Atlas / MCP servers / moonlight-lupin / canon

canonBLOCK

mcp/moonlight-lupin/canon

Local-first, multilingual church system: plan the service, print the bulletin, project the slides, keep members, rotas, records and the church's books. Runs on an office PC or Docker. AI assistants such as Claude connect through a permission-controlled MCP server.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
13 13r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

"Let all things be done decently and in order." — 1 Corinthians 14:40 凡事都要规规矩矩地按着次序行。 — 哥林多前书 14:40

Canon is a local-first, multilingual system for running a church: plan the service, print the bulletin, project the slides, keep the registers and records, and keep the church's books. It runs on an office PC, a server or any Docker host, with no cloud account, so the church's data stays under the church's control. Staff use it in a browser, and AI assistants such as Claude can connect through a permission-controlled MCP server.

It was designed with a bilingual (English / 中文) Reformed and Presbyterian congregation in mind, but its languages, liturgies and templates are all configurable. The name comes from the Greek κανών: a measuring reed, a rule (Ezek 40:3; Gal 6:16).

[](https://github.com/moonlight-lupin/canon/actions/workflows/ci.yml) [](LICENSE)

Features

  • Service planner: build the order of worship from templates, with drag-and-drop, clock times, roles and postures.
  • Library: hymns (with hymnal numbers), responsive liturgy, catechisms in numbered parts, and Bibles. KJV and 和合本 are built in; other Bibles download in one click or can be uploaded under your own licence.
  • From one plan:
  • a printed bulletin, folded into a booklet automatically;
  • projector slides with a presenter view;
  • PowerPoint, Word and FreeShow files;
  • a run sheet and a read-only share link.
  • Bulletin and slide templates set the look.
  • People:
  • congregations;
  • members and households;
  • co-workers;
  • groups and committees, Sunday school classes, with custom member fields;
  • a volunteer rota with e-mail reminders.
  • Resources (optional):
  • a lending library of books, DVDs and curricula: ISBN lookup, numbered co
Read from source at commit 447e007003d5OBSERVED · 2026-10-09
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add canon --env CANON_KEYCHAIN=${CANON_KEYCHAIN} --env CANON_KEY_FILE=${CANON_KEY_FILE} --env CANON_KEY_PROTECT=${CANON_KEY_PROTECT} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "canon": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "CANON_KEYCHAIN": "${CANON_KEYCHAIN}",
        "CANON_KEY_FILE": "${CANON_KEY_FILE}",
        "CANON_KEY_PROTECT": "${CANON_KEY_PROTECT}"
      }
    }
  }
}
03

Exposed tools (13)

13 read · 0 write · 0 destructive.

ToolRiskDescription
Book-keepingreadThe church’s double-entry books: a chart of accounts, funds, journals, verified offerings drafted into the books, bank statements matched, closed periods, and the income and expenditure, balance sheet and fund reports.
canon_placeholderread
catechism_seriesreadPlan Westminster Shorter or Larger Catechism questions across the coming services and, after confirmation, add them to each order of worship.
check_libraryreadFind songs and liturgical texts whose languages have drifted apart (a verse or part missing in one language, different line counts, Leader / People lines that do not match), likely duplicates, and Bible versions with missing chapters — then explain and propose fixes.
convert_existingreadTurn a bulletin (PDF, Word, photo) or a slide deck (PowerPoint, PDF, photos) the church already uses into Canon: the order of service, missing library items, and the settings for a matching bulletin / slide template.
group_overviewreadAn overview of committees, fellowships, cell groups and ministries: sizes, leaders, terms ending soon and gaps.
member_carereadUpcoming birthdays and visitors to follow up, for pastoral care — with privacy reminders. Only offered when the administrator exposes member details.
monthly_reportreadA short report on a month (or another period) for the pastor, elders or church council: attendance and new visitors, and — where this connection may see them — offerings, serving, songs and Scripture, membership.
plan_servicereadPlan a Lord\
proofread_servicereadCheck a service before printing: empty slots, missing references and translations, catechism ranges, bulletin choices, copyright, posture and leaders.
roster_checkreadCheck the coming weeks of the volunteer rota for gaps, conflicts and fairness, and propose changes — applied only after you approve.
suggest_hymnsreadSuggest hymns and psalms from the church\
translate_libraryreadFill missing languages in songs or liturgical texts — only public-domain or church-owned texts, as drafts marked for human review.
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (10 observation(s))
Network
declared (6 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (21)

