canvas mcp AGENTS.md changelog

https://raw.githubusercontent.com/vishalsachdev/canvas-mcp/HEAD/AGENTS.md

− | `create_rubric` | Create rubric with criteria, ratings, and optional assignment association |− | `update_rubric` | Safely replace rubric text/points while preserving every criterion/rating ID; two-step preview and confirmation |− | `associate_rubric` | Associate existing rubric with an assignment |− | SIS ID | `sis_course_id:ABC123` or `ABC123` | If configured |− and SIS IDs are matched against your course list, ignoring case and surrounding− whitespace; a value that matches more than one of your courses is refused with− the candidate IDs, so pass the numeric ID then. Tools that put the course in a− request path (for example `list_course_files`) refuse an identifier that matches− no course instead of sending it to Canvas.+ | `create_rubric` | Create a rubric with criteria and ratings, optionally attaching it to an assignment that has no rubric |+ | `update_rubric` | Edit existing rubric text or points while preserving every criterion/rating ID. Requires preview and confirmation |+ | `associate_rubric` | Associate an existing rubric with an assignment, replacing the current association. Use only for an explicit association change |+ | SIS ID | `sis_course_id:ABC123` or `ABC123` | The bare form works only for one of your courses; otherwise use the `sis_course_id:` prefix |+ and SIS IDs are matched against your course list, ignoring case and whitespace+ differences. A value that matches more than one of your courses is refused with+ the candidate IDs and course codes, so pass the numeric ID then. A value that+ matches no course is refused instead of being sent to Canvas; if it is part of a+ course name or code, the refusal lists up to five "Did you mean" candidates with+ their IDs. Retry with one of those IDs; the server never picks one for you.

https://raw.githubusercontent.com/vishalsachdev/canvas-mcp/HEAD/AGENTS.md

− CANVAS_ROLE=educator   # 94 tools by default, 96 with every gated tool enabled− CANVAS_ROLE=all        # Default profile; 113 tools by default, 126 with all feature-gated tools enabled− | `list_submissions` | Student submissions for grading |+ CANVAS_ROLE=educator   # 96 tools by default, 98 with every gated tool enabled+ CANVAS_ROLE=all        # Default profile; 115 tools by default, 128 with all feature-gated tools enabled+ | `list_submissions` | Compact student submission metadata by default; `include_body=True` adds fenced plain text with an explicit `manage_grades` check, existing anonymization redaction, 12,000 input characters per body and 60,000 total output characters; truncation and omitted records are marked. No comments or attachments |+ | `create_course_groups` | Preview a NEW course group set, groups and memberships from CSV (`group_name,description,canvas_user_id`); explicit confirmation token required; rejects duplicate/conflicting rows and existing set names; requires `manage_groups_add`, `manage_groups_manage`, `read_roster` |+ | `resume_course_group_creation` | Preview then confirm remaining work using the prior run's server-issued `run_id`; fresh token and full membership revalidation; reports every detected conflict and refuses all writes. Only recorded created IDs are targets; never moves students or adopts existing groups |+ ### Educator: Create Course Project Groups+ Call `create_course_groups(course_identifier, group_set_name, csv_data)` with+ CSV columns `group_name,description,canvas_user_id`, one active student per row.+ Repeat the group name and identical description for its members. Names and emails+ are never matched to people; obtain explicit numeric Canvas IDs first. Duplicate+ student rows, conflicting assignments/descriptions and existing group-set names+ are refused. At most 200 students, 50 groups and 250,000 CSV characters per run.+ The first call writes nothing. Show the entire preview, then call again with+ identical arguments and the single-use confirmation token after explicit approval.+ Partial results report created IDs, member outcomes and a `run_id`. Call+ `resume_course_group_creation(run_id)` for a fresh preview, then confirm that+ preview's fresh token. Resume may create pending groups inside the recorded set;+ it never targets caller-supplied or name-matched existing IDs. Every detected+ membership conflict stops the remaining batch and is shown before any new write.+ Verified memberships are skipped; changed previously confirmed memberships are+ refused. Unknown group/set creation outcomes require manual inspection.+ Run records are caller-bound, server-local, expire after 24 hours and are lost on+ restart; HTTP replicas need affinity. Canvas has no atomic membership compare+ and set: do not concurrently edit this group set during the operation. There is+ no deletion, reassignment or rollback. Both tools are educator writes, withheld+ on HTTP unless enabled by `ALLOWED_WRITE_TOOLS`.+ On Windows, `download_course_file` does not enforce owner-only access: downloaded+ files inherit the destination folder's Windows permissions, even in the default+ temporary folder, and other local users may be able to read them. Explain this+ before downloading; use a folder with verified private Windows permissions, or+ `read_course_file` to avoid saving a local copy. A successful Windows download+ also returns this warning. POSIX downloads are created with mode `0o600`.

