ModelsAtlas
Explore
Atlas / MCP servers / ahmedkhaleel2004 / GitDiagram

GitDiagramBLOCK

mcp/ahmedkhaleel2004/gitdiagram
MCP server by ahmedkhaleel2004 · ai · architecture diagram · code · Audited 2026-10-14
⚑ Report / re-scanSource ↗

Visualize any GitHub codebase: free interactive architecture diagrams and one-minute explainer videos. Replace 'hub' with 'diagram' in any GitHub URL.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
5 3r · 2w · 0d
Transport
streamable-http
License
MIT
Stars
18,177
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Visualize any codebase: turn any public or private GitHub repository into an interactive architecture diagram, or watch it explained in a one-minute narrated video. AI agents can use it too, through the MCP server or the Markdown version of any diagram (gitdiagram.com/owner/repo.md).

[Try GitDiagram →](https://gitdiagram.com/) · Or replace hub with diagram in any GitHub repository URL.

[](https://gitdiagram.com/)

[](LICENSE) [](https://ko-fi.com/ahmedkhaleel2004)

Sponsored SMS, WhatsApp, and RCS through one API. Try Sent →

New: explainer videos

GitDiagram can now turn a repository into a narrated video of about a minute. The video starts with what the project is for and what people do with it, then shows briefly how its main parts fit together and one decision under the hood.

[](https://gitdiagram.com/ahmedkhaleel2004/gitdiagram/video)

  • [Watch the gallery →](https://gitdiagram.com/videos) or add /video to any diagram URL, such as gitdiagram.com/owner/repo/video.
  • Download an MP4 in landscape or vertical (9:16), with captions burned in.
  • Making new videos is in early access. Anyone can watch videos that already exist.

Features

  • Watch a repository explained in a narrated video, or press Video on any diagram page.
  • *
Read from source at commit bba2a4fa4828OBSERVED · 2026-10-14
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add gitdiagram-render --env ANTHROPIC_ADMIN_KEY=${ANTHROPIC_ADMIN_KEY} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CACHE_KEY_SECRET=${CACHE_KEY_SECRET} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} -- npx -y gitdiagram-render
claude-desktop
{
  "mcpServers": {
    "gitdiagram-render": {
      "command": "npx",
      "args": [
        "-y",
        "gitdiagram-render"
      ],
      "env": {
        "ANTHROPIC_ADMIN_KEY": "${ANTHROPIC_ADMIN_KEY}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "CACHE_KEY_SECRET": "${CACHE_KEY_SECRET}",
        "CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}"
      }
    }
  }
}
03

Exposed tools (5)

3 read · 2 write · 0 destructive.

ToolRiskDescription
GitDiagramreadRead selected repositories to generate architecture diagrams
find_repository_diagramsread
get_explainer_videoread
write_scriptwriteDIRECTOR only: submit the film
write_shotswriteDESIGNER only: submit the exact shots for the beats you were assigned.
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (10 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
src/features/mcp-app/diagram-payload.ts
diagram-payload.ts
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
experiments/video-whisper-workers-ai/lib.ts:21
/.env" ... fetch(
Why it matters. reads secrets in the same file that sends data out
HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
experiments/video-practical/previous-prompt.txt:8
The repository material (README, file tree, source excerpts) arrives between <repository_material> and </repository_material>. Pictures attached from the README, just before it, are repository materia
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
.env.example:166
# origin on Vercel, http://127.0.0.1:$PORT in a production container.
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
experiments/video-bespoke/frames.ts:16
const ORIGIN = process.env.STAGE_ORIGIN ?? "http://127.0.0.1:4599";
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
experiments/video-bespoke/render.ts:20
const origin = process.env.STAGE_ORIGIN ?? "http://127.0.0.1:4599";
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
experiments/video-haiku-designer/sheets.ts:16
const ORIGIN = process.env.STAGE_ORIGIN ?? "http://127.0.0.1:4599";
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
workers/presence/.dev.vars.example
.dev.vars.example
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.suspicious_name · CWE-1104
src/features/mcp-app/diagram-payload.test.ts
diagram-payload.test.ts
Why it matters. member named after an attack tool
Fix. remove or justify
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/lib/chunk-reload.test.ts:23
new Function("window", chunkReloadScript)(win);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/lib/colo-cache.test.ts:104
createHash("md5")
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/server/generate/source-context.test.ts:17
createHash("sha1")
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/lib/cloudflare-edge.test.ts:185
"/.aws/credentials",
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
src/lib/cloudflare-edge.test.ts:186
"/s3/.aws/config",
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
experiments/video-whisper-workers-ai/analyze.ts:31
const { narrateBeats } = await import("../../src/server/explainer/narration");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
experiments/video-whisper-workers-ai/voice-stub.ts:8
} from "../../src/server/explainer/voice-alignment";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/components/generation/diagram-connections.test.tsx:75
expect(evidenceUrl("owner/repo", "../../evil/x.ts")).toBe(
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/sponsor-creative.test.ts:8
const root = new URL("../../", import.meta.url);
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/sponsor-readme.test.ts:9
const root = new URL("../../", import.meta.url);
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/server/explainer/readme-images.test.ts:277
"169.254.169.254",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
src/server/explainer/readme-images.test.ts:407
dns.set("inside.example.com", ["169.254.169.254"]);
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/dev-setup.md:139
The same source can be redeployed to Railway later through `Dockerfile` and `railway.json`. Those files are an offline recovery recipe, not a live standby. The container uses Next.js standalone output
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/server/generate/repository-context.parity.test.ts:301
["api/service.go", "blob"],
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/server/generate/repository-context.parity.test.ts:305
["api/service.go", { sha: "a".repeat(40), size: 127_000 }],

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha bba2a4fa4828full audit observations/trust-audit/mcp-server/ahmedkhaleel2004__gitdiagram.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-14bba2a4fa4828BLOCKD69first audit
06

Questions

What is the GitDiagram MCP server?

Visualize any GitHub codebase: free interactive architecture diagrams and one-minute explainer videos. Replace 'hub' with 'diagram' in any GitHub URL.

What tools does GitDiagram expose?

5 in total: 3 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is GitDiagram safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does GitDiagram need?

It reads ANTHROPIC_ADMIN_KEY, ANTHROPIC_API_KEY, CACHE_KEY_SECRET, CLOUDFLARE_API_TOKEN, CRON_SECRET, GLOBALPING_TOKEN, INDEXNOW_KEY, NEXT_PUBLIC_POSTHOG_KEY, OPENAI_API_KEY, OPENAI_COMPLIMENTARY_DAILY_LIMIT_TOKENS, OPENROUTER_API_KEY and PAGESPEED_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does GitDiagram run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as gitdiagram-render.

How current is this page?

The grade is for one exact copy of the source (bba2a4fa4828), read on 2026-10-14. The repository is watched and re-audited when it changes.

Advertisement