canvas-parent-mcp 2.1.9 → 2.1.10

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "2.1.9"
+    "version": "2.1.10"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "2.1.9",
+      "version": "2.1.10",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/.mcp.json

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
     "canvas": {
-      "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"],
+      "command": "npx",
+      "args": ["-y", "canvas-parent-mcp"],
       "env": {
         "CANVAS_BASE_URL": "${CANVAS_BASE_URL}",
         "CANVAS_TOKEN": "${CANVAS_TOKEN}",

package/dist/bundle.js

@@ -91,6 +91,7 @@ var require_util = __commonJS({
     exports.explicitlyAborted = explicitlyAborted2;
     exports.prefixIssues = prefixIssues2;
     exports.unwrapMessage = unwrapMessage2;
+    exports.sizeCaps = sizeCaps2;
     exports.attachSchema = attachSchema2;
     exports.finalizeIssue = finalizeIssue2;
     exports.getSizableOrigin = getSizableOrigin2;
@@ -625,6 +626,18 @@ var require_util = __commonJS({
     function unwrapMessage2(message) {
       return typeof message === "string" ? message : message?.message;
     }
+    function sizeCaps2(defChecks) {
+      const caps = [];
+      for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        if (!/_(length|size)$|_equals$/.test(d.check))
+          break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+          caps.push([max, ch]);
+      }
+      return caps;
+    }
     function attachSchema2(issues, start, inst) {
       var _a3;
       for (let i = start; i < issues.length; i++) {
@@ -2289,7 +2302,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -3123,6 +3136,31 @@ var require_schemas = __commonJS({
         return payload;
       };
     });
+    function capSize2(inst, size) {
+      const caps = util.sizeCaps(inst._zod.def.checks);
+      if (!caps.length)
+        return;
+      const cap = Math.min(...caps.map((c) => c[0]));
+      const parse3 = inst._zod.parse;
+      inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+          for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+            if (n > max && ch._zod.def.when(payload)) {
+              const start = payload.issues.length;
+              ch._zod.check(payload);
+              payload.issues[start].continue = false;
+              util.attachSchema(payload.issues, start, inst);
+              return payload;
+            }
+          }
+        }
+        return parse3(payload, ctx);
+      };
+    }
+    var arraySize2 = (input2) => Array.isArray(input2) ? input2.length : -1;
+    var mapSize2 = (input2) => input2 instanceof Map ? input2.size : -1;
+    var setSize2 = (input2) => input2 instanceof Set ? input2.size : -1;
     function handleArrayResult2(result, final, index) {
       if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -3166,6 +3204,7 @@ var require_schemas = __commonJS({
         }
         return payload;
       };
+      capSize2(inst, arraySize2);
     });
     function handlePropertyResult2(result, final, key, input2, optin, optout) {
       const isPresent = key in input2;
@@ -4122,6 +4161,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, mapSize2);
     });
     function handleMapResult2(keyResult, valueResult, final, key, input2, inst, ctx) {
       if (keyResult.issues.length) {
@@ -4188,6 +4228,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, setSize2);
     });
     function handleSetResult2(result, final) {
       if (result.issues.length) {
@@ -16292,9 +16333,15 @@ ${code}
       doc.write(`}`);
       return outputVar;
     }
+    function generateSizeGate2(doc, schema, size) {
+      for (const [max, check2] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand2(max, check2._zod.def.check)}) return INVALID;`);
+      }
+    }
     function generateArrayCheck2(doc, ctx, schema, accessor, buildsValue = true) {
       const def = schema._zod.def;
       doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.length`);
       const outputVar = buildsValue ? newVar2(ctx) : null;
       const iVar = newVar2(ctx);
       const elemVar = newVar2(ctx);
@@ -16694,6 +16741,7 @@ ${code}
     function generateMapCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const kVar = newVar2(ctx);
       const valVar = newVar2(ctx);
@@ -16710,6 +16758,7 @@ ${code}
     function generateSetCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const valVar = newVar2(ctx);
       doc.write(`const ${outputVar} = new Set();`);
@@ -27078,7 +27127,7 @@ function declaredDialect(schema, remedy) {
   throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var z = __toESM(require_v4(), 1);
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
@@ -41874,7 +41923,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -41885,6 +41934,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "aws[_-]?secret[_-]?access[_-]?key",
+  // fleet-audit#1297
   "code[_-]?verifier",
   // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -42582,6 +42633,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -43101,6 +43153,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -44521,7 +44585,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -45277,6 +45341,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -45320,6 +45409,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -46276,6 +46366,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -46342,6 +46433,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -55872,9 +55964,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -56274,6 +56372,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -56290,6 +56389,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -62002,10 +62102,34 @@ import { constants as fsConstants2, realpathSync as realpathSync2 } from "node:f
 var O_NOFOLLOW2 = fsConstants2.O_NOFOLLOW ?? 0;
 var O_NONBLOCK = fsConstants2.O_NONBLOCK ?? 0;
 
