canvas-mcpCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

npx skills add vishalsachdev/canvas-mcp

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: canvas-accessibility-auditor
description: Accessibility audit and remediation for Canvas LMS courses. Scans content for WCAG-oriented issues, generates prioritized reports, guides fixes, and verifies remediation. Use when asked to "audit accessibility", "check WCAG", "fix accessibility issues", or "run accessibility review".
---

# Canvas Accessibility Auditor

Full accessibility audit cycle for Learning Designers: scan course content, generate a prioritized report, guide remediation of fixable issues, re-scan to verify fixes, and produce an accessibility review summary.

## Prerequisites

- **Canvas MCP server** must be running and connected.
- Authenticated user must have **instructor, TA, or designer role** in the target course.
- For UFIXIT integration: the course must have a UFIXIT report page (generated by your institution's accessibility tool).

## Steps

### 1. Identify Target Course

Ask the user which course to audit. Accept a course code, Canvas ID, or course name.

If not specified, prompt:

> Which course would you like to audit for accessibility?

### 2. Scan Course Content

Run two scans in parallel if possible:

**Scan A -- Direct content scan:**
```
scan_course_content_accessibility(course_identifier, "pages,assignments")
```

This checks all page and assignment HTML for:
- Images missing alt text (WCAG 1.1.1, Level A)
- Empty headings (WCAG 2.4.6, Level AA)
- Tables missing headers (WCAG 1.3.1, Level A)
- Non-descriptive link text like "click here" (WCAG 2.4.4, Level A)

**Scan B -- UFIXIT report (if available):**
```
fetch_ufixit_report(course_identifier)
```

If the UFIXIT page exists, parse it:
```
parse_ufixit_violations(report_json)
```

### 3. Generate Prioritized Report

Combine results from both scans. Call `format_accessibility_summary` if using UFIXIT data.

Present issues sorted by priority:

```
## Accessibility Audit: [Course Name]

### Summary
- Content scanned: 20 pages, 15 assignments
- Total issues: 12
- Auto-fixable: 8 | Manual review needed: 4

### Level A Violations (must fix)
1. **Missing alt text** -- 5 images across 3 pages
   - Page "Week 1 Overview": 2 images
   - Page "Lab Instructions": 2 images
   - Assignment "Final Project": 1 image

2. **Tables missing headers** -- 2 tables
   - Page "Grade Scale": 1 table
   - Page "Schedule": 1 table

3. **Non-descriptive links** -- 3 instances of "click here"
   - Page "Resources": 2 links
   - Page "Week 3 Overview": 1 link

### Level AA Violations (should fix)
4. **Empty headings** -- 2 empty heading elements
   - Page "Week 5 Notes": 1 empty h3
   - Page "Midterm Review": 1 empty h2

### Manual Review Required
- Color contrast: Cannot be checked automatically (requires visual inspection)
- Video captions: Cannot be verified via API (check in Canvas media player)
- PDF accessibility: Cannot be parsed via API (use Adobe Acrobat checker)
```

### 4. Guided Remediation

For each auto-fixable issue, walk the user through the fix:

**For missing alt text:**
1. Call `get_page_content(course_identifier, page_url)` to retrieve the HTML
2. Identify the `<img>` tags without alt attributes
3. Ask the user for alt text descriptions (or suggest based on surrounding context)
4. Call `edit_page_content(course_identifier, page_url, new_content)` with corrected HTML

**For non-descriptive links:**
1. Retrieve the page content
2. Show the current link: `<a href="...">click here</a>`
3. Suggest descriptive replacement: `<a href="...">Download the syllabus (PDF)</a>`
4. Apply fix after user approval

**For empty headings:**
1. Retrieve the page content
2. Show the empty heading
3. Ask: "Remove this heading, or add text to it?"
4. Apply the chosen fix

**For tables missing headers:**
1. Retrieve the page content
2. Show the table structure
3. Ask: "Which row/column should be headers?"
4. Convert `<td>` to `<th>` elements and apply

Always ask for user confirmation before modifying any page.

### 5. Re-scan Modified Pages

After remediation, re-run the scan on modified pages only:

```
scan_course_content_accessibility(course_identifier, "pages")
```

Report: "Fixed 8/12 issues. 4 remaining require manual review."

### 6. Generate Accessibility Review Summary

Produce a final summary suitable for stakeholder reporting:

```
## Accessibility Review Summary

**Course:** [Course Name]
**Audit Date:** [date]
**Auditor:** AI-assisted audit via Canvas MCP

### Results
- Total content items scanned: 35
- Automated issues found: 12
- Issues remediated: 8
- Issues requiring manual review: 4
- Automated WCAG-oriented checks: Partial pass (manual review items remain)

### Remediation Actions Taken
- Added alt text to 5 images
- Fixed 3 non-descriptive links
- Removed 2 empty headings

### Outstanding Items
- Color contrast review needed (pages with colored text)
- Video caption verification (embedded videos)
- PDF accessibility check (uploaded PDFs)

### Recommendation
Course content meets automated WCAG 2.1 Level A criteria after remediation.
Manual review of color contrast and multimedia is recommended before publishing.
```

## MCP Tools Used

| Tool | Purpose |
|------|---------|
| `scan_course_content_accessibility` | Scan pages and assignments for WCAG issues |
| `fetch_ufixit_report` | Retrieve institutional UFIXIT report |
| `parse_ufixit_violations` | Extract structured violations from report |
| `format_accessibility_summary` | Format violations into readable report |
| `get_page_content` | Retrieve page HTML for remediation |
| `edit_page_content` | Apply accessibility fixes to pages |
| `list_courses` | Find available courses |

## Example

**User:** "Run accessibility audit for CS 101"

**Agent:** Scans all content, generates the prioritized report.

**User:** "Fix the missing alt text issues"

**Agent:** Retrieves each affected page, asks for alt text descriptions, applies fixes, re-scans.

## Limitations

- **Cannot check:** Color contrast, video captions, PDF accessibility, audio descriptions, keyboard navig

CAUTIONgrade C · trust 72/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (6 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

found

Findings (25)

console.log(`✓ ~/.claude.json canvas X-Canvas-Token header updated -> ${mask(t)} (backup: ~/.claude.json.bak-${stamp})`);

proxy_pass http://127.0.0.1:8819;

stripped = text.lstrip(" \n\t\r ")

secret = "synthetic-secret-token-123"

secret = "synthetic-secret-token-456"

.mcpbignore

.assetsignore

.nojekyll

return importlib.import_module(MODULE_NAME)

module = importlib.import_module(self.module)

import { fetchAllPaginated } from "../../client.js";

import { canvasPost } from "../../client.js";

import { canvasGet } from "../../client.js";

import { fetchAllPaginated } from "../../client.js";

import { createBatchRunner } from "../../batching.js";

(b"x-canvas-url", b"http://169.254.169.254/latest/meta-data/"),

initializeCanvasClient(`http://127.0.0.1:${address.port}`, 'synthetic');

initializeCanvasClient(`http://127.0.0.1:${address.port}`, 'synthetic');

"http://127.0.0.1:3000",

"HTTPS_PROXY": "http://127.0.0.1:9", "https_proxy": "http://127.0.0.1:9",

payload = json.loads(base64.b64decode(raw))

content = base64.b64decode(encoded, validate=True)

JPEG_BYTES = bytes.fromhex(

@types/node, tsx, typescript

share a token ([issue 318](https://github.com/vishalsachdev/canvas-mcp/issues/318)).

Gates applied: no_behavioural_pass.