This is an independent project, not affiliated with Canva. It forwards MCP tool and resource requests, but does not install itself into your AI client or edit a design by itself.

Install

Publication pending: The package has been prepared as [email protected], but this version is not published to npm yet. Do not use the registry command below until npm view [email protected] version confirms this release. Use Node.js 20.11 or newer, a local browser, and an MCP client that supports stdio.

After the public npm release is verified:

npm install --global canva-mcp
canva-mcp login
canva-mcp status

Until then, install the source from this repository:

git clone https://github.com/AmoureuxID/canva-mcp.git
cd canva-mcp
npm ci
npm install --global .
canva-mcp login
canva-mcp status

The trailing . installs the checked-out source, not a registry package. If you prefer no global installation, use node bin/canva-mcp-stdio.mjs login from the checkout. Install and run under the same OS account, and keep npm's global executable directory on your PATH.

Approve the read-only scopes in your browser on the same computer. If no tab opens, use the one-time URL printed by the still-running login command. Do not share a callback URL, authorization code, or token. The login attempt expires after ten minutes.

Connect your MCP client

For an npm installation, configure the client to launch canva-mcp with the serve argument. For a source checkout, you can instead point your client's stdio configuration to Node and the absolute path to the entry point:

{
  "mcpServers": {
    "canva": {
      "command": "node",
      "args": ["/absolute/path/to/canva-mcp/bin/canva-mcp-stdio.mjs", "serve"]
    }
  }
}

The JSON above is a generic shape; each MCP client may use different settings. Restart or reload the client after configuring it. serve writes MCP protocol messages to standard output, so it is intended to be launched by the client rather than used as an interactive shell. The guide covers Windows paths, OS user accounts, and DSH without replacing an existing connector.

What this bridge handles

• OAuth authorization with PKCE S256 and a temporary 127.0.0.1 callback, approved by the person signing in.
• Per-user credential storage, refresh-token rotation, and MCP forwarding to https://mcp.canva.com/mcp.
• login, serve, status, and logout commands. status reports stored credentials, not whether a revoked grant will still work. logout removes local tokens; revoke access separately in Canva settings if needed.

The default grant requests profile:read, design:meta:read, design:content:read, and folder:read. It requests no write scopes. Canva may advertise tools that this grant cannot execute; a listed tool is not a promise that create, edit, export, or publish will succeed. Clients supporting only a remote HTTP MCP URL cannot use this local stdio bridge directly.

Have an AI agent install it

Copy the guarded agent prompt from the guide. It directs the agent to check the real MCP client settings, show you any config edit before applying it, and leave browser approval to you. Do not provide the agent with a credential file, OAuth code, callback URL, or token.

Status, checks, and limits

The CI badge reflects the current GitHub Actions workflow; inspect the run details before relying on a platform result. The workflow defines Windows, macOS, and Ubuntu jobs for Node 20, 22, and 24. Tests and package inspection run with:

npm ci
npm test
npm pack --dry-run --json

A live OAuth sign-in through this new package and a clean-machine MCP listing have not yet been confirmed. The npm package is not published. Troubleshooting, credential storage, and release checks are in the guide.

MIT license: LICENSE.