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
skills/canon/SKILL.md:14
3. Missing tools are deliberate: the administrator sets each module to off / read / read & write. Don't work around it; tell the user what an administrator would need to change in Settings → AI / MCP.
Why it matters. asks the agent to act without the user's knowledge
MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338
src/pages/BulletinLayoutEditor.tsx:205
const key = layout.some((s) => s.key === p.key) ? `${p.key}_${Math.random().toString(36).slice(2, 5)}` : p.key;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
Dockerfile:41
CMD node -e "fetch('http://127.0.0.1:'+(process.env.CANON_PORT||3000)+'/api/me').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
server/lib/csv.ts:14
const s = text.replace(/^/, '');
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
server/lib/csv.ts:38
let s = text.replace(/^/, '');
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
server/lib/csv.ts:96
return '' + rows.map((r) => r.map((c) => csvCell(c, delimiter)).join(delimiter)).join('\r\n') + '\r\n';
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
server/lib/csv.ts:145
return { text: new TextDecoder('utf-8', { fatal: true }).decode(buf).replace(/^/, ''), encoding: 'utf-8' };
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
server/lib/csv.ts:168
h.normalize('NFKC').replace(/^/, '').trim().toLowerCase().replace(/[\s_\-.:/]+/g, '_').replace(/^_|_$/g, '');
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/dates-1900.xlsx
dates-1900.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/fixtures/dates-1904.xlsx
dates-1904.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
locales/.zh-sync.json
.zh-sync.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/csv/common.ts:3
import type { L10n, Lang, Person } from '../../shared/types.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/csv/common.ts:4
import { langInfo } from '../../shared/languages.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/csv/coworkers.ts:3
import type { Coworker, Person } from '../../shared/types.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/csv/engine.ts:4
import type { Lang, ModuleKey } from '../../shared/types.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/csv/engine.ts:10
import { LANG_CODE_RE } from '../../shared/languages.ts';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.github/workflows/ci.yml:38
for i in $(seq 1 150); do curl -sf http://127.0.0.1:3999/api/about > about.json && break; sleep 2; done
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.github/workflows/docker-check.yml:38
if curl -sf http://127.0.0.1:3000/api/about > about.json; then return 0; fi
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CHANGELOG.md:408
- **start-canon.bat shows the office PC's network address** (e.g. `http://192.168.1.20:5018`) for other computers, instead of its name. If no address is found it shows the name as before.
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:65
3. Open <http://localhost:3000>. Setup asks for your church's languages and creates the administrator account. Other computers on the office network open the address the Canon window shows, e.g. `http
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, docx, express, nodemailer, opencc-js, pptxgenjs, qrcode, zod
Why it matters. 24 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-09 · audit v0.4.1 · source sha 447e007003d5full audit observations/trust-audit/mcp-server/moonlight-lupin__canon.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-09447e007003d5BLOCKD69first audit
06

Questions

What is the canon MCP server?

Local-first, multilingual church system: plan the service, print the bulletin, project the slides, keep members, rotas, records and the church's books. Runs on an office PC or Docker. AI assistants such as Claude connect through a permission-controlled MCP server.

What tools does canon expose?

13 in total: 13 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is canon safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does canon need?

It reads CANON_KEYCHAIN, CANON_KEY_FILE and CANON_KEY_PROTECT from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does canon run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as canon at 0.19.7.

How current is this page?

The grade is for one exact copy of the source (447e007003d5), read on 2026-10-09. The repository is watched and re-audited when it changes.

Advertisement