canvas-parent-mcp 2.1.8 → 2.1.10

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "2.1.8"
+    "version": "2.1.10"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "2.1.8",
+      "version": "2.1.10",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "2.1.8",
+  "version": "2.1.10",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",
@@ -21,5 +21,5 @@
     "mcp"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcpServers": "./.mcp.json"
 }

package/.mcp.json

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
     "canvas": {
-      "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"],
+      "command": "npx",
+      "args": ["-y", "canvas-parent-mcp"],
       "env": {
         "CANVAS_BASE_URL": "${CANVAS_BASE_URL}",
         "CANVAS_TOKEN": "${CANVAS_TOKEN}",

package/README.md

@@ -48,7 +48,7 @@ If none succeed, you get an error that names every escape hatch.
 CANVAS_BASE_URL=https://cms.instructure.com
 ```
 
-Install the ContextMint Bridge browser extension from its [releases page](https://github.com/nullnet-app/contextmint-bridge/releases) (Chrome: download the chrome zip, unzip it, and load it unpacked at `chrome://extensions` with Developer mode on — there is no Chrome Web Store listing yet; Safari: not available yet — it will ship inside the ContextMint app, which has no public download yet, so use Chrome for now), sign into your Canvas instance once, and the MCP reads your session cookies at startup. After that, all Canvas API calls go directly from Node — the extension is **not** in the request hot path. Works with any auth flow (SSO/SAML/2FA included) because Canvas itself handled the sign-in.
+Install the ContextMint Bridge browser extension from its [releases page](https://github.com/nullnet-app/contextmint-bridge/releases) (Chrome: download the chrome zip, unzip it, and load it unpacked at `chrome://extensions` with Developer mode on — there is no Chrome Web Store listing yet; Safari: not available yet — it will ship inside the ContextMint app, which has no public download yet, so use Chrome for now), sign into your Canvas instance, and the MCP reads your session cookies from the browser on the first request and again whenever Canvas answers 401 (the session expired). In between, Canvas API calls go directly from Node — the extension is **not** in the request hot path, but it must stay reachable (browser running, extension installed) for the MCP to renew the session. Works with any auth flow (SSO/SAML/2FA included) because Canvas itself handled the sign-in.
 
 > **Where the extension comes from.** ContextMint Bridge is the fetchproxy browser extension under its new name, from the same maintainer — fetchproxy's own README ([Extension](https://github.com/chrischall/fetchproxy#extension)) points to it. Its source is public at [nullnet-app/contextmint-bridge](https://github.com/nullnet-app/contextmint-bridge): build it yourself (`npm run build`, per its README), or check a release zip against the `.sha256` file published beside it:
 >
@@ -101,6 +101,12 @@ If your account uses SSO and you can't use fetchproxy (e.g. headless server), mi
 
 See `.env.example`.
 
+### Session cache
+
+In username/password and OAuth modes the signed-in session is cached between runs, so a restart does not log in (or spend a refresh-token exchange) again. The cache file — `$MCP_DATA_DIR/.canvas-parent-mcp/session.json` by default, or `CANVAS_SESSION_FILE` — holds the live `canvas_session` + `pseudonym_credentials` cookies or the OAuth access token **in plaintext**. It is created owner-only (0600, in a 0700 directory), and only the credential binding is stored as a salted digest; your username, password and refresh token are never written to it. Token and fetchproxy modes never write the cache.
+
+Backup and sync tools that run as you can still copy that file. On a shared or backed-up machine, set `CANVAS_SESSION_CACHE=false` to keep the session in memory only (each start then re-authenticates).
+
 ### Bootstrapping OAuth via the mobile QR code
 
 If your Canvas admin has disabled personal-access-token creation (some institutions restrict tokens to "the mobile app only") AND your account uses SSO so username/password can't auth, you can mint OAuth credentials by going through the same QR-login flow that the official Canvas mobile apps use:

package/dist/auth.js

@@ -31,12 +31,15 @@
 //
 //   4. fetchproxy fallback (new)
 //      When no env vars are set, lift the user's session out of their
-//      already-signed-in canvas tab. `@fetchproxy/bootstrap` opens a
-//      one-shot WebSocket bridge, asks the extension for the
+//      already-signed-in canvas tab. resolveAuth() does not read the
+//      browser itself: it hands the client a `refresh` function, and the
+//      client calls it lazily on the first request and again on every 401.
+//      Each lift asks the extension (via `@fetchproxy/bootstrap`) for the
 //      `canvas_session` + `pseudonym_credentials` cookies (declared
-//      upfront — that's the security boundary), and closes the bridge.
-//      Subsequent Canvas API calls go out via plain Node `fetch()` with
-//      those cookies attached — fetchproxy is NOT in the request hot path.
+//      upfront — that's the security boundary). Between lifts, Canvas API
+//      calls go out via plain Node `fetch()` with those cookies attached —
+//      fetchproxy is NOT in the request hot path, but the extension must
+//      stay reachable for the life of the server so a 401 can re-lift.
 //
 //      Note: `pseudonym_credentials` is HttpOnly, which is fine —
 //      @fetchproxy/bootstrap@^0.3.0 uses `chrome.cookies.get` to read