{ "data": { "a": { "slug": "canvas-lms", "name": "Instructure Canvas", "vendor": "Instructure", "vendorUrl": "https://www.instructure.com", "kind": "http-api", "category": "learning", "summary": "Canvas is Instructure's learning management system for schools and universities. Its REST and GraphQL APIs read and change courses, assignments, quizzes, submissions and grades on an institution's Canvas domain, with OAuth2 developer keys its administrators issue and scope.", "url": "https://www.anchorterminal.com/tools/canvas-lms", "markdownUrl": "https://www.anchorterminal.com/tools/canvas-lms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/canvas-lms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/canvas-lms.json", "dns": "canvas-lms.grade.anchorterminal.com", "repo": "https://github.com/instructure/canvas-lms", "license": "AGPL-3.0 (Canvas LMS source); hosted service proprietary", "transports": [ "http" ], "remoteUrl": "https://\u003cinstitution\u003e.instructure.com/api/v1", "packages": [], "auth": "oauth", "authNotes": "OAuth2 against the institution's Canvas domain. A developer key (client ID and secret) is created by a root account administrator, or by Instructure as a global key an administrator enables, and can be scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints; tokens for keys issued since October 2015 expire after 1 hour and are renewed with a refresh token. A person can also generate a manual access token in their profile for testing, and the API policy forbids asking other users to paste such tokens into an app. Tokens go in the Authorization header; passing `access_token` as a query parameter is supported but discouraged (https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth.md).", "pricing": "paid", "pricingNotes": "No public price. Canvas is sold to institutions by contract through Instructure's sales team, with tiers compared on the Canvas tiers page. The free Canvas Lite account for individual educators (terms effective 30 September 2026) is limited to 500MB, five published courses and 50 students a course, and its terms say it does not include API token access (https://www.instructure.com/policies/canvas-lite-terms-conditions).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Canvas API docs, the API policy or the OAuth2 guide (checked 2026-11-03).", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developerdocs.instructure.com/services/canvas", "llmsTxt": "https://developerdocs.instructure.com/llms.txt", "capabilities": [ "learning.lms", "learning.courses", "learning.quiz", "learning.progress" ], "tags": [ "hosted", "official", "oauth", "open-source", "paid", "sales-led", "llms-txt", "graphql", "status-page", "security-txt", "bug-bounty" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 59.5, "grade": "C", "agentReady": false, "rank": 622, "ranked": true, "rankOf": 1349, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 72, "payments": 0, "reliability": 63, "schema": 77, "security": 61, "transparency": 82 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A wide REST and GraphQL API over an institution's courses, assignments, quizzes, submissions and grades, with scoped OAuth2 developer keys, Link-header paging, a 90-day deprecation policy and a dated change log. Access depends on an institution's administrator issuing a key, there is no public price or sandbox, and the API policy bars unapproved MCP connections.", "bestFor": "An agent acting for a teacher, student or administrator inside an institution that has issued a key, reading assignments and grades or creating course content.", "strengths": [ "REST API over courses, modules, assignments, quizzes, submissions, grades and users, plus a GraphQL endpoint with a GraphiQL explorer", "Developer keys scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints, 1-hour access tokens with refresh, and keys controlled by the institution's administrators", "API policy requires 90 days' notice before removing an endpoint or field, with a change log dated by announcement", "Statuspage with component history, llms.txt on the developer docs, and security.txt valid to 1 January 2027 with a Bugcrowd disclosure programme", "Canvas LMS source under AGPL-3.0, from which the API reference and an OpenAPI 3.0 file are generated" ], "weaknesses": [ "An agent needs a developer key or OAuth grant from the institution's root administrator; Canvas Lite's terms exclude API token access", "No public price, trial or sandbox for the API, and the 2026 API policy forbids connecting through MCP servers Instructure has not approved", "Throttling is cost-based with no published quota, 429s carry no Retry-After, and no idempotency keys are documented for writes", "25 status entries in 90 days, including hour-plus login, MFA and regional outages for some users", "No hosted OpenAPI file or official REST SDK found; the OpenAPI file has to be generated from the source, whose public mirror stopped in May 2026" ], "agentNotes": [ "Ask the institution's Canvas administrator for a scoped developer key, or run the OAuth2 flow on the institution's own domain; never ask users to paste manual access tokens", "Send the token only in the Authorization header, follow the opaque Link headers for paging and set per_page rather than guessing page counts", "Watch X-Request-Cost and X-Rate-Limit-Remaining, keep to one request at a time, and on 429 wait before retrying", "Check the API policy before wiring Canvas into an MCP server; it prohibits connections through MCP servers Instructure has not approved", "Use the GraphQL endpoint at /api/graphql when you need a few fields from many objects, since REST responses have no field selection" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.5 } ], "editorialScores": { "ergonomics": 63, "maintenance": 72, "payments": 0, "reliability": 63, "schema": 77, "security": 61, "transparency": 71 }, "provenanceScore": 93, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -H \"Authorization: Bearer \u003cACCESS_TOKEN\u003e\" \"https://\u003cinstitution\u003e.instructure.com/api/v1/courses?per_page=50\"" }, "letme": { "capability": "https://letme.dev/learning.lms", "tool": "https://letme.dev/canvas-lms" }, "area": "everyday", "provenance": { "legalEntity": "Instructure, Inc.", "domain": "instructure.com", "domainRegistered": "1998-02-25", "endpointOnVendorDomain": true, "terms": "https://www.instructure.com/policies/terms-of-use", "privacy": "https://www.instructure.com/policies/privacy", "statusPage": "https://status.instructure.com", "changelog": "https://community.instructure.com/en/categories/canvas-lms-changelog", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The terms of use (effective 12 August 2025) and the API policy (effective 12 August 2025) name Instructure, Inc. and its affiliates; the privacy notice (effective 10 July 2026) also names Instructure Global Ltd. in London.", "The terms of use bar accessing or creating accounts by any means other than the publicly supported interfaces, naming scraping; the API is one of those interfaces under the API policy.", "developerdocs.instructure.com/robots.txt allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes. status.instructure.com disallows /api/ and /embed/, so the history was read from /history.atom. community.instructure.com disallows search, messages and paged category listings. canvas.instructure.com answered 503 to robots.txt and was not read.", "RDAP at Verisign gives instructure.com a registration date of 25 February 1998.", "security.txt at www.instructure.com/.well-known/security.txt names security@instructure.com, the vulnerability disclosure page and a PGP key, with Expires 1 January 2027.", "The developer docs pages carry text addressed to agents, asking them to query a GitBook endpoint; it was read as data and not acted on." ], "score": 93 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/canvas-lms.json", "live": { "slug": "canvas-lms", "probe": { "target": "https://\u003cinstitution\u003e.instructure.com/api/v1", "method": "get", "lastAt": "2026-11-04T19:34:26.664413251Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 43, "samples30d": 43, "days": [ { "date": "2026-11-04", "probes": 43, "ok": 0 } ], "outages": [ { "start": "2026-11-04T15:25:14.852879587Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "vendorStatus": { "page": "https://status.instructure.com", "indicator": "minor", "summary": "Minor Service Outage", "checkedAt": "2026-11-04T19:31:06.18345823Z" }, "securityTxt": { "url": "https://instructure.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-01T00:00:00z", "checkedAt": "2026-11-04T15:54:37.398266631Z" }, "updatedAt": "2026-11-04T19:34:26.664413251Z" } }, "answer": "Moodle scores 67.7 (B) on agent readiness against Instructure Canvas's 59.5 (C), and leads in 4 of 7 scored categories. Instructure Canvas leads on schema \u0026 documentation, agent ergonomics and transparency \u0026 trust.", "b": { "slug": "moodle", "name": "Moodle", "vendor": "Moodle Pty Ltd", "vendorUrl": "https://moodle.com", "kind": "http-api", "category": "learning", "summary": "Moodle is an open-source learning management system that schools and companies run themselves or through MoodleCloud. Its web services expose 800 functions for courses, quizzes, assignments and grades, and Moodle 5.3 adds a scoped REST API with personal access tokens.", "url": "https://www.anchorterminal.com/tools/moodle", "markdownUrl": "https://www.anchorterminal.com/tools/moodle.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/moodle.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/moodle.json", "dns": "moodle.grade.anchorterminal.com", "repo": "https://github.com/moodle/moodle", "license": "GPL-3.0-or-later", "transports": [ "http" ], "remoteUrl": "https://\u003csite\u003e/webservice/rest/server.php", "packages": [], "auth": "mixed", "authNotes": "Classic web services use a token tied to a user and a service. An administrator enables web services and the REST protocol, creates a service with chosen functions, authorises users and makes the token under Manage tokens, with optional IP restriction and a valid-until date; users with the capability can also fetch one from login/token.php with a username and password. The token travels as the `wstoken` parameter in the query string or POST body. Moodle 5.3 (5 October 2026) adds a REST API at /api/rest/v2 with personal access tokens (scoped, expiring after 7 days to 1 year, shown once, revocable, with last-use IP) and OAuth 2 clients an administrator registers, enforced by scopes such as core_user:user:read in addition to capabilities (https://docs.moodle.org/503/en/REST_API_tokens).", "pricing": "free", "pricingNotes": "Moodle LMS is free software under GPL-3.0-or-later, installed and run by the owner. Moodle Pty Ltd's hosted MoodleCloud plans are public, billed yearly in Australian dollars, from Starter at AUD 230 (USD 160) a year for 50 users and 1GB to Standard at AUD 3,000 (USD 2,090) for 750 users and 50GB, with a 28-day trial of Starter that needs no card; MoodleCloud sites cannot install plugins, and whether they allow web services was not established. Partner hosting is quoted (https://www.moodlecloud.com/standard-plans/).", "priceSummary": "Free · OSS", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the web services documentation, the routing and scopes docs or MoodleCloud's pages (checked 2026-11-03).", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://moodledev.io/docs/6.0/apis/subsystems/external", "capabilities": [ "learning.lms", "learning.courses", "learning.quiz", "learning.progress" ], "tags": [ "self-hosted", "open-source", "official", "free", "oauth", "security-txt", "gpl" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 67.7, "grade": "B", "agentReady": false, "rank": 280, "ranked": true, "rankOf": 1349, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 81, "payments": 60, "reliability": 80, "schema": 66, "security": 67, "transparency": 76 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "Free GPL software with about 800 typed web service functions over courses, quizzes, assignments and grades, a six-monthly release train with dated security advisories, and in 5.3 a scoped REST API with expiring tokens. An administrator must enable the services and issue tokens, the classic token travels in the query string, and no public OpenAPI file exists without a site.", "bestFor": "An agent working inside an institution or company that runs Moodle and can get a scoped token, reading course content, quiz attempts, assignments and grades or writing grades and enrolments.", "strengths": [ "About 800 to 900 external functions with typed, described parameters and returns, generated into a reference on every site", "Moodle 5.3 adds personal access tokens with scopes and 7-day to 1-year expiry, OAuth 2 clients and a SwaggerUI for the new REST API", "Services can expose only chosen functions to authorised users, with IP restriction and expiry on tokens", "Releases every April and October, point releases every two months, 5.3 LTS supported with security fixes to October 2029", "Ten dated security advisories with CVEs between 9 September and 15 October 2026, under GPL-3.0-or-later source" ], "weaknesses": [ "A site administrator has to enable web services, build a service and issue a token before any call; nothing is self-serve", "The classic token goes in the `wstoken` query or POST parameter, is all-powerful within the user's capabilities and has no scopes", "No public OpenAPI or llms.txt; the machine-readable reference exists only inside a running site", "The 5.3 REST API reaches only a few parts of Moodle, so most work still goes through the classic functions", "No official client SDK or MCP server from Moodle HQ; sample clients and community servers only" ], "agentNotes": [ "Ask the site administrator for a token on a custom service limited to the functions you need, with an IP restriction and a valid-until date; don't use the mobile service token for broader work", "Call https://\u003csite\u003e/webservice/rest/server.php with wsfunction, wstoken and moodlewsrestformat=json, sending the token in the POST body rather than the URL", "On a 5.3 site, prefer a personal access token or OAuth 2 client for the /api/rest/v2 routes it covers, and expect an access_denied error naming the missing scope", "Read each function's parameters in the site's API Documentation page; array parameters are flattened as users[0][username] in REST", "Check the site's Moodle version and the upgrade notes before relying on a function; deprecated external functions are removed outright" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.7 } ], "editorialScores": { "ergonomics": 49, "maintenance": 81, "payments": 60, "reliability": 80, "schema": 66, "security": 67, "transparency": 76 }, "provenanceScore": 76, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -X POST \"https://\u003csite\u003e/webservice/rest/server.php\" -d wstoken=\u003cTOKEN\u003e -d wsfunction=core_course_get_courses -d moodlewsrestformat=json" }, "letme": { "capability": "https://letme.dev/learning.lms", "tool": "https://letme.dev/moodle" }, "area": "everyday", "unitPrices": [ { "item": "MoodleCloud Starter (50 users, 1GB), yearly", "unit": "month", "usd": 13.33, "note": "USD 160 a year (AUD 230); hosted by Moodle Pty Ltd, plugins not installable" }, { "item": "MoodleCloud Standard (750 users, 50GB), yearly", "unit": "month", "usd": 174.17, "note": "USD 2,090 a year (AUD 3,000)" } ], "provenance": { "legalEntity": "Moodle Pty Ltd", "domain": "moodle.org", "domainRegistered": "2002-04-02", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://moodle.com/privacy-notice/", "statusPage": "https://status.moodlecloud.com", "changelog": "https://moodledev.io/general/releases", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "Moodle Pty Ltd is named in the privacy notice (last updated October 2025, PO Box 303, West Perth) and in the trademark notice on moodle.com. The software licence is GPL-3.0-or-later, which stands in for terms; no terms of service for self-hosted use exist, and MoodleCloud's site links only cookie, privacy and trademark policies.", "The privacy notice links a standard data processing agreement (February 2026 PDF) and a register of GDPR information, and names dpo@moodle.com and privacy@moodle.com.", "moodle.org/.well-known/security.txt names the report form at moodle.org/security/report/ and the policy at moodledev.io/general/development/process/security, with Expires 10 May 2027.", "moodle.org/robots.txt disallows search pages and /plugins/*/*, sets Content-Signal ai-train=no, search=yes, ai-input=no and asks for a 10-second crawl delay; docs.moodle.org asks for 5 seconds. Both were followed. moodledev.io, moodle.com and www.moodlecloud.com allow all.", "The endpoint sits on each owner's own site, not on a Moodle domain, so endpointOnVendorDomain is false. status.moodlecloud.com (Uptime Kuma) covers MoodleCloud only.", "RDAP at Public Interest Registry gives moodle.org a registration date of 2 April 2002; moodle.com dates from 22 February 1999." ], "score": 76 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/moodle.json", "live": { "slug": "moodle", "probe": { "target": "https://\u003csite\u003e/webservice/rest/server.php", "method": "get", "lastAt": "2026-11-04T19:34:55.482445256Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 43, "samples30d": 43, "days": [ { "date": "2026-11-04", "probes": 43, "ok": 0 } ], "outages": [ { "start": "2026-11-04T15:25:33.426772381Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "vendorStatus": { "page": "https://status.moodlecloud.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:09.831975618Z" }, "securityTxt": { "url": "https://moodle.org/.well-known/security.txt", "state": "valid", "expires": "2027-05-10T01:00:00.000Z", "checkedAt": "2026-11-04T15:54:22.866105142Z" }, "updatedAt": "2026-11-04T19:34:55.482445256Z" } }, "edges": [ { "by": 60, "category": "payments", "leads": "moodle", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.", "b": "Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60." }, "scores": { "a": 0, "b": 60 } }, { "by": 17, "category": "reliability", "leads": "moodle", "name": "Reliability", "reasons": { "a": "Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with \"retry later\", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.", "b": "Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80." }, "scores": { "a": 63, "b": 80 } }, { "by": 14, "category": "ergonomics", "leads": "canvas-lms", "name": "Agent ergonomics", "reasons": { "a": "include[] parameters and per_page size REST responses, and GraphQL selects fields (22 of 25). Link-header paging on every list, with filters such as enrollment_type and state on courses (20). Error bodies are a JSON errors array, documented per endpoint rather than centrally, and 401 with WWW-Authenticate for expired tokens is explained (10 of 20). No idempotency keys; reads are safe to repeat and writes are not addressed (5 of 20). Few required parameters per call, but no official REST SDK (community libraries only) and the official client is the DAP CLI for data exports (6 of 15). 22 + 20 + 10 + 5 + 6 = 63.", "b": "About 800 to 900 functions, but a service can expose only the functions an agent needs and each call names one function, so the working set is small (20 of 25). Paging and filtering vary by function; course and user lookups take criteria and some take limits, read only in the catalogue (10 of 20). The REST protocol returns an exception, errorcode and message object on failure, and the 5.3 API returns OAuth2 access_denied with a hint naming the missing scope; the classic shape was not read first-hand on this pass (8 of 20). No idempotency keys; many functions are creates and updates (5 of 20). Required parameters vary by function; no official SDK, only sample clients and community libraries (6 of 15). 20 + 10 + 8 + 5 + 6 = 49." }, "scores": { "a": 63, "b": 49 } }, { "by": 11, "category": "schema", "leads": "canvas-lms", "name": "Schema \u0026 documentation", "reasons": { "a": "An OpenAPI 3.0 file is generated from the source with `rake doc:openapi`, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as \"429 Forbidden (Rate Limit Exceeded)\" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.", "b": "Function definitions are machine-readable inside a site (the generated API Documentation page for classic functions, SwaggerUI for the 5.3 REST API), but no OpenAPI or similar file is published without a site (15 of 25). No llms.txt on moodledev.io or docs.moodle.org (0). Each function and parameter carries a description, and the developer docs explain when to write a service and how to validate context (14 of 20). PARAM_* types, required, optional and default flags, nested structures, and scope declarations on 5.3 routes (13 of 15). curl samples and sample clients in several languages, but the error response shape was not documented on the pages read (9 of 15). Release notes per version, an \"introduced in\" column in the function list and a written deprecation policy (15). 15 + 0 + 14 + 13 + 9 + 15 = 66." }, "scores": { "a": 77, "b": 66 } }, { "by": 9, "category": "maintenance", "leads": "moodle", "name": "Maintenance \u0026 community", "reasons": { "a": "Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.", "b": "Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81." }, "scores": { "a": 72, "b": 81 } }, { "by": 6, "category": "security", "leads": "moodle", "name": "Security \u0026 auth", "reasons": { "a": "OAuth2 with developer keys scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but `access_token` as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.", "b": "Two credential models. The classic token is one secret per user and service with no scopes, documented in the `wstoken` query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67." }, "scores": { "a": 61, "b": 67 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Instructure", "b": "Moodle Pty Ltd", "name": "Vendor" }, { "a": "https://\u003cinstitution\u003e.instructure.com/api/v1", "b": "https://\u003csite\u003e/webservice/rest/server.php", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "AGPL-3.0 (Canvas LMS source); hosted service proprietary", "b": "GPL-3.0-or-later", "name": "Licence" }, { "a": "0", "b": "0", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-27", "b": "2026-10-05", "name": "Last release" }, { "a": "no date given", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "2025-10-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "yes", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" } ], "faq": [ { "answer": "Moodle scores 67.7 (B) on agent readiness against Instructure Canvas's 59.5 (C), and leads in 4 of 7 scored categories. Instructure Canvas leads on schema \u0026 documentation, agent ergonomics and transparency \u0026 trust.", "question": "Which is better for AI agents, Instructure Canvas or Moodle?" }, { "answer": "Instructure Canvas uses an OAuth sign-in. Moodle takes an API key or an OAuth sign-in.", "question": "Do Instructure Canvas and Moodle need an API key?" }, { "answer": "Yes. Instructure Canvas has a hosted endpoint at https://\u003cinstitution\u003e.instructure.com/api/v1 and Moodle at https://\u003csite\u003e/webservice/rest/server.php.", "question": "Can an agent call Instructure Canvas and Moodle without installing anything?" }, { "answer": "Yes. Instructure Canvas is open source (AGPL-3.0 (Canvas LMS source); hosted service proprietary). Moodle is open source (GPL-3.0-or-later).", "question": "Are Instructure Canvas and Moodle open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 77 against 66", "Agent ergonomics, 63 against 49", "Transparency \u0026 trust, 82 against 76" ], "also": null, "goodFor": "An agent acting for a teacher, student or administrator inside an institution that has issued a key, reading assignments and grades or creating course content.", "slug": "canvas-lms", "watchFor": "An agent needs a developer key or OAuth grant from the institution's root administrator; Canvas Lite's terms exclude API token access" }, { "aheadOn": [ "Reliability, 80 against 63", "Security \u0026 auth, 67 against 61", "Payments \u0026 pricing, 60 against 0", "Maintenance \u0026 community, 81 against 72" ], "also": null, "goodFor": "An agent working inside an institution or company that runs Moodle and can get a scoped token, reading course content, quiz attempts, assignments and grades or writing grades and enrolments.", "slug": "moodle", "watchFor": "A site administrator has to enable web services, build a service and issue a token before any call; nothing is self-serve" } ], "history": null, "job": { "capability": "learning.lms", "name": "Learning lms" }, "others": [ { "json": "https://www.anchorterminal.com/compare/canvas-lms-vs-learnosity.json", "title": "Instructure Canvas vs Learnosity", "url": "https://www.anchorterminal.com/compare/canvas-lms-vs-learnosity" }, { "json": "https://www.anchorterminal.com/compare/canvas-lms-vs-quizgecko.json", "title": "Instructure