Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 2
- 4 3
- 3 5
- 2 1
- 1 0
Trust in production
- Trust it - 36%
- With caveats - 36%
- Wouldn't - 27%
64% would recommend this server
How reviewers scored it
- Setup & docs 3.5
- Auth experience 3.5
- Reliability 3.5
- Maintainer responsiveness 4.0
Why it got a B
Canva's official server, hosted over HTTPS at mcp.canva.com/mcp with OAuth sign-in and no advisories found. Once you approve the connection, the agent can search your designs, read their content and pages, generate new design candidates, upload assets from a URL, export files and edit existing designs. Canva's docs say edits stay in draft until committed and access is per user. The optional canva-sdks/canva-skills plugin adds ready-made skills (resize for social media, bulk create, brand check, edit, feedback). It can still change real designs, so keep tool approval on. Biggest deduction: OAuth is per Canva account with no scopes or read-only mode documented, and the server is closed source, so maintenance is one band lower.
How to connect
Claude Code: /plugin marketplace add canva-sdks/canva-skills, then /plugin install canva@canva-skills (connects https://mcp.canva.com/mcp; sign in to Canva when prompted)Is Canva MCP Server safe?
Is Canva MCP Server safe to use?
Canva MCP Server grades B (solid, with minor gaps). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Upkeep is hard to verify (closed source or a single maintainer), so pin the version you tested.
Does Canva MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Canva MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Collaboration
- A Docusign MCP ServerOfficial hosted Docusign server that lets an AI agent create and send envelopes, track signing and search agreements, with OAuth sign-in.
- A Google Drive MCP ServerOfficial Google-hosted Drive server (Developer Preview) to search, read, download, create, and copy files, with scoped OAuth.
- A Pragor Project Board MCP ServerHosted server that connects an agent to a Pragor project board to read and update messages, tasks and operations, with a per-agent token limited to its project role.
- A Slack MCP ServerOfficial hosted Slack server to search and read messages, files, and canvases, and send messages as you.
- A Zoom MCP (Meetings)Zoom's official hosted Meetings MCP server, one of several per-product servers, reached over Streamable HTTP with OAuth 2.1 and PKCE.
Embed this badge
[](https://trustedmcp.io/servers/canva-mcp)<a href="https://trustedmcp.io/servers/canva-mcp"><img src="https://trustedmcp.io/badge/canva-mcp.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Does the job, docs could be better
Good for experimenting, still deciding about production. Scoped the token to just what the agent needs and it respected that. Filed an issue and got a reply within two days. Keep permissions tight and it is a good tool.
Used for Keeping project boards up to date
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Promising, a bit raw
It does the job, but it took some tweaking. Hosted endpoint means no local process to babysit. The OAuth flow worked first time in Claude Code. Auth is handled properly, and revoking access later was one click.
Used for Summarising channels I missed
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Mixed feelings after two weeks
Useful tool, though I would not hand it to a junior unsupervised. The OAuth flow worked first time in Claude Code. Updates land regularly, and nothing broke when I upgraded. I will check back in a few releases.
Used for Keeping project boards up to date
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Useful, with a few rough edges
Mostly reliable, with the odd timeout. Read-only mode is the first thing I enable, and it covers most of what I need.
Used for Turning chat threads into tasks
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 5/5
Does what it says, no drama
Clear tool names, sensible outputs, very few surprises. Nice to use something maintained by Canva rather than a random fork. I like that access goes through a proper sign-in instead of a long-lived secret on disk.
Used for Meeting prep from shared docs
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Better than the DIY script it replaced
Replaced a homegrown script with Canva MCP Server and have not looked back. Filed an issue and got a reply within two days. Sign-in flow was painless and I never had to paste a key into a config file. It is in our production agent and I sleep fine.
Used for Turning chat threads into tasks
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 3/5
No complaints after a month
Our agents call this dozens of times a day. Hosted endpoint means no local process to babysit. Sign-in flow was painless and I never had to paste a key into a config file. Worth it, just do not skip the hardening steps.
Used for Drafting announcements
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Solid and well behaved
Set this up for our team after comparing a few options. Nothing to install, I just point the client at the URL. Scoped the token to just what the agent needs and it respected that. Happy to run it in production.
Used for Posting daily standup summaries
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Decent, not set-and-forget
Works well enough for what I need. Nothing to install, I just point the client at the URL. I would use it in prod, but only with a human approving writes.
Used for Searching old conversations for decisions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Trustworthy enough for real work
I use this almost daily. Releases come often and the changelog is clear. The OAuth flow worked first time in Claude Code. Would recommend without hesitation.
Used for Summarising channels I missed
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Fine for a demo, not for prod
Gave it a fair shot over two weeks. Sign-in flow was painless and I never had to paste a key into a config file. Turned on read-only mode on day one, highly recommend doing the same. Keeping it to local experiments for now.
Used for Drafting announcements
- Setup & docs 2/5
- Auth experience 4/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.