canvas-admin-roster

Canvas Admin Roster

Admin-audience skill for inspecting the Canvas account tree and making targeted enrollment changes. Walks list_accounts → list_sub_accounts → list_account_courses / list_account_users so the agent paces itself instead of dumping the whole institution at once. Write paths (enroll_user, remove_enrollment) are explicitly gated by per-action confirmation and are clearly separated from the read paths.

Prerequisites

• Canvas MCP server must be running and connected.
• Admin Canvas token required. A teacher or TA token will return empty results from list_accounts and 401/403 from list_sub_accounts, list_account_courses, list_account_users, and get_account_reports. If the user does not have an admin token, stop at Step 1 and tell them this skill needs an admin role on the relevant account.
• enroll_user and remove_enrollment additionally require permission to manage enrollments on the target course. A "subaccount admin" role may be able to read the account but not modify enrollments — the skill will surface a 403 if that happens.
• Many admin endpoints expose institution-wide data. Only run this skill in a private session.

Steps

1. Discover the Accounts You Can See

Call list_accounts. This returns every account the authenticated admin has access to — in many institutions this is just the root account, but multi-tenant Canvas deployments can return several.

If the response is empty, the token does not have admin scope. Stop here and tell the user.

Show the user the accounts with their id, name, and parent_account_id:

ACCOUNTS YOU CAN ADMIN
• [1]  Root Account (Big State University)
• [42] College of Engineering          parent: 1
• [43] College of Liberal Arts         parent: 1

2. Walk the Sub-Account Tree

Ask the user which account to drill into, or default to the root account.

For the chosen account, call list_sub_accounts with that account_id. This is shallow — it returns direct children only, not the full descendant tree. If the user wants to walk further down, repeat list_sub_accounts on each child sub-account they pick. Do not recurse the whole tree by default — large institutions can have hundreds of sub-accounts and you will burn quota.