Canvas vs Quizgecko", "url": "https://www.anchorterminal.com/compare/canvas-lms-vs-quizgecko" }, { "json": "https://www.anchorterminal.com/compare/kahoot-vs-moodle.json", "title": "Kahoot! vs Moodle", "url": "https://www.anchorterminal.com/compare/kahoot-vs-moodle" }, { "json": "https://www.anchorterminal.com/compare/learnosity-vs-moodle.json", "title": "Learnosity vs Moodle", "url": "https://www.anchorterminal.com/compare/learnosity-vs-moodle" }, { "json": "https://www.anchorterminal.com/compare/moodle-vs-quizgecko.json", "title": "Moodle vs Quizgecko", "url": "https://www.anchorterminal.com/compare/moodle-vs-quizgecko" }, { "json": "https://www.anchorterminal.com/compare/canvas-lms-vs-kahoot.json", "title": "Instructure Canvas vs Kahoot!", "url": "https://www.anchorterminal.com/compare/canvas-lms-vs-kahoot" } ], "panel": null, "scores": [ { "by": 17, "canvas-lms": 63, "edge": "moodle", "key": "reliability", "moodle": 80, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 11, "canvas-lms": 77, "edge": "canvas-lms", "key": "schema", "moodle": 66, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 14, "canvas-lms": 63, "edge": "canvas-lms", "key": "ergonomics", "moodle": 49, "name": "Agent ergonomics", "weight": 13 }, { "by": 6, "canvas-lms": 61, "edge": "moodle", "key": "security", "moodle": 67, "name": "Security \u0026 auth", "weight": 14 }, { "by": 60, "canvas-lms": 0, "edge": "moodle", "key": "payments", "moodle": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 9, "canvas-lms": 72, "edge": "moodle", "key": "maintenance", "moodle": 81, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 6, "canvas-lms": 82, "edge": "canvas-lms", "key": "transparency", "moodle": 76, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Moodle scores 67.7 (B) on agent readiness against Instructure Canvas's 59.5 (C), and leads in 4 of 7 scored categories. Instructure Canvas leads on schema \u0026 documentation, agent ergonomics and transparency \u0026 trust. Both do learning lms.", "tasks": null, "tutorials": [], "verdicts": { "canvas-lms": "A wide REST and GraphQL API over an institution's courses, assignments, quizzes, submissions and grades, with scoped OAuth2 developer keys, Link-header paging, a 90-day deprecation policy and a dated change log. Access depends on an institution's administrator issuing a key, there is no public price or sandbox, and the API policy bars unapproved MCP connections.", "moodle": "Free GPL software with about 800 typed web service functions over courses, quizzes, assignments and grades, a six-monthly release train with dated security advisories, and in 5.3 a scoped REST API with expiring tokens. An administrator must enable the services and issue tokens, the classic token travels in the query string, and no public OpenAPI file exists without a site." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/canvas-lms-vs-moodle", "json": "https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.min.md" }, "markdown": "Moodle scores 67.7 (B) on agent readiness against Instructure Canvas's 59.5 (C), and leads in 4 of 7 scored categories. Instructure Canvas leads on schema \u0026 documentation, agent ergonomics and transparency \u0026 trust. Both do learning lms.\n\n- Instructure Canvas: grade C, 59.5/100, rank #622 of 1349. Markdown https://www.anchorterminal.com/tools/canvas-lms.md · JSON https://www.anchorterminal.com/api/v1/tools/canvas-lms.json\n- Moodle: grade B, 67.7/100, rank #280 of 1349. Markdown https://www.anchorterminal.com/tools/moodle.md · JSON https://www.anchorterminal.com/api/v1/tools/moodle.json\n- Best learning, tutoring and assessment tools for AI agents: https://www.anchorterminal.com/best/learning/index.md\n- All 10 learning comparisons: https://www.anchorterminal.com/compare/learning/index.md\n\n## Which one, for what\n\n### Instructure Canvas (C)\n\nGood for: An agent acting for a teacher, student or administrator inside an institution that has issued a key, reading assignments and grades or creating course content.\n\nAhead on:\n- Schema \u0026 documentation, 77 against 66\n- Agent ergonomics, 63 against 49\n- Transparency \u0026 trust, 82 against 76\n\nWatch for: An agent needs a developer key or OAuth grant from the institution's root administrator; Canvas Lite's terms exclude API token access\n\n### Moodle (B)\n\nGood for: An agent working inside an institution or company that runs Moodle and can get a scoped token, reading course content, quiz attempts, assignments and grades or writing grades and enrolments.\n\nAhead on:\n- Reliability, 80 against 63\n- Security \u0026 auth, 67 against 61\n- Payments \u0026 pricing, 60 against 0\n- Maintenance \u0026 community, 81 against 72\n\nWatch for: A site administrator has to enable web services, build a service and issue a token before any call; nothing is self-serve\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Moodle +60\n\n- Instructure Canvas (0): Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.