Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Open canonical comparison link

Comparable alternatives

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence fieldCanva Dev MCPMCP100 SelectedGitHub MCPMCP100 Selected
Task fit
Best for
  • Building Canva Apps SDK and Connect API integrations
  • Finding Canva developer documentation and App UI Kit guidance
  • Generating app scaffolds and reviewing app UI against Canva guidance
  • Repository, issue, pull-request, and code context
  • Teams that can issue a narrowly scoped PAT or use the hosted OAuth flow
  • Read-only GitHub investigation using restricted toolsets
Not ideal for
  • Creating or editing end-user Canva designs through natural language
  • Production automation that needs direct Canva account actions
  • Git hosting outside GitHub
  • Users unable to run Docker for the documented local configuration
  • Workflows that need only a small amount of public repository context
Avoid when
  • Node.js 24 or later and npm cannot be installed
  • The coding agent must not receive local app context
  • Agent-generated code would be deployed without review or normal testing
  • You cannot restrict the token to the necessary repositories and scopes
  • The agent must not receive private repository, issue, pull-request, or user data
  • Your organization has not approved the OAuth app or PAT policy
Provenance
Provenance details

First-party MCP

Canva · Publisher source ↗

First-party MCP

GitHub · Publisher source ↗

Maintenance
Maintenance details

Repo: Not documented

Package: Jul 22, 2026

Repo: Aug 14, 2026

Package: Not documented

Popularity evidence
GitHub starsNot documented

32,248

GitHub stars · checked 2026-08-14T18:46:26.000Z

Shared package downloads

10,746

Shared package downloads (not MCP-specific) · checked 2026-07-29T17:30:00.000Z

Not documented
External adoption evidence
  • npm: package downloads: 10,746Non-comparable contextual signal.npm: package downloads · Admission snapshot · checked 2026-07-29T17:30:00.000ZEvidence source ↗
  • github: repository stars: 32,248Exact attributable signal.github: repository stars · Admission snapshot · checked 2026-08-14T18:46:26.000ZEvidence source ↗
Client coverage
Client coverage details
Claude Code✓ Local stdio
Claude Desktop✓ Local stdio
Codex✓ Local stdio
VS Code✓ Local stdio
Cursor✓ Local stdio
OpenCode✓ Local stdio
Claude Code✓ Streamable HTTP
Claude Desktop✓ Streamable HTTP
Codex✓ Streamable HTTP
VS Code✓ Streamable HTTP
Cursor✓ Streamable HTTP
OpenCode✓ Streamable HTTP
Client coverage noteLocal stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
AuthenticationThe documented Dev MCP setup itself requires no Canva account login. Separate Canva CLI or Connect API workflows can require their own Canva credentials, which must not be placed in prompts.Hosted service supports OAuth; local stdio uses GITHUB_PERSONAL_ACCESS_TOKEN. GitHub recommends minimum scopes, separate tokens, rotation, and environment-variable handling.
CostCanva documents no separate Dev MCP fee. Node/npm are free; Canva developer services, the selected AI client, and model usage may have separate costs.The open-source server is MIT licensed. GitHub account, Copilot, Enterprise, Actions, API, or other product charges and limits may apply independently.
PermissionsThe local server can fetch Canva developer documentation and expose development helpers, including app generation and design-review guidance. Its effective local access also depends on the connected coding client's filesystem and command permissions.Access follows the authenticated GitHub identity and granted OAuth/PAT permissions. The server supports tool allow-lists, read-only mode, repository-oriented toolsets, and lockdown mode; write tools remain possible unless read-only mode is enabled.
Data handlingCanva states that the MCP server operates locally, fetches documentation from canva.dev and other sources, and does not transmit code or prompts anywhere other than the selected AI agent or LLM tool.Repository contents, issues, pull requests, users, actions, and other enabled GitHub API data may be returned to the MCP client. The local server passes requests to GitHub; the hosted server is operated by GitHub. Do not place PATs in committed configuration.
Limitations
Tradeoffs
  • The server runs locally and Canva says it does not transmit code or prompts beyond the chosen AI agent, but the agent itself still receives project context.
  • Using `@latest` gives current guidance but is mutable; pin an approved Canva CLI version for reproducibility.
  • Generated code and design-review advice accelerate development but do not replace API validation, tests, or app review.
  • The default local toolsets include repositories, issues, pull requests, users, and context; limiting toolsets reduces capability and context size.
  • Local Docker keeps the MCP process local but still sends authorized requests to GitHub APIs.
  • PAT setup is explicit and portable, while hosted OAuth is easier but relies on GitHub's remote MCP service.
Risk contextTreat generated code as untrusted until reviewed and tested, keep production tokens out of prompts, validate Connect API requests against official schemas, and pin the CLI for controlled environments. This is a documentary review and does not claim MCP100 execution testing.A broadly scoped token plus write-capable tools can alter repositories and collaboration records. Prefer fine-grained credentials, repository restriction, explicit toolsets, GITHUB_READ_ONLY=1, and lockdown mode where public-content prompt injection is a concern.
Evidence date
Editorial review2026-07-242026-07-24
Candidate evidence2026-07-29T20:58:26.000Z2026-08-14T18:46:26.000Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →