)` — file metadata
-- `canvas_download_file(url, destinationPath)` — download a file to disk
+- `canvas_download_file(url, destinationPath)` — download a file to disk. `url` must be a `/files/` URL on the configured Canvas host; `destinationPath` must be inside `CANVAS_OUTPUT_DIR` (default `~/Downloads`), and a relative path is resolved against it
 
 ## Response shape (`view`)
 

package/skills/canvas-parent-api/references/canvas-endpoints.md

@@ -217,7 +217,9 @@ curl -sL -H "Authorization: Bearer $CANVAS_TOKEN" "$FILE_URL" -o /path/to/destin
 ```
 
 `-L` follows Canvas's redirect to the actual file storage backend. The MCP's
-`canvas_download_file` tool additionally refuses to overwrite an existing
+`canvas_download_file` tool additionally only fetches `/files/` URLs on the
+`CANVAS_BASE_URL` host, only writes inside `CANVAS_OUTPUT_DIR` (default
+`~/Downloads`), refuses to overwrite an existing
 destination unless told to and validates the parent directory exists —
 replicate that yourself in a script if it matters (`[ -f dest ] && exit 1`,
 `[ -d "$(dirname dest)" ] || exit 1`).