\n- Moodle (60): Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60.\n\n### Reliability: Moodle +17\n\n- Instructure Canvas (63): Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with \"retry later\", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.\n- Moodle (80): Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80.\n\n### Agent ergonomics: Instructure Canvas +14\n\n- Instructure Canvas (63): include[] parameters and per_page size REST responses, and GraphQL selects fields (22 of 25). Link-header paging on every list, with filters such as enrollment_type and state on courses (20). Error bodies are a JSON errors array, documented per endpoint rather than centrally, and 401 with WWW-Authenticate for expired tokens is explained (10 of 20). No idempotency keys; reads are safe to repeat and writes are not addressed (5 of 20). Few required parameters per call, but no official REST SDK (community libraries only) and the official client is the DAP CLI for data exports (6 of 15). 22 + 20 + 10 + 5 + 6 = 63.\n- Moodle (49): About 800 to 900 functions, but a service can expose only the functions an agent needs and each call names one function, so the working set is small (20 of 25). Paging and filtering vary by function; course and user lookups take criteria and some take limits, read only in the catalogue (10 of 20). The REST protocol returns an exception, errorcode and message object on failure, and the 5.3 API returns OAuth2 access_denied with a hint naming the missing scope; the classic shape was not read first-hand on this pass (8 of 20). No idempotency keys; many functions are creates and updates (5 of 20). Required parameters vary by function; no official SDK, only sample clients and community libraries (6 of 15). 20 + 10 + 8 + 5 + 6 = 49.\n\n### Schema \u0026 documentation: Instructure Canvas +11\n\n- Instructure Canvas (77): An OpenAPI 3.0 file is generated from the source with `rake doc:openapi`, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as \"429 Forbidden (Rate Limit Exceeded)\" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.\n- Moodle (66): Function definitions are machine-readable inside a site (the generated API Documentation page for classic functions, SwaggerUI for the 5.3 REST API), but no OpenAPI or similar file is published without a site (15 of 25). No llms.txt on moodledev.io or docs.moodle.org (0). Each function and parameter carries a description, and the developer docs explain when to write a service and how to validate context (14 of 20). PARAM_* types, required, optional and default flags, nested structures, and scope declarations on 5.3 routes (13 of 15). curl samples and sample clients in several languages, but the error response shape was not documented on the pages read (9 of 15). Release notes per version, an \"introduced in\" column in the function list and a written deprecation policy (15). 15 + 0 + 14 + 13 + 9 + 15 = 66.\n\n### Maintenance \u0026 community: Moodle +9\n\n- Instructure Canvas (72): Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.\n- Moodle (81): Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81.\n\n### Security \u0026 auth: Moodle +6\n\n- Instructure Canvas (61): OAuth2 with developer keys scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but `access_token` as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.\n- Moodle (67): Two credential models. The classic token is one secret per user and service with no scopes, documented in the `wstoken` query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67.\n\n## Score by category\n\n| Category | Weight | Instructure Canvas | Moodle | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 63 | 80 | Moodle +17 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 66 | Instructure Canvas +11 |\n| Agent ergonomics | 13% (16.2 this run) | 63 | 49 | Instructure Canvas +14 |\n| Security \u0026 auth | 14% (17.5 this run) | 61 | 67 | Moodle +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 0 | 60 | Moodle +60 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 81 | Moodle +9 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 82 | 76 | Instructure Canvas +6 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **59.5 · C** | **67.7 · B** | |\n\n## Facts side by side\n\n| Fact | Instructure Canvas | Moodle |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Instructure | Moodle Pty Ltd |\n| Hosted endpoint | `https://\u003cinstitution\u003e.instructure.com/api/v1` | `https://\u003csite\u003e/webservice/rest/server.php` |\n| Transports | HTTP | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Paid | Free |\n| x402 | no | no |\n| Licence | AGPL-3.0 (Canvas LMS source); hosted service proprietary | GPL-3.0-or-later |\n| Tools exposed | 0 | 0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-27 | 2026-10-05 |\n| Terms last updated | no date given | no document linked |\n| Privacy policy last updated | no date given | 2025-10-01 |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | yes | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n\n## Verdicts\n\n**Instructure Canvas.