easygrade-canvaslms-mcp

The code uses environment variables for sensitive API keys (Canvas, Fireworks), which is good practice. Pydantic models are used for API arguments, providing some level of input validation against incorrect types. There's no explicit use of 'eval' or other highly dangerous functions. The `config.yaml` shows placeholders for API keys, which if used directly without environment variables, could lead to hardcoded secrets. The LLM-driven tool routing means that the security relies heavily on the LLM's adherence to the system prompt and the proper validation/sanitization of arguments before they are passed to the Canvas API client. While `smart_normalize_args` helps, it doesn't prevent semantically invalid inputs if the LLM misinterprets a command.