https://raw.githubusercontent.com/vishalsachdev/canvas-mcp/HEAD/AGENTS.md

− - Write tools may be absent: the operator's `ALLOWED_WRITE_TOOLS` decides which tools that change anything exist, and a hosted (HTTP) server allows none unless configured. Treat a missing write tool as the deployment's policy, tell the user, and do not look for a workaround+ Announcement deletion tools refuse ordinary discussions and records Canvas does+ not explicitly identify as announcements, including when confirming a preview.+ - Write tools may be absent: the operator's `ALLOWED_WRITE_TOOLS` decides which tools that change anything exist, and a hosted (HTTP) server allows none unless configured. Treat a missing write tool as the deployment's policy, tell the user, and do not look for a workaround. When tools are withheld, the server's instructions state the policy (read-only, or the allowed write tools by name)

https://raw.githubusercontent.com/vishalsachdev/canvas-mcp/HEAD/AGENTS.md

− CANVAS_ROLE=educator   # 93 tools by default, 95 with every gated tool enabled− CANVAS_ROLE=all        # Default profile; 112 tools by default, 125 with all feature-gated tools enabled+ CANVAS_ROLE=educator   # 94 tools by default, 96 with every gated tool enabled+ CANVAS_ROLE=all        # Default profile; 113 tools by default, 126 with all feature-gated tools enabled+ | `get_student_submission` | One student’s current submitted text and visible text comments; requires `manage_grades`, preserves anonymization redaction, and caps output |+ ## Inbox vs Issues+ _Section added by [Doodle bot], 2026-10-09. Authored and committed by: [Doodle bot]_+ - **Use `_agent-inbox/` for directives:** work an agent should pick up — tasks, notes, conventions. See `_agent-inbox/README.md` for the file format.+ - **Use GitHub issues for conversations:** anything that needs a decision, a discussion thread, or tracking over time — bugs, feature requests, open questions.+ - **Public repos lean toward issues.** In public repos like canvas-mcp, issues are the surface contributors watch, so prefer them. Inbox items in public repos must never include secrets, tokens, or student data.