+// node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 var NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+var JUST_A_MOMENT = "just a moment";
+function hasJustAMomentTitle(html) {
+  const lower = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open3 = lower.indexOf("<title", i);
+    if (open3 < 0)
+      return false;
+    const gt = lower.indexOf(">", open3 + 6);
+    if (gt < 0)
+      return false;
+    let j = gt + 1;
+    while (j < lower.length && /\s/.test(lower[j]))
+      j++;
+    if (lower.startsWith(JUST_A_MOMENT, j))
+      return true;
+    i = gt + 1;
+  }
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
@@ -62869,6 +62993,17 @@ function isPublicSuffix(host) {
   return false;
 }
 
+// node_modules/@fetchproxy/protocol/dist/ip-literal.js
+function isIpLiteralHost(host) {
+  if (host.includes(":") || host.startsWith("["))
+    return true;
+  const labels = host.split(".");
+  if (labels.length > 1 && labels[labels.length - 1] === "")
+    labels.pop();
+  const last = labels[labels.length - 1] ?? "";
+  return /^[0-9]+$/.test(last) || /^0x[0-9a-f]*$/i.test(last);
+}
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 var ProtocolError3 = class extends Error {
   constructor(message) {
@@ -63334,6 +63469,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError3(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isIpLiteralHost(d)) {
+        throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (isPublicSuffix(d)) {
         throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -65459,7 +65597,7 @@ async function startHost(opts) {
             if (ownRetryableRefusal)
               resetSessionPromise();
             resolveOwnSession(ownSession);
-          } else {
+          } else if (identified === "extension" && extensionWs === ws) {
             const slot = peers.get(frame.mcpId);
             if (slot)
               slot.ws.send(JSON.stringify(frame));
@@ -66485,6 +66623,9 @@ var FetchproxyServer = class {
       throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
     }
     for (const d of opts.domains) {
+      if (typeof d === "string" && isIpLiteralHost(d)) {
+        throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (typeof d === "string" && isPublicSuffix(d)) {
         throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -68419,6 +68560,9 @@ var FetchproxyServer = class {
   }
 };
 
