What makes canvas-parent-api notable?

1.6K downloads. Trust evidence available

How should canvas-parent-api be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

canvas-parent-api

Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and files for yourself or a linked observee. Use when you want Canvas data without the MCP, in a script, or on a machine where the MCP isn't installed. Skill: canvas-parent-api Owner: chrischall Summary: Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and files for yourself or a linked observee. Use when you want Canvas data without the MCP, in a script, or on a machine where the MC

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

1.6k

Updated

Oct 10, 2026

Version

2.1.9

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.6K downloads reported by the source. Last updated 10/10/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 10, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 10, 2026
Adoption signal: 1.6K downloadsadoption · observed Oct 10, 2026
Latest release: 2.1.9release · observed Oct 9, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s17cjx1a349nz5apaqp02vgz4h85728z:canvas-parent-api

Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-chrischall-canvas-parent-api/snapshot"

Documentation

CLAWHUB

147,585 characters of source documentation, loaded on request.

Extracted files

4 files captured from the source.

SKILL.md

---
name: canvas-parent-api
description: "Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and files for yourself or a linked observee. Use when you want Canvas data without the MCP, in a script, or on a machine where the MCP isn't installed."
---

# Canvas LMS via curl (no MCP)

Canvas's REST API (`/api/v1/...`) is a normal per-institution API reachable
directly with `curl` — no browser bridge, no bot wall. Every request needs an
`Authorization: Bearer <token>` header; there is no anonymous access. The
host is **per-institution** (`https://<district>.instructure.com`, or a
self-hosted domain) — always read it from `$CANVAS_BASE_URL`, never hardcode
one tenant.

This is the same data the `canvas_*` MCP tools return, reached with plain
`curl` instead of a running server.

## One-time setup — get a bearer token

Pick whichever your institution allows (mirrors `canvas-parent-mcp`'s
`CANVAS_TOKEN` / OAuth modes — the session-cookie and fetchproxy modes need
the MCP or a browser and are out of scope here):

**A. Personal access token (simplest, if allowed)**

Canvas web UI → Account → Settings → **+ New Access Token**. Most
institutions disable this for non-admins, so try B if it's not offered.

```sh
export CANVAS_BASE_URL=https://<district>.instructure.com   # per-institution, no trailing slash
export CANVAS_TOKEN=<token from the UI>
```

**B. OAuth via the mobile QR-login flow**

In the Canvas mobile app: Account → **QR for Login** (or "Pair with
Observer/QR Login"), scan it with any camera to get the URL it encodes
(`https://sso.canvaslms.com/canvas/login?domain=...&code=...`). Exchange it
once for OAuth credentials with the helper this same repo ships (no MCP
server needs to be *running* — it's a one-off CLI).

It prints four `NAME=value` lines to stdout
(`CANVAS_BASE_URL`/`CANVAS_CLIENT_ID`/`CANVAS_CLIENT_SECRET`/`CANVAS_REFRESH_TOKEN`)
— **export them into the shell**, since the next `curl` reads them as env
vars and this step can't be skipped:

```sh
eval "$(npx canvas-parent-mcp-qr-login "<qr-url>" | sed 's/^/export /')"
```

Then mint (and later re-mint) a short-lived access token from the refresh
token with `curl` directly — no need to re-scan the QR each time:

```sh
curl -s -X POST "$CANVAS_BASE_URL/login/oauth2/token" \
  -d grant_type=refresh_token \
  -d client_id="$CANVAS_CLIENT_ID" \
  -d client_secret="$CANVAS_CLIENT_SECRET" \
  -d refresh_token="$CANVAS_REFRESH_TOKEN" \
  | jq -r '.access_token'
```

Export the result as `CANVAS_TOKEN` (access tokens expire in ~1h — re-run
this when calls start 401ing).

