GoCanvas MCP Server (read-only)

Item: GoCanvas MCP Server (read-only)
Rating: 67
Author: M8ven

Exposes read-only GoCanvas API v3 endpoints as MCP tools, enabling listing and retrieval of forms, submissions, reports, and reference data.

→ kbates97/GoCanvas-Readonly-MCP · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 3 credentials: GOCANVAS_API_TOKEN, GOCANVAS_CLIENT_SECRET, GOCANVAS_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configGOCANVAS_BASE_URL— Optional. Defaults to https://api.gocanvas.com/api/v3.

🔐 secretGOCANVAS_API_TOKEN— Static bearer token.

configGOCANVAS_CLIENT_ID— / GOCANVAS_CLIENT_SECRET OAuth 2.0 client credentials (preferred). A short-lived bearer token is fetched from /oauth/token, cached, and auto-refreshed on expiry or 401.

🔐 secretGOCANVAS_CLIENT_SECRET— GOCANVAS_CLIENT_ID / OAuth 2.0 client credentials (preferred). A short-lived bearer token is fetched from /oauth/token, cached, and auto-refreshed on expiry or 401.

configGOCANVAS_OAUTH_SCOPE— Optional OAuth scope to request.

configGOCANVAS_USERNAME— / GOCANVAS_PASSWORD HTTP Basic auth (fallback).

🔐 secretGOCANVAS_PASSWORD— GOCANVAS_USERNAME / HTTP Basic auth (fallback).

configGOCANVAS_PDF_DIR— The three PDF tools download the binary response to

configGOCANVAS_TIMEOUT— Optional. HTTP timeout in seconds (default 30).

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/kbates97-gocanvas-readonly-mcp-1i19sj)](https://m8ven.ai/mcp/kbates97-gocanvas-readonly-mcp-1i19sj)

commit: dbe0e08f86eb80976f5389b390f64c9ac836af82

code hash: b150cd7f3d855a2dd99e4ff65852c1de7a7b2ee0637f45b6012ba1eb756f2349

verified: 7/21/2026, 9:18:42 AM

view raw JSON →