+// node_modules/@fetchproxy/server/dist/bot-wall.js
+var CLOUDFLARE_TITLE_SCAN_MAX = 64 * 1024;
+
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
 function createSessionLifter(opts) {
@@ -68704,7 +68848,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "2.1.9",
+  version: "2.1.10",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -68751,9 +68895,9 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^3.0.0",
-    "@fetchproxy/bootstrap": "^3.6.0",
-    "@fetchproxy/server": "^3.6.0",
+    "@chrischall/mcp-utils": "^3.0.3",
+    "@fetchproxy/bootstrap": "^3.6.2",
+    "@fetchproxy/server": "^3.6.2",
     "@modelcontextprotocol/server": "^2.3.0",
     dotenv: "^18.0.0",
     zod: "^4.6.5"
@@ -69813,10 +69957,29 @@ var CanvasClient = class {
       const linkHeader = res.headers.get("link");
       const next = linkHeader ? parseLinkHeader(linkHeader).next : void 0;
       if (!next) break;
-      url4 = next;
+      url4 = this.pinPaginationUrl(next);
     }
     return out;
   }
+  /**
+   * The Link header is upstream-controlled, and the next hop carries the
+   * parent's credential (Bearer token or session cookies). Only follow it on
+   * the configured Canvas origin over https; anything else is refused rather
+   * than fetched — a truncated list reported as complete would mislead too.
+   */
+  pinPaginationUrl(next) {
+    const base = new URL(this.account.baseUrl);
+    let parsed;
+    try {
+      parsed = new URL(next, base);
+    } catch {
+      throw new PaginationOriginError(base.origin);
+    }
+    if (parsed.protocol !== "https:" || parsed.origin !== base.origin || parsed.username || parsed.password) {
+      throw new PaginationOriginError(base.origin);
+    }
+    return parsed.href;
+  }
   /**
    * Download a Canvas file to disk.
    *
@@ -70076,6 +70239,14 @@ var CanvasUnreachableError = class extends Error {
   }
   status;
 };
+var PaginationOriginError = class extends Error {
+  constructor(origin) {
+    super(`PaginationOriginRejected: Canvas sent a next-page link off ${origin}; stopped without following it (the request carries your Canvas credential).`);
+    this.origin = origin;
+    this.name = "PaginationOriginError";
+  }
+  origin;
+};
 var DownloadUrlRejectedError = class extends Error {
   constructor(url4, reason) {
     super(`DownloadUrlRejected: ${reason}; use the \`url\` from canvas_list_course_files. Got: ${url4}`);
@@ -70560,7 +70731,7 @@ try {
 var client = resolved ? new CanvasClient(resolved.account, { refreshSession: resolved.refresh }) : null;
 await runMcp({
   name: "canvas",
-  version: "2.1.9",
+  version: "2.1.10",
   // x-release-please-version
   tools: [
     // Outside the `if (resolved)` on purpose: an unconfigured server must

package/dist/client.js

@@ -90,10 +90,30 @@ export class CanvasClient {
             const next = linkHeader ? parseLinkHeader(linkHeader).next : undefined;
             if (!next)
                 break;
-            url = next;
+            url = this.pinPaginationUrl(next);
         }
         return out;
     }
+    /**
+     * The Link header is upstream-controlled, and the next hop carries the
+     * parent's credential (Bearer token or session cookies). Only follow it on
+     * the configured Canvas origin over https; anything else is refused rather
+     * than fetched — a truncated list reported as complete would mislead too.
+     */
+    pinPaginationUrl(next) {
+        const base = new URL(this.account.baseUrl);
+        let parsed;
+        try {
+            parsed = new URL(next, base);
+        }
+        catch {
+            throw new PaginationOriginError(base.origin);
+        }
+        if (parsed.protocol !== 'https:' || parsed.origin !== base.origin || parsed.username || parsed.password) {
+            throw new PaginationOriginError(base.origin);
+        }
+        return parsed.href;
+    }
     /**
      * Download a Canvas file to disk.
      *
@@ -409,6 +429,14 @@ export class CanvasUnreachableError extends Error {
         this.name = 'CanvasUnreachableError';
     }
 }
+export class PaginationOriginError extends Error {
+    origin;
+    constructor(origin) {
+        super(`PaginationOriginRejected: Canvas sent a next-page link off ${origin}; stopped without following it (the request carries your Canvas credential).`);
+        this.origin = origin;
+        this.name = 'PaginationOriginError';
+    }
+}
 export class DownloadUrlRejectedError extends Error {
     url;
     constructor(url, reason) {

package/dist/index.js

@@ -54,7 +54,7 @@ const client = resolved
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '2.1.9', // x-release-please-version
+    version: '2.1.10', // x-release-please-version
     tools: [
         // Outside the `if (resolved)` on purpose: an unconfigured server must
         // still expose something that can say WHY (see the tool's docblock).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -47,9 +47,9 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
-    "@fetchproxy/bootstrap": "^3.6.0",
-    "@fetchproxy/server": "^3.6.0",
+    "@chrischall/mcp-utils": "^3.0.3",
+    "@fetchproxy/bootstrap": "^3.6.2",
+    "@fetchproxy/server": "^3.6.2",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.0",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "2.1.9",
+  "version": "2.1.10",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "2.1.9",
+      "version": "2.1.10",
       "transport": {
         "type": "stdio"
       },