## Core call pattern

```sh
curl -s \
  -H "Authorization: Bearer $CANVAS_TOKEN" \
  -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/users/self/profile" \
  | sed 's/^while(1);//' | jq .
```

Two quirks

_meta.json

{
  "ownerId": "kn700jq4sjtf2anb0rk3ft4p7n856872",
  "slug": "canvas-parent-api",
  "version": "2.1.9",
  "publishedAt": 1791588217944
}

references/canvas-endpoints.md

# Canvas API endpoints for curl

All 18 `canvas_*` MCP tools, transcribed from `src/tools/*.ts` in
`canvas-parent-mcp`. Every call needs:

```sh
-H "Authorization: Bearer $CANVAS_TOKEN"
-H "Accept: application/json+canvas-string-ids, application/json"
```

against `$CANVAS_BASE_URL` (per-institution, e.g.
`https://<district>.instructure.com`). Pipe every response through
`sed 's/^while(1);//'` before `jq` (Canvas's XSSI guard). List endpoints are
marked **paginated** — see the `Link`-header loop in `SKILL.md` for anything
you expect to run long; for a quick look just bump `per_page`.

`{userSegment}` below means `users/self`, or `users/<observeeId>` to read a
linked observee's data instead (get IDs from §2).

---

## 1. Profile

```sh
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/users/self/profile" | sed 's/^while(1);//' \
  | jq '{id, name, primary_email, login_id, locale, time_zone}'
```

## 2. Observees — students linked to your observer account

Empty array for a plain student token.

```sh
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/users/self/observees?include[]=avatar_url" | sed 's/^while(1);//' \
  | jq '.[] | {id, name}'
```

*(paginated)*

## 3. Courses — active, with grades

```sh
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/{userSegment}/courses?enrollment_state=active&state[]=available&include[]=total_scores&include[]=current_grading_period_scores&include[]=term" \
  | sed 's/^while(1);//' | jq '.[] | {id, name, total_scores}'
```

*(paginated)*

## 4. Single course — syllabus, teachers, term

```sh
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/courses/{courseId}?include[]=syllabus_body&include[]=teachers&include[]=term" \
  | sed 's/^while(1);//' | jq '{id, name, syllabus_body, teachers, term}'
```

## 5. Assignments — a course's assignment list, with your submission inline

`bucket` (optional): `past` `overdue` `undated` `ungraded` `unsubmitted`
`upcoming` `future`.

```sh
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/courses/{courseId}/assignments?include[]=submission&order_by=due_at&bucket=upcoming" \
  | sed 's/^while(1);//' | jq '.[] | {id, name, due_at, submission: .submission.workflow_state}'
```

*(paginated)*

## 6. Missing submissions — past-due, unsubmitted

For an observee, `course_ids[]` (repeat the param per ID) is required.

```sh
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" -H "Accept: application/json+canvas-string-ids, application/json" \
  "$CANVAS_BASE_URL/api/v1/{userSegment}/missing_submissions?include[]=planner_overrides&

skill-card.md

## Description:

Guides agents in querying a user's or linked student's Canvas LMS courses, grades, assignments, messages, and files through authenticated API calls without an MCP server.

This skill is ready for commercial/non-commercial use.

## Publisher:

[chrischall](https://clawhub.ai/user/chrischall)

### License/Terms of Use:

MIT-0

## Use Case:

Developers, parents, and other authorized Canvas users can use this skill to retrieve course and student information from their institution's Canvas account in scripts or shell-based agent workflows.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Authenticated queries can expose sensitive Canvas account and student information.

Mitigation: Use a scoped token and grant access only to agents authorized to handle the account data.

Risk: Evaluating QR-login helper output or running an unverified npx package can execute untrusted commands.

Mitigation: Review helper output instead of evaluating it and pin or verify the package before running it.

Risk: Refresh tokens can leak through shared shells or logs, and file downloads can overwrite unintended destinations.

Mitigation: Keep tokens out of shared shells and logs; restrict downloads to a known safe folder and refuse overwrites.

## Reference(s):

- [Canvas API endpoint examples](references/canvas-endpoints.md)
- [Canvas Parent API release on ClawHub](https://clawhub.ai/chrischall/skills/canvas-parent-api)

## Skill Output:

**Output Type(s):** [Shell commands, Guidance]

**Output Format:** [Markdown with shell code blocks]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Commands return Canvas API JSON and may download course files when run.]

## Skill Version(s):

2.1.9 (source: ClawHub release evidence)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 15h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.