Canva: MCP server, CLI and agent surfaces
Sign-in required, tools not seen, not counted. The MCP endpoint listed for Canva at mcp.canva.com answered 401 with OAuth metadata on 4 November 2026. Its tools can be listed only after a person authorizes a client, and this directory never signs in.
Fact sheet
| Company | Canva |
|---|
| Domain | canva.com |
|---|
| Category | Productivity (Ora leaderboard category) |
|---|
| MCP server | Sign-in required (OAuth with client registration) |
|---|
| Tranco rank | 284 on the list of 4 November 2026 |
|---|
| Ora score | 42, grade D; Ora scanned the domain on 5 November 2026 and the cached score was read on 5 November 2026 from its score API (Ora's score page for canva.com, a vendor-published score) |
|---|
| Company found through | the vendor's own documentation; the awesome-remote-mcp-servers list; the official MCP Registry; Ora's public leaderboard |
|---|
| Last verified | 4 November 2026 |
|---|
MCP server
| Endpoint | https://mcp.canva.com/mcp |
|---|
| How it was found | listed in the vendor's own documentation; the awesome-remote-mcp-servers list; the official MCP Registry; Ora's public leaderboard |
|---|
| Transport | streamable-http |
|---|
| HTTP status | 401 |
|---|
| Connected | 4 November 2026, 20:01 UTC |
|---|
| Handshake time | 99 ms over 1 attempt |
|---|
| Documentation | www.canva.dev |
|---|
The endpoint answered the handshake with a sign-in challenge, so the tool list is not visible to this directory. It is not counted as an MCP server: a sign-in challenge is its own state, and the connector listed no tools.
Connector log
2 connections on 4 November 2026, read-only methods only
- 19:55:52Z https://mcp.canva.com/mcp sent initialize result auth-required (HTTP 401) 93 ms
- 20:01:28Z https://mcp.canva.com/mcp sent initialize result auth-required (HTTP 401) 99 ms
Authentication
| Auth type | OAuth with client registration |
|---|
| What the challenge said | Bearer realm="OAuth", resource_metadata="https://mcp.canva.com/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token" |
|---|
| Protected resource metadata | mcp.canva.com |
|---|
| Authorization server metadata | mcp.canva.com |
|---|
| Registration endpoint | https://mcp.canva.com/register |
|---|
| Client ID metadata documents | supported |
|---|
| Auth as listed by a registry | OAuth2.1 (a claim, not checked by connecting) |
|---|
The sign-in route, step by step
- Request
https://mcp.canva.com/mcp without a token. It answers 401 and a WWW-Authenticate header. - Read the protected resource metadata at
https://mcp.canva.com/.well-known/oauth-protected-resource/mcp to find the authorization server. - Register a client at the registration endpoint
https://mcp.canva.com/register (dynamic client registration), so no human has to create an app first. - Send a person through the authorization page, then retry the endpoint with the bearer token. The connector stops after step 2 and never authorizes.
See OAuth for MCP: client ID metadata documents and dynamic registration for how each route works.
CLI
| Package | @canva/cli on npm (page) |
|---|
| Exists | yes |
|---|
| Latest version | 2.17.0 |
|---|
| Last publish | 2 November 2026 |
|---|
| Command names | canva |
|---|
| Checked | 4 November 2026 |
|---|
Other agent surfaces
Agent surfaces other than MCP and CLI| Surface | Result |
|---|
| OpenAPI file | No OpenAPI file at the root paths checked. |
| WebMCP in the initial HTML | Not detected on the home page by the shared crawl. |
| MCP discovery file | Not found (the crawl got a non-200 answer). |
| A2A agent card | Not found (the crawl got a non-200 answer). |
| A2A agent card (older path) | Not found (the crawl got a non-200 answer). |
| agents.json | Not found (the crawl got a non-200 answer). |
| OAuth authorization server metadata | Found: canva.com/.well-known/oauth-authorization-server answered with a valid document in the shared crawl. |
| NLWeb endpoint | Not checked in this edition. |
Registry listings
Registry listings| Registry | Listed |
|---|
| Official MCP Registry | Yes: com.canva.mcp/mcp |
| GitHub MCP Registry | No |
| awesome-remote-mcp-servers | Yes |
| Smithery | Not checked: Smithery's listing pages and search API were unavailable on 4 November 2026. |
| Glama | Not checked: Glama's API needs a key and attribution terms. |