generated: '2026-08-13'
method: probed
source: >-
  https://mcp.canva.com/mcp (HTTP 401 + WWW-Authenticate challenge),
  https://mcp.canva.com/.well-known/oauth-protected-resource (HTTP 200),
  https://mcp.canva.com/.well-known/oauth-authorization-server (HTTP 200),
  https://www.canva.dev/docs/connect/mcp-server.md (HTTP 200)
description: >-
  Canva ships TWO distinct MCP surfaces and they are not interchangeable. (1) A hosted,
  remote MCP server at https://mcp.canva.com/mcp — the "Canva AI Connector" — which an MCP
  client POSTs to directly after an OAuth 2.1 authorization-code flow; it advertises OAuth
  Protected Resource Metadata (RFC 9728) and Authorization Server Metadata (RFC 8414),
  including Dynamic Client Registration. (2) A local stdio "Canva Dev MCP server" launched
  with `npx -y @canva/cli@latest mcp`, aimed at AI-assisted development of Canva apps and
  integrations (documentation and tooling assistance), not at operating a user's designs.
deployment:
  mode: both
  endpoint: https://mcp.canva.com/mcp
  install: npx -y @canva/cli@latest mcp
  package: https://www.npmjs.com/package/@canva/cli
  auth: oauth
  verified: probed
servers:
  - name: Canva AI Connector (hosted MCP server)
    mode: remote
    endpoint: https://mcp.canva.com/mcp
    transport: streamable-http
    auth: oauth
    status: live
    evidence:
      - url: https://mcp.canva.com/mcp
        method: POST
        body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
        http_status: 401
        www_authenticate: >-
          Bearer realm="OAuth",
          resource_metadata="https://mcp.canva.com/.well-known/oauth-protected-resource/mcp",
          error="invalid_token", error_description="Missing or invalid access token"
      - url: https://mcp.canva.com/.well-known/oauth-protected-resource
        http_status: 200
        file: well-known/canva-mcp-oauth-protected-resource.json
      - url: https://mcp.canva.com/.well-known/oauth-authorization-server
        http_status: 200
        file: well-known/canva-mcp-oauth-authorization-server.json
    oauth:
      issuer: https://mcp.canva.com
      authorization_endpoint: https://mcp.canva.com/authorize
      token_endpoint: https://mcp.canva.com/token
      registration_endpoint: https://mcp.canva.com/register
      revocation_endpoint: https://mcp.canva.com/token
      dynamic_client_registration: true
      pkce: true
      code_challenge_methods_supported:
        - S256
        - plain
      grant_types_supported:
        - authorization_code
        - refresh_token
        - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
      token_endpoint_auth_methods_supported:
        - client_secret_basic
        - client_secret_post
        - none
    scopes_supported:
      - profile:read
      - design:meta:read
      - design:content:write
      - design:content:read
      - folder:read
      - folder:write
      - brandtemplate:content:read
      - brandtemplate:meta:read
      - brandtemplate:content:write
      - comment:write
      - comment:read
      - asset:read
      - asset:write
      - brandkit:read
      - help:answers:read
      - help:answers:write
    tools:
      status: gated
      note: >-
        tools/list returns 401 without a bearer token, so the live tool list and inputSchemas
        could not be enumerated anonymously. NOTHING is asserted here about tool names.
        The scopes_supported list above is the authoritative anonymous evidence of what the
        server can reach, and it is the basis of mcp/canva-tool-crosswalk.yml. Two scopes —
        brandkit:read, help:answers:read/write — are NOT in the Connect API OAuth scope
        table, so the hosted MCP server reaches at least two capabilities the public REST
        API does not expose.
  - name: Canva Dev MCP server
    mode: local-stdio
    install: npx -y @canva/cli@latest mcp
    package: https://www.npmjs.com/package/@canva/cli
    auth: none
    status: live
    purpose: >-
      AI-assisted DEVELOPMENT of Canva apps and integrations — documentation lookup and
      development tooling for MCP clients such as Cursor, Claude Desktop and Claude Code.
      It does not operate an end user's Canva designs.
    docs: https://www.canva.dev/docs/connect/mcp-server/
    prerequisites:
      - git
      - Node.js v24 or later
      - npm
    evidence:
      - url: https://www.canva.dev/docs/connect/mcp-server.md
        http_status: 200
related:
  agent_skills: https://github.com/canva-sdks/canva-skills
  connect_openapi: openapi/canva-connect-api-openapi.yml
  crosswalk: mcp/canva-tool-crosswalk.yml