https://raw.githubusercontent.com/vishalsachdev/canvas-mcp/HEAD/AGENTS.md

− CANVAS_ROLE=student    # ~37 tools (student + shared)− CANVAS_ROLE=educator   # 92 tools (educator + shared)− CANVAS_ROLE=all        # Default profile; 98 tools by default, 103 with all feature-gated tools enabled− Three things to know before using them:− | `update_discussion_topic` | Edit discussion or announcement title/body and settings. Optional guards: `expect_body_sha256` (topics have no `updated_at`), `find`/`replace` on the message, `require` (see Guarded edits) |− | `get_syllabus` | Full Syllabus tab content, untruncated (text/html/both). Educators write it with `update_syllabus` |− | `get_page_content` | Read page content |− | `list_discussion_topics` | Discussion forums (discussions only; set `include_announcements` to also list announcements). Shows `Anonymity:` when Canvas reports an `anonymous_state`. Canvas REST returns 404 for fully anonymous topics; the topic read tools then say the topic exists and must be opened in the Canvas UI, instead of reporting it missing |− | `get_discussion_topic_details` | One topic's details; `raw_dates=True` appends the topic's dates and, for a graded discussion, its assignment and checkpoint dates. Prints the message's SHA-256 for `update_discussion_topic`'s `expect_body_sha256` |− | `list_discussion_entries` | Posts in a discussion |− Same parameters on update_assignment (description). Discussion topics and the− Omit every guard parameter and the tools behave exactly as before.− | Course code | `badm_350_120251_246794` | SIS course code |− | SIS ID | `sis_course_id:ABC123` | If configured |− The server automatically resolves identifiers to Canvas IDs.− No anonymization needed - students only access their own data via Canvas "self" endpoints.+ CANVAS_ROLE=student    # 51 tools by default (student + shared), 62 with every student write tool enabled+ CANVAS_ROLE=educator   # 93 tools by default, 95 with every gated tool enabled+ CANVAS_ROLE=all        # Default profile; 112 tools by default, 125 with all feature-gated tools enabled+ | `get_my_assignment_scores` | Every assignment's score and status in one course, by assignment group (weights, drop rules) |+ | `calculate_grade_scenarios` | Recompute your grade the way Canvas does (compared with Canvas's own score), try what-if scores, and get the percentage needed on remaining work for a target % or letter |+ | `list_my_announcements` | Announcements across ALL active courses (default last 14 days); `list_announcements` is per-course |+ | `get_my_activity_stream` | Recent activity feed grouped by kind: announcements, discussions, conversations, grades/comments (course activity only; no group or non-course inbox items) |+ | `list_my_groups` | Groups you belong to, with course, course ID and member count. To read a group's discussions or announcements, pass its course ID and group ID to `list_discussion_topics(course_identifier, group_id=..., include_announcements=True)` and `get_discussion_with_replies(course_identifier, topic_id, include_replies=True, group_id=...)` |+ | `get_group_members` | Members of one of your groups (no emails) |+ | `list_group_files` | Files stored in one of your groups |+ Shared discussion reads, including the course-wide group listing, require group+ membership in every tool profile unless Canvas explicitly grants `manage_grades`+ or `read_as_admin`. Missing or malformed permission data never grants staff access.+ The group tools only read groups you are a member of; they check your membership+ before every call and refuse other groups even when Canvas would allow the read.+ | `list_quizzes` | Classic quizzes and New Quizzes in a course: dates, limits, your submission state (read-only) |+ | `get_quiz_details` | One quiz's settings plus your own attempts used/remaining and kept score from the latest record (read-only; earlier history and New Quizzes details are limited) |+ | `list_calendar_events` | Calendar across courses, personal and group calendars: events and due dates |+ | `get_calendar_event` | One calendar event in full |+ | `list_planner_notes` | Your own planner notes (personal to-dos) in a date window |+ | `find_message_recipients` | Find instructors, TAs or classmates you can message in a course, with their user IDs (non-staff names pseudonymised while anonymization is on, and a name search then returns staff only) |+ | `create_planner_note` | Add a note to your own planner |+ | `update_planner_note` | Change one of your planner notes (preview, then token) |+ | `delete_planner_note` | Delete one of your planner notes (preview, then token) |+ | `mark_planner_item_complete` | Tick or untick an item in your own planner; for course content this also syncs its "Mark as done" module requirement, so `mark_module_item_done` must be permitted too |+ | `create_personal_calendar_event` | Add an event to your personal calendar |+ | `delete_personal_calendar_event` | Delete an event from your personal calendar (preview, then token) |+ | `send_message` | Send a new Inbox message to 1-5 people in a course (two calls: preview, then confirm) |+ | `reply_to_conversation` | Reply to an Inbox conversation you are already in (two calls: preview, then confirm) |+ Four things to know before using them:+ 4. **Planner and personal-calendar deletes and note edits are two calls too.**+    Show the preview, then confirm with the token. These tools only touch the+    student's own notes and personal calendar; course, group and appointment+    events are refused, so do not retry those with other IDs.+ 5. **Planner-note creation, planner completion, and personal-event creation write immediately.**+    `create_planner_note`, `mark_planner_item_complete`, and+    `create_personal_calendar_event` have no preview or confirmation-token step.+    Get the user's approval before calling them. Completing or un-completing+    course content can change module progression and re-lock later modules.+ 6. **`send_message` and `reply_to_conversation` are two calls too.** Show the

Showing the first 40 of each.