canvas-pii-guard

garris-canvas-tools — Canvas tools for instructors (Claude Code)

Two Claude Code plugins for MGCCC instructors. Built and tested on the MGCCC Canvas instance; they reuse cleanly for any Canvas school after a few setting tweaks.

Plugin	What it does
courseforge	Builds Canvas course content — migrated from a Notion course or generated on request — as styled, sanitizer-safe pages, weekly modules, and (optionally) graded assignments/discussions/quizzes. Idempotent re-runs. Content-first: it does not read student data in normal use and refuses ad-hoc roster/grade/submission access. It adds one opt-in blind-grading flow (a sterilizing + pseudonymizing gateway: identities stay local, you grade pseudonymized text, a dry-run-first poster writes grades back).
canvas-pii-guard	A local data-protection layer: PreToolUse hooks that block Canvas student-data API calls (rosters/grades/submissions) and local-cache reads before they run, so student PII is never fetched or sent. Plus a best-effort output scrubber tuned to MGCCC ID formats. Install it alongside courseforge.

Not included here: the full admin/grading tool that intentionally reads student submissions with real identities. That stays on admin machines only. What this repo's content plugin does include is an opt-in blind-grading path that keeps identities local and only shows the model pseudonymized, scrubbed submission text (best-effort de-identification, not a guarantee — see Student data security below).

Requirements

• Claude Code (custom skills/plugins are not available in the claude.ai web app or Claude Desktop).
• PowerShell (Windows PowerShell 5.1 is fine).
• A Canvas API access token for your own account, plus your course base URL + id.
• For Notion-sourced builds only: a connected Notion MCP connector.

Install

Install both plugins from the marketplace. The safety layer (canvas-pii-guard) is a hooks plugin — it must be registered with Claude Code, which a manual folder copy cannot do. In Claude Code, type these three lines (one at a time):

/plugin marketplace add billathekilla737/garris-canvas-tools
/plugin install courseforge@garris-canvas-tools
/plugin install canvas-pii-guard@garris-canvas-tools

You'll get a trust prompt on install — review the scripts, then approve. Fully restart Claude Code so the skills and hooks load.

Install both. courseforge builds your courses; canvas-pii-guard is the local block that actually enforces the no-student-data guarantee. Installing courseforge alone leaves that protection off.

Verify it worked (after restart) — ask Claude:

"Is canvas-pii-guard active, and do you have the courseforge skill?"

It should confirm the courseforge skill is available and that the PII-guard PreToolUse hook is registered. If the guard isn't active, re-run the third command.

If /plugin isn't available (SDK harness, automation)

Some surfaces — the Claude Agent SDK harness, headless/automation runs — can't load the plugin marketplace and will say /plugin "isn't available in this environment." For those, run the bundled installer instead. Crucially, it does what a bare folder copy could not: it registers the canvas-pii-guard hooks into settings.json, so the safety block is never left off. It's idempotent, merges into any existing settings.json (writing a .bak first), and runs the 51-check guard suite at the end.

git clone https://github.com/billathekilla737/garris-canvas-tools "$env:TEMP\garris-canvas-tools"
powershell -NoProfile -ExecutionPolicy Bypass -File "$env:TEMP\garris-canvas-tools\Install-CourseForge.ps1"

An AI assistant can run those two lines for you (they're ordinary commands, not slash commands). See AGENT-INSTALL-PROMPT.md for a paste-ready prompt.

⚠️ Do not hand-copy just the skill folder into ~/.claude/skills/ — that installs only the content skill and leaves the safety hooks uninstalled. Use the marketplace commands, or Install-CourseForge.ps1, both of which register the hooks.

First-time setup (each instructor)

The easy way (recommended): in your course folder, ask Claude to "set up my Canvas" (or run scripts\Setup-Canvas.ps1). It asks two questions — your course web address and your access token (typed hidden) — and does everything else: saves the token correctly, writes the config, protects it with .gitignore, and tests the connection, printing your course name when it works. No file paths, no file-extension headaches. To get the token: Canvas → Account → Settings → New Access Token, then paste it when asked.