** A wide REST and GraphQL API over an institution's courses, assignments, quizzes, submissions and grades, with scoped OAuth2 developer keys, Link-header paging, a 90-day deprecation policy and a dated change log. Access depends on an institution's administrator issuing a key, there is no public price or sandbox, and the API policy bars unapproved MCP connections.\n\n**Moodle.** Free GPL software with about 800 typed web service functions over courses, quizzes, assignments and grades, a six-monthly release train with dated security advisories, and in 5.3 a scoped REST API with expiring tokens. An administrator must enable the services and issue tokens, the classic token travels in the query string, and no public OpenAPI file exists without a site.\n\n## Before you call either\n\n### Instructure Canvas\n\n1. Ask the institution's Canvas administrator for a scoped developer key, or run the OAuth2 flow on the institution's own domain; never ask users to paste manual access tokens\n2. Send the token only in the Authorization header, follow the opaque Link headers for paging and set per_page rather than guessing page counts\n3. Watch X-Request-Cost and X-Rate-Limit-Remaining, keep to one request at a time, and on 429 wait before retrying\n4. Check the API policy before wiring Canvas into an MCP server; it prohibits connections through MCP servers Instructure has not approved\n5. Use the GraphQL endpoint at /api/graphql when you need a few fields from many objects, since REST responses have no field selection\n\n### Moodle\n\n1. Ask the site administrator for a token on a custom service limited to the functions you need, with an IP restriction and a valid-until date; don't use the mobile service token for broader work\n2. Call https://\u003csite\u003e/webservice/rest/server.php with wsfunction, wstoken and moodlewsrestformat=json, sending the token in the POST body rather than the URL\n3. On a 5.3 site, prefer a personal access token or OAuth 2 client for the /api/rest/v2 routes it covers, and expect an access_denied error naming the missing scope\n4. Read each function's parameters in the site's API Documentation page; array parameters are flattened as users[0][username] in REST\n5. Check the site's Moodle version and the upgrade notes before relying on a function; deprecated external functions are removed outright\n\n## Questions\n\n### Which is better for AI agents, Instructure Canvas or Moodle?\n\nMoodle scores 67.7 (B) on agent readiness against Instructure Canvas's 59.5 (C), and leads in 4 of 7 scored categories. Instructure Canvas leads on schema \u0026 documentation, agent ergonomics and transparency \u0026 trust.\n\n### Do Instructure Canvas and Moodle need an API key?\n\nInstructure Canvas uses an OAuth sign-in. Moodle takes an API key or an OAuth sign-in.\n\n### Can an agent call Instructure Canvas and Moodle without installing anything?\n\nYes. Instructure Canvas has a hosted endpoint at https://\u003cinstitution\u003e.instructure.com/api/v1 and Moodle at https://\u003csite\u003e/webservice/rest/server.php.\n\n### Are Instructure Canvas and Moodle open source?\n\nYes. Instructure Canvas is open source (AGPL-3.0 (Canvas LMS source); hosted service proprietary). Moodle is open source (GPL-3.0-or-later).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.json, and with the fewest tokens: https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"canvas-lms\", \"b\": \"moodle\"}`. From a terminal: `anchor compare canvas-lms moodle`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/canvas-lms.json and https://www.anchorterminal.com/api/v1/tools/moodle.json\n\n## Other comparisons with Instructure Canvas or Moodle\n\n- [Instructure Canvas vs Learnosity](https://www.anchorterminal.com/compare/canvas-lms-vs-learnosity.md)\n- [Instructure Canvas vs Quizgecko](https://www.anchorterminal.com/compare/canvas-lms-vs-quizgecko.md)\n- [Kahoot! vs Moodle](https://www.anchorterminal.com/compare/kahoot-vs-moodle.md)\n- [Learnosity vs Moodle](https://www.anchorterminal.com/compare/learnosity-vs-moodle.md)\n- [Moodle vs Quizgecko](https://www.anchorterminal.com/compare/moodle-vs-quizgecko.md)\n- [Instructure Canvas vs Kahoot!](https://www.anchorterminal.com/compare/canvas-lms-vs-kahoot.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Instructure Canvas vs Moodle", "url": "" } ], "description": "Moodle scores 67.7 (B) to Instructure Canvas's 59.5 (C) for learning lms. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Instructure Canvas C 59.5", "Moodle B 67.7", "scores" ], "h1": "Instructure Canvas vs Moodle", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/canvas-lms-vs-moodle", "published": "2026-10-01", "section": "tools", "title": "Instructure Canvas vs Moodle for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/canvas-lms-vs-moodle" }, "tokens": { "markdown": 4550, "slim": 3030 }, "version": 1 }